<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.extratest
{mso-style-name:extra_test;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Courier New";}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hi, I’m trying to use this plugin ‘check_mysql_avs’ with a mysql server (vdecmdb-as-01.sys.comcast.net) that is using TLS connections. With newer versions of mysql (I’m using Percona 5.7.19-log) there’s a setting called ‘require_secure_transport’
when set, prevents users to login unless they can connect using TLS. The user I’m testing with nagios@’op5%sys.comcast.net' has ‘require ssl’ in its configuration. I’ve been trying to get this check working (see below). I think that the certificate files
need to be on the OP5 servers for it to work. Is there a way to register them with the OP5 servers? The mysql server does have the certificate registered.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Here’s something that is odd and you’ll find blogs on this out there that discuss this (see link
<a href="https://www.percona.com/blog/2017/06/27/ssl-connections-in-mysql-5-7/">https://www.percona.com/blog/2017/06/27/ssl-connections-in-mysql-5-7/</a>). I can connect from another host with this command without providing the certificate information and
a connection will be created and will be encrypted. I’m wondering if you were to update the mysql client software on the OP5 servers that might solve the issue? I’m guessing that the script is written in Perl or Python so perhaps updating those RPM(s) may
solve it too? I’d be willing to test with you if you’d like.<o:p></o:p></p>
<p class="MsoNormal">-sh-4.2$ hostname<o:p></o:p></p>
<p class="MsoNormal">vdecmdbwst-ho-a2p.sys.comcast.net<o:p></o:p></p>
<p class="MsoNormal">-sh-4.2$ <b>mysql -h vdecmdb-as-01.sys.comcast.net -u nagios -pN3gi0spswd\)</b><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b>OP5 check definition<o:p></o:p></b></p>
<p class="MsoNormal">nagios!N3gi0spswd\)!streamer -l --ca-cert=/db/data/CA_NSO_2010.crt --cert=/db/data/vde_cmdb_east.crt --key=/db/data/vde_cmdb_east.key<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b>output<o:p></o:p></b></p>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Arial",sans-serif;color:#414141;background:#F7F5EF"> </span><span style="font-size:8.5pt;font-family:"Arial",sans-serif;color:#414141">on </span><span style="font-size:12.0pt;font-family:"Times New Roman",serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="background:#F2F2F2"><span style="font-size:10.0pt;font-family:"Courier New";color:#414141">_USER1_/check_mysql -H 10.146.0.137 -u nagios -p N3gi0spswd\) -d streamer -l --ca-cert=/db/data/CA_NSO_2010.crt --cert=/db/data/vde_cmdb_east.crt
--key=/db/data/vde_cmdb_east.key<o:p></o:p></span></p>
<p class="MsoNormal" style="background:#F2F2F2"><span style="font-size:10.0pt;font-family:"Courier New";color:#414141">Result code: CRITICAL<o:p></o:p></span></p>
<p class="MsoNormal" style="background:#F2F2F2"><span style="font-size:10.0pt;font-family:"Courier New";color:#414141">SSL connection error<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b>Mysql server<o:p></o:p></b></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">mysql> show global variables like "%ssl%";<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">+---------------+----------------------------+<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">| Variable_name | Value |<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">+---------------+----------------------------+<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">| have_openssl | YES |<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">| have_ssl | YES |<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">| ssl_ca | /db/data/CA_NSO_2010.crt |<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">| ssl_capath | |<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">| ssl_cert | /db/data/vde_cmdb_east.crt |<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">| ssl_cipher | |<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">| ssl_crl | |<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">| ssl_crlpath | |<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">| ssl_key | /db/data/vde_cmdb_east.key |<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">+---------------+----------------------------+<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New"">9 rows in set (0.00 sec)<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b><span style="color:black">Grant Edmunds</span></b><span style="color:black"> <br>
MySQL DBA<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">CVPI – Core Video Platform Integration<br>
</span><span style="font-size:12.0pt;color:black">303 712-3239</span><span style="color:black"><br>
</span><b><u><span style="font-size:10.0pt;color:blue">grant_edmunds@comcast.com</span></u></b><span style="color:#833C0B"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>