Hi Jan,
My bad, I used the wrong port on the local server.
With the correct port number it does work locally.
Via the SSH tunnel I still can't get it working with other protocols than 2:
bart@laptop01:~$ ssh -vvvv -L 8530:db01:8530 admin@jumphost -N
bart@laptop01:~$ arangorestore --ssl.protocol 5 --server.endpoint
ssl://localhost:8530
--server.authentication true --server.username root
--include-system-collections false --server.database testdb
--create-database false --input-directory ./arangodump_2017-03-08
Please specify a password:
2017-03-09T12:02:23Z [5389] ERROR Could not connect to endpoint http+ssl:
//127.0.0.1:7530
2017-03-09T12:02:23Z [5389] FATAL Could not connect to
'http+ssl://127.0.0.1:7530' 'connect() failed with #111 - Connection
refused''
This is the verbose output of the SSH tunnel during the arangorestore
operation:
debug1: Connection to port 8530 forwarding to db01 port 8530 requested.
debug2: fd 6 setting TCP_NODELAY
debug2: fd 6 setting O_NONBLOCK
debug3: fd 6 is O_NONBLOCK
debug1: channel 2: new [direct-tcpip]
debug2: channel 2: open confirm rwindow 2097152 rmax 32768
debug2: channel 2: rcvd eof
debug2: channel 2: output open -> drain
debug2: channel 2: obuf empty
debug2: channel 2: close_write
debug2: channel 2: output drain -> closed
debug2: channel 2: read<=0 rfd 6 len 0
debug2: channel 2: read failed
debug2: channel 2: close_read
debug2: channel 2: input open -> drain
debug2: channel 2: ibuf empty
debug2: channel 2: send eof
debug2: channel 2: input drain -> closed
debug2: channel 2: send close
debug3: channel 2: will not send data after close
debug2: channel 2: rcvd close
debug3: channel 2: will not send data after close
debug2: channel 2: is dead
debug2: channel 2: garbage collecting
debug1: channel 2: free: direct-tcpip: listening port 8530 for db01 port
8530, connect from 127.0.0.1 port 36661 to 127.0.0.1 port 8530, nchannels 3
debug3: channel 2: status: The following connections are open:
#2 direct-tcpip: listening port 8530 for db01 port 8530, connect from
127.0.0.1 port 36661 to 127.0.0.1 port 8530 (t4 r0 i3/0 o3/0 fd 6/6 cc -1)
Thanks,
Bart
On Thursday, March 9, 2017 at 12:58:48 PM UTC+1, Jan wrote:
>
> Hi,
>
> can you also try setting `--ssl.protocol 5` when invoking arangorestore?
>
> arangorestore --server.endpoint ssl://localhost:8530
> --server.authentication true --server.username root
> --include-system-collections false --server.database testdb
> --create-database false --input-directory ./arangodump_2017-03-08
> --ssl.protocol 5
>
> Thanks
> Jan
>
>
> Am Donnerstag, 9. März 2017 12:49:19 UTC+1 schrieb Bart DS:
>>
>> Hi Jan,
>>
>> I tried to perform the restore locally on an ArangoDB v3.1.13 server
>> without any SSL tunnels and I have the same issue.
>>
>> According to the docs the default SSL protocol for the server should be 4
>> (TLSv1):
>>
>>> The default *value* is 4 (i.e. TLSv1). If available, set it to 5 (i.e.
>>> TLSv1.2), because lower protocol versions are known to be vulnerable to
>>> POODLE attack variants.
