Please convert to use the system's crypto policy for SSL and TLS: https://fedoraproject.org/wiki/Changes/CryptoPolicy#Scope If this program is compiled against gnutls, change the default priority string to be "@SYSTEM" or to use gnutls_set_default_priority(). If this program is compiled against openssl, and there is no default cipher list specified, you don't need to modify it. Otherwise replace the default cipher list with "PROFILE=SYSTEM". If this program obtains its cipher list (or priority) using a configuration file, please update the shipped configuration files with the appropriate string that sets the system policy. In all cases please verify (as described in the URL above) that the application uses the system's crypto profiles. Please contact me for any questions.
A quick reminder; this is a blocker for #1076390. if you have no resources to pursue that please contact me.
why was this assigned to me? I don't work on this stuff
You are the listed maintainer of the package. If you are not please orphan it.
oh. sadly I no longer have the resources needed to maintain this. I also don't know how to orphan it
Please go to: https://admin.fedoraproject.org/pkgdb/package/mod_gnutls/ login, and then press orphan package.
please eric, can you to approve me as maintainer and contact person for this package? instead of orphaning as i already have commit rights
This package has changed ownership in the Fedora Package Database. Reassigning to the new owner of this component.
I've left myself as an admin. at some point I will have enough time to set up my RPM packaging environment again and will be happy to give this package some love
i can take care of packaging part, can you help me with 'impementation part'? is it problem of autotools configuration or is needed change in code?
For that change, the only thing needed is to put the "@SYSTEM" string in the GnuTLSPriorities of the default configuration file.
this way? ######### [indy@dhcp-27-216 mod_gnutls]$ cat mod_gnutls.conf LoadModule gnutls_module modules/mod_gnutls.so GnuTLSCache dbm "/var/cache/mod_gnutls" GnuTLSCacheTimeout 300 GnuTLSPriorities "@SYSTEM"
That seems right.
mod_gnutls-0.5.10-13.el7 has been submitted as an update for Fedora EPEL 7. https://admin.fedoraproject.org/updates/mod_gnutls-0.5.10-13.el7
mod_gnutls-0.5.10-13.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/mod_gnutls-0.5.10-13.fc19
mod_gnutls-0.5.10-13.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/mod_gnutls-0.5.10-13.fc20
mod_gnutls-0.5.10-13.fc21 has been submitted as an update for Fedora 21. https://admin.fedoraproject.org/updates/mod_gnutls-0.5.10-13.fc21
I haven't checked the package, but please note that this is a fedora 21 only feature. The @SYSTEM will not work on any other system than Fedora 21 (or rawhide).
Package mod_gnutls-0.5.10-13.fc21: * should fix your issue, * was pushed to the Fedora 21 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing mod_gnutls-0.5.10-13.fc21' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2014-10766/mod_gnutls-0.5.10-13.fc21 then log in and leave karma (feedback).
thanks, unpushed from epel7 and fedora 19, 20. (In reply to Nikos Mavrogiannopoulos from comment #17) > I haven't checked the package, but please note that this is a fedora 21 only > feature. The @SYSTEM will not work on any other system than Fedora 21 (or > rawhide).
mod_gnutls-0.5.10-14.el7 has been submitted as an update for Fedora EPEL 7. https://admin.fedoraproject.org/updates/mod_gnutls-0.5.10-14.el7
mod_gnutls-0.5.10-14.fc21 has been submitted as an update for Fedora 21. https://admin.fedoraproject.org/updates/mod_gnutls-0.5.10-14.fc21
mod_gnutls-0.5.10-14.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/mod_gnutls-0.5.10-14.fc20
mod_gnutls-0.5.10-14.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/mod_gnutls-0.5.10-14.fc19
[root@jetson ~]# systemctl status httpd.service -l ● httpd.service - The Apache HTTP Server Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled) Active: failed (Result: exit-code) since Fri 2014-10-03 17:21:31 CEST; 4min 39s ago Process: 924 ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND (code=exited, status=1/FAILURE) Main PID: 924 (code=exited, status=1/FAILURE) Oct 03 17:21:31 jetson httpd[924]: AH00526: Syntax error on line 5 of /etc/httpd/conf.d/mod_gnutls.conf: Oct 03 17:21:31 jetson httpd[924]: GnuTLS: Syntax error parsing priorities string at: "@SYSTEM" Oct 03 17:21:31 jetson systemd[1]: httpd.service: main process exited, code=exited, status=1/FAILURE Oct 03 17:21:31 jetson systemd[1]: Failed to start The Apache HTTP Server. Oct 03 17:21:31 jetson systemd[1]: Unit httpd.service entered failed state.
checked on rawhide - same, @SYSTEM is not recognised
What is the output of: $ gnutls-cli -l --priority @SYSTEM in that system, I just tried it on a newly installed F21 and it lists the ciphersuites.
