Re: No agent heart beats after adding TLSv1 and TLSv1.1 to security.server.disabled.protocols

[Robert Levas]

Di Li…

I think there is a bug in the agent-side code that prevents it from using the 
other protocols…

See if this works for you:

1. Stop Ambari Agent

2. Edit /usr/lib/python2.6/site-packages/ambari_agent/alerts/web_alert.py and 
comment out (starting at or near line 56):
# patch ssl module to fix SSLv3 communication bug
# for more info see 
http://stackoverflow.com/questions/9835506/urllib-urlopen-works-on-sslv3-urls-with-python-2-6-6-on-1-machine-but-not-wit
def sslwrap(func):
    @wraps(func)
    def bar(*args, **kw):
        kw['ssl_version'] = ssl.PROTOCOL_TLSv1
        return func(*args, **kw)
    return bar
ssl.wrap_socket = sslwrap(ssl.wrap_socket)

3. Remove /usr/lib/python2.6/site-packages/ambari_agent/alerts/web_alert.pyc, 
note the *PYC* extension

4. Start Ambari Agent

NOTE: This may have a negative effect on connecting to hosts where SSLv3 is 
needed, but that may not be an issue for you.

Rob


On 6/30/16, 8:23 AM, "Di Li" <lovelyco...@yahoo.com.INVALID> wrote:

Hello folks,

I installed Ambari 2.2.0 on a single node cluster. I added TLSv1 and TLSv1.1 to 
the security.server.disabled.protocols list in ambari.properties. Once I have 
done that I found agents couldn't connect to the ambari server anymore, with 
the following error in ambari server log.

Does anyone know what I need to do to only allow TLSv1.2 ?

DEBUG [qtp-ambari-agent-54] nio:714 - EOF
org.eclipse.jetty.io.EofException
        at org.eclipse.jetty.http.HttpParser.fill(HttpParser.java:1050)
        at org.eclipse.jetty.http.HttpParser.parseNext(HttpParser.java:280)
        at org.eclipse.jetty.http.HttpParser.parseAvailable(HttpParser.java:235)
        at 
org.eclipse.jetty.server.AsyncHttpConnection.handle(AsyncHttpConnection.java:82)
        at org.eclipse.jetty.io.nio.SslConnection.handle(SslConnection.java:196)
        at 
org.eclipse.jetty.io.nio.SelectChannelEndPoint.handle(SelectChannelEndPoint.java:696)
        at 
org.eclipse.jetty.io.nio.SelectChannelEndPoint$1.run(SelectChannelEndPoint.java:53)
        at 
org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:608)
        at 
org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:543)
        at java.lang.Thread.run(Thread.java:745)
javax.net.ssl.SSLHandshakeException: Client requested protocol TLSv1 not 
enabled or not supported
        at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1431)
        at 
sun.security.ssl.SSLEngineImpl.checkTaskThrown(SSLEngineImpl.java:535)
        at 
sun.security.ssl.SSLEngineImpl.writeAppRecord(SSLEngineImpl.java:1214)
        at sun.security.ssl.SSLEngineImpl.wrap(SSLEngineImpl.java:1186)
        at javax.net.ssl.SSLEngine.wrap(SSLEngine.java:469)
        at org.eclipse.jetty.io.nio.SslConnection.wrap(SslConnection.java:465)
        at 
org.eclipse.jetty.io.nio.SslConnection.process(SslConnection.java:386)
        at 
org.eclipse.jetty.io.nio.SslConnection.access$900(SslConnection.java:48)
        at 
org.eclipse.jetty.io.nio.SslConnection$SslEndPoint.fill(SslConnection.java:715)
        at org.eclipse.jetty.http.HttpParser.fill(HttpParser.java:1044)
        at org.eclipse.jetty.http.HttpParser.parseNext(HttpParser.java:280)
        at org.eclipse.jetty.http.HttpParser.parseAvailable(HttpParser.java:235)
        at 
org.eclipse.jetty.server.AsyncHttpConnection.handle(AsyncHttpConnection.java:82)
        at org.eclipse.jetty.io.nio.SslConnection.handle(SslConnection.java:196)
        at 
org.eclipse.jetty.io.nio.SelectChannelEndPoint.handle(SelectChannelEndPoint.java:696)
        at 
org.eclipse.jetty.io.nio.SelectChannelEndPoint$1.run(SelectChannelEndPoint.java:53)
        at 
org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:608)
        at 
org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:543)
        at java.lang.Thread.run(Thread.java:745)


Thanks.

Di