URL:
  <http://savannah.cern.ch/support/?126060>

                 Summary: gsi auth plugin caches (expired) host certificate?
                 Project: XROOTD
            Submitted by: iven
            Submitted on: 2012-02-03 08:55
                Category: None
                Priority: 5 - Normal
                Severity: 3 - Normal
                  Status: None
                 Privacy: Public
             Assigned to: None
        Originator Email: 
             Open/Closed: Open
         Discussion Lock: Any
        Operating System: GNU/Linux

    _______________________________________________________

Details:

xrootd-server-3.0.4-0
openssl-0.9.8e-20.el5

GSI authentication failed with messages such as

120203 00:00:25 6150 XrootdXeq: User authentication failed; Secgsi:
ErrParseBuffer: certificate has expired - go and get a new one: kXGC_certreq

Nevertheless, the certificate on disk had been renewed:

[root@c2atlassrv301 ~]# grep /xrootd-server-cert.pem /etc/xrd.cf
sec.protocol gsi -crl:3
-cert:/etc/grid-security/xrootd-server/xrootd-server-cert.pem
-key:/etc/grid-security/xrootd-server/xrootd-server-key.pem
-gridmap:/etc/grid-security/grid-mapfile -d:0 -gmapopt:2

[root@c2atlassrv301 ~]# ll
/etc/grid-security/xrootd-server/xrootd-server-cert.pem
-rw-r--r-- 1 stage st 2422 Jan 30 09:37
/etc/grid-security/xrootd-server/xrootd-server-cert.pem


[root@c2atlassrv301 ~]# openssl x509 -in
/etc/grid-security/xrootd-server/xrootd-server-cert.pem -noout -enddate
notAfter=Jan 22 16:15:40 2013 GMT

However, the daemon had not been restarted afterwards:

[root@c2atlassrv301 ~]# ps axo lstart,pid,cmd | grep xroot
Tue Jan 17 11:01:03 2012  6150 /opt/xrootd/bin/xrootd -n manager -r -c
/etc/xrd.cf -l /var/log/xroot/xrdlog.manager -b -R stage


Would it be possible to stat() and re-read the host certificate+key
occasionally (of course, this should be cached for some reasonable time, i.e.
not re-read at every connection), and at least in case the certificate appears
to be expired?

Or would this be already fixed in a more recent xrootd release?





    _______________________________________________________

Reply to this item at:

  <http://savannah.cern.ch/support/?126060>

_______________________________________________
  Message sent via/by LCG Savannah
  http://savannah.cern.ch/

########################################################################
Use REPLY-ALL to reply to list

To unsubscribe from the XROOTD-DEV list, click the following link:
https://listserv.slac.stanford.edu/cgi-bin/wa?SUBED1=XROOTD-DEV&A=1