March 2021 - discuss - lists.mariadb.org

[Maria-discuss] Galera with TLS not happy.
by lejeczek 30 Mar '21

30 Mar '21

Hi guys. I'm trying to add encryption to my already working galera cluster and I've look at number of tutorials, official ones included. I've added these to configs: [mariadb] ssl_cert = /etc/my.cnf.d/certs/c8kubernode2.private.pawel.crt ssl_key = /etc/my.cnf.d/certs/c8kubernode2.private.pawel.key ssl_ca = /etc/my.cnf.d/certs/ca.crt [mysqld] wsrep_provider_options="socket.ssl=yes;socket.ssl_cert=/etc/my.cnf.d/certs/c8kubernode2.private.pawel.crt;socket.ssl_key=/etc/my.cnf.d/certs/c8kubernode2.private.pawel.key;socket.ssl_ca=/etc/my.cnf.d/certs/ca.crt" First server, above configs, starts okey with 'galera_new_cluster' but the second, I'm on Centos 8, when started as normal with systemd shows: ... 2021-03-29 17:33:34 0 [ERROR] WSREP: gcomm/src/asio_tcp.cpp:handshake_handler():128: handshake with remote endpoint ssl://10.1.1.223:4567 failed: asio.ssl:337047686: 'certificate verify failed' ( 337047686: 'error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed') 2021-03-29 17:33:36 0 [ERROR] WSREP: gcomm/src/asio_tcp.cpp:handshake_handler():128: handshake with remote endpoint ssl://10.1.1.223:4567 failed: asio.ssl:337047686: 'certificate verify failed' ( 337047686: 'error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed') ... and eventually after a moment fails. The second server has the same bits in configs only, naturally, files names are different respectively. I also see this, in case might tell more or be relevant, this is on 'galera_new_cluster' up & running: -> $ mysql --ssl -h c8kubernode2.private.pawel -u wordpress -p --ssl-verify-server-cert=true Enter password: ERROR 2026 (HY000): SSL connection error: self signed certificate in certificate chain -> $ mysql --ssl -h c8kubernode2.private.pawel -u wordpress -p --ssl-verify-server-cert=false Enter password: Welcome to the MariaDB monitor. Commands end with ; or \g. But if this is 'CN' problem then looking at the mysql server cert: -> $ _my._sslPrintCert.sh c8kubernode2.private.pawel.crt issuer=CN = "nodemaster.private.pawel," # <= here, it matches server's hostname as expected. subject=CN = c8kubernode2.private.pawel notAfter=Jul 2 20:50:57 2023 GMT Certificate: ... Also, in case it might matter, I do not have as you can see [sst] bits done yet. Any ideas someone cares to share I'll appreciate. many thanks, L.

1 0

[Maria-discuss] Introduction and Task Suggestion
by Hemant Kumar Singh 22 Mar '21

22 Mar '21

Hi everyone, I am Hemant from Nepal, currently a Computer Science Junior at NIT Warangal, India willing to take part in GSoC 2021. I saw a major priority task "MDEV-13648- Add FULL OUTER JOIN to MariaDB (https://link.getmailspring.com/link/F02B618E-9401-406B-BD92-A573A39AD858@ge…)" unresolved since gsoc 2019; but it's not listed in 2021 List of Ideas. So, I was just wondering whether I can contribute to this task for gsoc 2021. Can anyone confirm this? Regards, Hemant Kumar Singh https://iamhks.com (https://link.getmailspring.com/link/F02B618E-9401-406B-BD92-A573A39AD858@ge…)

3 3

[Maria-discuss] Is it possible to upgrade SHA-1 and MD5 algorithms in Mariadb-10.5?
by Lukas Javorsky 22 Mar '21

22 Mar '21

Hi, In RHEL-9 we are deprecating, old SHA-1 and MD5 and that's why I want to ask you if there is any chance that upstream is going to change it, or we should do it downstream. These algorithms are no longer considered as safe, so it may be a good thing to upgrade them. AFAIK mariadb uses these algorithms in *mariadb* and *mariadb-connector-c.* Also if you have no intention to change it, is there any chance you could help us somehow. Maybe point out what we should be aware of. Please let me know what you think Lukas -- S pozdravom/ Best regards Lukáš Javorský Associate Software Engineer, Core service - Databases Red Hat <https://www.redhat.com> Purkyňova 115 (TPB-C) 612 00 Brno - Královo Pole ljavorsk(a)redhat.com <https://www.redhat.com>

5 8

[Maria-discuss] Why does MariaDB needs SELinux capability for setuid/setgid?
by Lukas Javorsky 16 Mar '21

16 Mar '21

Hi guys, I'm looking into SELinux in Fedora's MariaDB package and I can see that we have two types in MariaDB that have setuid/setgid capability. 1st: https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/module… 2nd: https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/module… My question is, does mysqld_t need to have this capability? I found that setuid/setgid is used inside mysqld_safe_helper (mariadbd-safe-helper). Are there any other cases when MariaDB uses these functions? Thank you for letting me know Lukas -- S pozdravom/ Best regards Lukáš Javorský Associate Software Engineer, Core service - Databases Red Hat <https://www.redhat.com> Purkyňova 115 (TPB-C) 612 00 Brno - Královo Pole ljavorsk(a)redhat.com <https://www.redhat.com>

3 5

[Maria-discuss] Problem with InnoDB: Semaphore wait after upgrading to 10.3.27
by Conor Murphy 16 Mar '21

16 Mar '21

Hi, We have a handful of servers running MariaDB 10.3. We noticed issues on two of them where we were getting issues like "InnoDB: A long semaphore wait:--Thread 140602802394880 has waited at dict0stats.cc line 1969 for 241.00 seconds the semaphore:" and crashes like "ERROR] [FATAL] InnoDB: Semaphore wait has lasted > 600 seconds. We intentionally crash the server because it appears to be hung.210215 7:14:24 [ERROR] mysqld got signal 6 ;" Turned out that these two servers were running 10.3.27 whereas the others were running 10.3.17. After downgrading the two problem servers to 10.3.17, all the issues with InnoDB semaphores stopped. Any ideas on how to track down what change between 10.3.17 to 10.3.27 might be causing this problem? Thanks, Conor

3 4

[Maria-discuss] RocksDB doubt
by Roberto Spadim 04 Mar '21

04 Mar '21

Hi folks! Could be possible write/read from rocksdb and at the same machine have a mariadb+myrocksdb running? -- Roberto Spadim

1 0