Re: [HTCondor-users] Migration from 8.8.8 to 9.0.9, single user, non root, multi machine setup, help

[Todd Tannenbaum <tannenba@xxxxxxxxxxx>]

On 2/24/2022 7:44 PM, frankie.lc@xxxxxxxxx wrote:

To anyone getting here via Google,

I am still not entirely sure why SSL is failing, but I was able to overcome this by disabling the host check.

SSL_SKIP_HOST_CHECK = false

Hope this helps,

Francisco

    Hi Francisco,
    
    Glad you got it working!
    
    I think the trouble you ran into is normally an SSL host certificate
    will normally have the Common Name (CN) field set to be the fully qualified name
      for the system that uses the certificate (e.g. foo.myorg.com).  In
      the certificate below, it looks like CN is set to be "Example
      Condor", which is why you needed to tell HTCondor to "skip the
      host check" -- in the host check process, the client says "I want
      to connect to machine xxx.yyy.com", and then the client will
      confirm that the CN in the SSL certificate on the server also
      contains "xxx.yyy.com".    If the name of the machine the client
      connected to does not match the CN in the certificate, SSL
      authentication will fail unless you set "SSL_SKIP_HOST_CHECK".  
      
      Personally, I find SSL configuration to be very exasperating
      (whether it be for HTCondor, or a web server, or anything at all
      actually!), and for my own small HTCondor pools I would gravitate
      towards either POOL or IDTOKENS authentication. 
      
      
      Hope the above helps
      Todd

----

On Thu, Feb 24, 2022 at 2:13 AM Francisco Leite de Castro <frankie.lc@xxxxxxxxx> wrote:

Hi,

I run a small cluster of 4 machines as a non-root user. 

Upgrading to 9.0.9 I've been trying to get "condor_status" to work for a couple of days now, I haven't even tried multi-machines, but it's been to no avail, maybe someone here can help.

Relevant portion of condor_config

AUTH_SSL_SERVER_CAFILE =   /home/frankie/certs/ca_cert.crt
AUTH_SSL_SERVER_CERTFILE = /home/frankie/certs/condor.crt
AUTH_SSL_SERVER_KEYFILE =  /home/frankie/certs/condor.key

AUTH_SSL_CLIENT_CAFILE =   /home/frankie/certs/ca_cert.crt
AUTH_SSL_CLIENT_CERTFILE = /home/frankie/certs/condor.crt
AUTH_SSL_CLIENT_KEYFILE =  /home/frankie/certs/condor.key

SEC_DEFAULT_AUTHENTICATION = REQUIRED
SEC_DEFAULT_AUTHENTICATION_METHODS = SSL

SEC_DAEMON_AUTHENTICATION = REQUIRED
SEC_DAEMON_AUTHENTICATION_METHODS = SSL
SEC_DAEMON_INTEGRITY = REQUIRE
SEC_DAEMON_ENCRYPTION = REQUIRED

ALLOW_READ          = frankie@*
ALLOW_WRITE         = frankie@*
ALLOW_ADMINISTRATOR = frankie@*
ALLOW_CONDIG        = frankie@*
ALLOW_NEGOTIATOR    = frankie@*
ALLOW_DAEMON        = frankie@*

CERTIFICATE_MAPFILE = /home/frankie/certs/condor_mapfile

I have just this one entry on the mapfile:

SSL "/C=UK/L=London/CN=CAST Condor/emailAddress=frankie@xxxxxxxxxxx" frankie

If I do a "condor_q -debug" everything goes ok.

02/24/22 01:52:48 (fd:4) (pid:37179) (D_SECURITY) SSL authentication succeeded to /C=UK/L=London/CN=Example Condor/emailAddress=frankie@xxxxxxxxxxx
02/24/22 01:52:48 (fd:4) (pid:37179) (D_SECURITY) Authentication was a Success.
02/24/22 01:52:48 (fd:4) (pid:37179) (D_SECURITY) AUTHENTICATION: setting default map to ssl@unmapped
02/24/22 01:52:48 (fd:4) (pid:37179) (D_SECURITY) AUTHENTICATION: Parsing map file.
02/24/22 01:52:48 (fd:4) (pid:37179) (D_SECURITY) AUTHENTICATION: post-map: current FQU is 'frankie@xxxxxxxxxxxxxxxxx'

(...)

Total for query: 0 jobs; 0 completed, 0 removed, 0 idle, 0 running, 0 held, 0 suspended

If I do a "condor_status -debug" it fails with this:

02/24/22 01:54:17 (fd:4) (pid:37183) (D_SECURITY) Client trying post connection check.
02/24/22 01:54:17 (fd:4) (pid:37183) (D_SECURITY) SSL Auth: post_connection_check.
02/24/22 01:54:17 (fd:4) (pid:37183) (D_SECURITY) SSL_get_peer_certificate returned data.
02/24/22 01:54:17 (fd:4) (pid:37183) (D_SECURITY) No SSL host name specified.
02/24/22 01:54:17 (fd:4) (pid:37183) (D_SECURITY) SSL Auth: Error on check of peer certificate
02/24/22 01:54:17 (fd:4) (pid:37183) (D_SECURITY) SSL Auth: application verification failure
02/24/22 01:54:17 (fd:4) (pid:37183) (D_SECURITY) Client performs one last exchange of messages.
02/24/22 01:54:17 (fd:4) (pid:37183) (D_SECURITY) SSL Auth: SSL Authentication failed

(...)

Error: communication error
AUTHENTICATE:1003:Failed to authenticate with any method
AUTHENTICATE:1004:Failed to authenticate using SSL

I followed these directives to create the .crt files. The condor.crt file has this info:

Certificate:
    Data:
        Version: 3 (0x2)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = UK, L = London, CN =  Example Condor
        Validity
            Not Before: Feb 23 23:41:18 2022 GMT
            Not After : Feb 21 23:41:18 2032 GMT
        Subject: C = UK, L = London, CN =  Example Condor, emailAddress = frankie@xxxxxxxxxxx
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)

            (...)
            X509v3 Subject Alternative Name:
                DNS:localhost, DNS:box-1, DNS:box-1.example.com, IP Address:192.168.5.121
    Signature Algorithm: sha256WithRSAEncryption

I've tried, but can't figure if it's something I'm messing on the SSL side or on condor side.

Following the message "No SSL host name specified." we can trace the function here:

https://github.com/htcondor/htcondor/blob/master/src/condor_io/condor_auth_ssl.cpp

if (fqdn.empty()) {
    dprintf(D_SECURITY, "No SSL host name specified.\n");
    goto err_occured;
}

But it still leaves me empty-handed.

Can anyone spot what I'm doing wrong?

Many thanks,

Frankie

----

_______________________________________________
HTCondor-users mailing list
To unsubscribe, send a message to htcondor-users-request@xxxxxxxxxxx with a
subject: Unsubscribe
You can also unsubscribe by visiting
https://lists.cs.wisc.edu/mailman/listinfo/htcondor-users

The archives can be found at:
https://lists.cs.wisc.edu/archive/htcondor-users/

-- 
Todd Tannenbaum <tannenba@xxxxxxxxxxx>  University of Wisconsin-Madison
Center for High Throughput Computing    Department of Computer Sciences
Calendar: https://tinyurl.com/yd55mtgd  1210 W. Dayton St. Rm #4257
Phone: (608) 263-7132                   Madison, WI 53706-1685