>>>
>>
>> In the arangod.conf file of my server it is set to 5 however:
>>
>> [ssl]
>> keyfile=/etc/arangodb3/server.pem
>> protocol=5
>>
>>
>> In the logs I see the following output:
>>
>> 2017-03-08T00:56:41Z [3484] INFO ArangoDB 3.1.13 [linux] 64bit, using
>> VPack 0.1.30, ICU 54.1, V8 5.0.71.39, OpenSSL 1.0.2g 1 Mar 2016
>> 2017-03-08T00:56:41Z [3484] INFO file-descriptors (nofiles) hard limit is
>> 131072, soft limit is 131072
>> 2017-03-08T00:56:41Z [3484] INFO JavaScript using startup
>> '/usr/share/arangodb3/js', application '/var/lib/arangodb3-apps'
>> 2017-03-08T00:56:43Z [3517] INFO ArangoDB 3.1.13 [linux] 64bit, using
>> VPack 0.1.30, ICU 54.1, V8 5.0.71.39, OpenSSL 1.0.2g 1 Mar 2016
>> 2017-03-08T00:56:43Z [3517] INFO using SSL options:
>> SSL_OP_CIPHER_SERVER_PREFERENCE, SSL_OP_TLS_ROLLBACK_BUG
>> 2017-03-08T00:56:43Z [3517] INFO Starting up with role SINGLE
>> 2017-03-08T00:56:43Z [3517] INFO Authentication is turned on
>> 2017-03-08T00:56:43Z [3517] INFO Authentication system only
>> 2017-03-08T00:56:43Z [3517] INFO Authentication for unix sockets is
>> turned on
>> 2017-03-08T00:56:43Z [3517] INFO file-descriptors (nofiles) hard limit is
>> 131072, soft limit is 131072
>> 2017-03-08T00:56:43Z [3517] INFO JavaScript using startup
>> '/usr/share/arangodb3/js', application '/var/lib/arangodb3-apps'
>> 2017-03-08T00:56:44Z [3517] INFO using endpoint 'http+ssl://0.0.0.0:8530'
>> for ssl-encrypted requests
>> 2017-03-08T00:56:44Z [3517] INFO ArangoDB (version 3.1.13 [linux]) is
>> ready for business. Have fun!
>> 2017-03-08T00:57:50Z [3517] ERROR {communication} unable to perform ssl
>> handshake: wrong version number : 336130315
>> 2017-03-09T08:14:25Z [3517] ERROR {communication} unable to perform ssl
>> handshake: wrong version number : 336109835
>> 2017-03-09T08:32:51Z [3517] ERROR {communication} unable to perform ssl
>> handshake: wrong version number : 336109835
>> 2017-03-09T10:51:40Z [3517] ERROR {communication} unable to perform ssl
>> handshake: wrong version number : 336109835
>> 2017-03-09T10:52:31Z [3517] ERROR {communication} unable to perform ssl
>> handshake: wrong version number : 336109835
>>
>>
>> Thanks.
>>
>> Bart
>>
>>
>> On Thursday, March 9, 2017 at 12:22:48 PM UTC+1, Bart DS wrote:
>>>
>>> Hi Jan,
>>>
>>> Apparently the issue was caused by the default SSL protocol used by
>>> arangorestore.
>>> When specifying --ssl.protocol 2 (which is obviously less secure) the
>>> restore succeeds.
>>>
>>> What I forgot to mention in my initial post is that I'm performing the
>>> restore over an SSL tunnel.
>>> So probably the culprit is the SSL tunnel which isn't correctly
>>> configured to accept more secure protocols such as TLS
>>>
>>> Thanks.
>>>
>>> Bart
>>>
>>> On Thursday, March 9, 2017 at 10:08:28 AM UTC+1, Jan wrote:
>>>>
>>>> Hi,
>>>>
>>>> I tried this locally on an Ubuntu Linux with 3.0.12 and default
>>>> configuration files and the above commands and did not encounter any
>>>> problems.
>>>>
>>>> arangodump and arangorestore use the same underlying connection code,
>>>> so I am wondering whether creating the dump over SSL with arangodump has
>>>> worked.
>>>> Are there any SSL-related configuration options for arangod in your
>>>> start script or arangod's configuration file?
>>>>
>>>> Can you also post on which platform you run it on plus the output of
>>>> `arangorestore --version`. This will show some library version numbers.
>>>> Thanks!
>>>> Jan
>>>>
>>>>
>>>> Am Donnerstag, 9. März 2017 09:43:08 UTC+1 schrieb Bart DS:
>>>>>
>>>>> Hi,
>>>>>
>>>>> I can't restore a database dump over SSL:
>>>>>
>>>>> arangorestore --server.endpoint ssl://localhost:8530
>>>>> --server.authentication true --server.username root
>>>>> --include-system-collections false --server.database testdb
>>>>> --create-database false --input-directory ./arangodump_2017-03-08
>>>>>
>>>>> Please specify a password:
>>>>> 2017-03-09T08:14:25Z [11029] ERROR Could not connect to endpoint http+
>>>>> ssl://localhost:8530
>>>>> 2017-03-09T08:14:25Z [11029] FATAL Could not connect to
>>>>> 'http+ssl://localhost:8530' 'SSL: during SSL_connect: 0 - Success''
>>>>>
>>>>>
>>>>> I can connect to the web interface on https://localhost:8530 and I am
>>>>> also able to connect and restore when not using SSL.
>>>>>
>>>>> ArangoDB version is 3.0.12 with a self-signed certificate
>>>>>
>>>>> Thanks,
>>>>>
>>>>> Bart
>>>>>
>>>>
--
You received this message because you are subscribed to the Google Groups
"ArangoDB" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
