Bug 40158 - self-service fails to connect to UMC in Amazon env
Summary: self-service fails to connect to UMC in Amazon env
Status: CLOSED INVALID
Alias: None
Product: UCS
Classification: Unclassified
Component: Self Service
Version: UCS 4.1
Hardware: Other Linux
: P5 normal
Target Milestone: UCS 4.1-0-errata
Assignee: Daniel Tröder
QA Contact: Florian Best
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-12-02 11:09 CET by Daniel Tröder
Modified: 2016-02-10 14:01 CET (History)
4 users (show)

See Also:
What kind of report is it?: ---
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Customer ID:
Max CVSS v3 score:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Daniel Tröder univentionstaff 2015-12-02 11:09:55 CET
Happens on our own EC2 instance:

[02/Dec/2015:09:52:43]  Authentication on UMC at ucs-master.mydomain.intranet failed: 'The Univention Management Console service could not be reached.'
[02/Dec/2015:09:52:52]  Socket error while accessing UMC at ucs-master.mydomain.intranet: [Errno 1] _ssl.c:504: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol

There are a lot of search hits about projects having problems with Python requests, proxies and TLS.

As a temporary workaround I changed HTTPSConnection to HTTPConnection in wsgi/lib.py in our VM. Not a problem, as it always connects to localhost anyway.
Comment 1 Benjamin Fels univentionstaff 2016-01-15 09:45:41 CET
Happened again with the demo EC2 instance for the Univention Summit Demopoint.
Comment 2 Daniel Tröder univentionstaff 2016-01-27 17:47:56 CET
A hackish (but not insecure) workaround for missing SSL options in Python < 2.7.9 is in r67025 (yaml 67026).
Comment 3 Florian Best univentionstaff 2016-02-04 13:20:55 CET
How can this be reproduced?

The solution doesn't work if apache2/force_https is set.
Comment 4 Florian Best univentionstaff 2016-02-04 14:35:00 CET
The problem exists when our squid proxy is between the communication:
root@ucs-master:~# ucr get proxy/http 
http://ucs-master.mydomain.intranet:3128
Comment 5 Florian Best univentionstaff 2016-02-04 16:29:26 CET
The problem is the wrong UCS configuration, the Images from presales are broken:
root@ucs-master:~# ucr get squid/transparentproxy 
true

This caused that all HTTPS traffic was send to the non-HTTPS-Squid-Proxy.

REOPEN: Please revert all changes.
Comment 6 Florian Best univentionstaff 2016-02-04 16:41:44 CET
See also Bug #35131 - which causes univention-squid to be broken.
Comment 7 Daniel Tröder univentionstaff 2016-02-04 16:42:14 CET
Changes reverted in commits 67204 and 67205.
Comment 8 Florian Best univentionstaff 2016-02-04 16:51:16 CET
OK: revert
Comment 9 Stefan Gohmann univentionstaff 2016-02-04 17:05:22 CET
That means the password reset can't be used if our squid package is installed and we should fix Bug #35131?
Comment 10 Florian Best univentionstaff 2016-02-04 17:15:54 CET
(In reply to Stefan Gohmann from comment #9)
> That means the password reset can't be used if our squid package is
> installed and we should fix Bug #35131?
Plus one must manually set squid/transparentproxy=true to break it. This was the case in some images which were used by professional services.
If the UCR variable is unset (which is the default) everything is fine.