########### f21 ################ [root@localhost ~]# systemctl status httpd.service -l ● httpd.service - The Apache HTTP Server Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled) Active: failed (Result: exit-code) since Tue 2014-10-07 14:11:24 CEST; 10s ago Process: 963 ExecStop=/bin/kill -WINCH ${MAINPID} (code=exited, status=1/FAILURE) Process: 961 ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND (code=exited, status=1/FAILURE) Main PID: 961 (code=exited, status=1/FAILURE) Oct 07 14:11:24 localhost httpd[961]: AH00526: Syntax error on line 5 of /etc/httpd/conf.d/mod_gnutls.conf: Oct 07 14:11:24 localhost httpd[961]: GnuTLS: Syntax error parsing priorities string at: "@SYSTEM" Oct 07 14:11:24 localhost systemd[1]: httpd.service: main process exited, code=exited, status=1/FAILURE Oct 07 14:11:24 localhost kill[963]: kill: cannot find process "" Oct 07 14:11:24 localhost systemd[1]: httpd.service: control process exited, code=exited status=1 Oct 07 14:11:24 localhost systemd[1]: Failed to start The Apache HTTP Server. Oct 07 14:11:24 localhost systemd[1]: Unit httpd.service entered failed state. [root@localhost ~]# gnutls-cli -l --priority @SYSTEM Cipher suites for @SYSTEM TLS_ECDHE_RSA_AES_128_CBC_SHA1 0xc0, 0x13 SSL3.0 TLS_ECDHE_RSA_AES_128_CBC_SHA256 0xc0, 0x27 TLS1.0 TLS_ECDHE_RSA_CAMELLIA_128_CBC_SHA256 0xc0, 0x76 TLS1.0 TLS_ECDHE_RSA_AES_256_CBC_SHA1 0xc0, 0x14 SSL3.0 TLS_ECDHE_RSA_AES_256_CBC_SHA384 0xc0, 0x28 TLS1.0 TLS_ECDHE_RSA_CAMELLIA_256_CBC_SHA384 0xc0, 0x77 TLS1.0 TLS_ECDHE_RSA_3DES_EDE_CBC_SHA1 0xc0, 0x12 SSL3.0 TLS_ECDHE_RSA_ARCFOUR_128_SHA1 0xc0, 0x11 SSL3.0 TLS_ECDHE_ECDSA_AES_128_CBC_SHA1 0xc0, 0x09 SSL3.0 TLS_ECDHE_ECDSA_AES_128_CBC_SHA256 0xc0, 0x23 TLS1.0 TLS_ECDHE_ECDSA_CAMELLIA_128_CBC_SHA256 0xc0, 0x72 TLS1.0 TLS_ECDHE_ECDSA_AES_256_CBC_SHA1 0xc0, 0x0a SSL3.0 TLS_ECDHE_ECDSA_AES_256_CBC_SHA384 0xc0, 0x24 TLS1.0 TLS_ECDHE_ECDSA_CAMELLIA_256_CBC_SHA384 0xc0, 0x73 TLS1.0 TLS_ECDHE_ECDSA_3DES_EDE_CBC_SHA1 0xc0, 0x08 SSL3.0 TLS_ECDHE_ECDSA_ARCFOUR_128_SHA1 0xc0, 0x07 SSL3.0 TLS_RSA_AES_128_CBC_SHA1 0x00, 0x2f SSL3.0 TLS_RSA_AES_128_CBC_SHA256 0x00, 0x3c TLS1.0 TLS_RSA_CAMELLIA_128_CBC_SHA1 0x00, 0x41 SSL3.0 TLS_RSA_CAMELLIA_128_CBC_SHA256 0x00, 0xba TLS1.0 TLS_RSA_AES_256_CBC_SHA1 0x00, 0x35 SSL3.0 TLS_RSA_AES_256_CBC_SHA256 0x00, 0x3d TLS1.0 TLS_RSA_CAMELLIA_256_CBC_SHA1 0x00, 0x84 SSL3.0 TLS_RSA_CAMELLIA_256_CBC_SHA256 0x00, 0xc0 TLS1.0 TLS_RSA_3DES_EDE_CBC_SHA1 0x00, 0x0a SSL3.0 TLS_RSA_ARCFOUR_128_SHA1 0x00, 0x05 SSL3.0 TLS_DHE_RSA_AES_128_CBC_SHA1 0x00, 0x33 SSL3.0 TLS_DHE_RSA_AES_128_CBC_SHA256 0x00, 0x67 TLS1.0 TLS_DHE_RSA_CAMELLIA_128_CBC_SHA1 0x00, 0x45 SSL3.0 TLS_DHE_RSA_CAMELLIA_128_CBC_SHA256 0x00, 0xbe TLS1.0 TLS_DHE_RSA_AES_256_CBC_SHA1 0x00, 0x39 SSL3.0 TLS_DHE_RSA_AES_256_CBC_SHA256 0x00, 0x6b TLS1.0 TLS_DHE_RSA_CAMELLIA_256_CBC_SHA1 0x00, 0x88 SSL3.0 TLS_DHE_RSA_CAMELLIA_256_CBC_SHA256 0x00, 0xc4 TLS1.0 TLS_DHE_RSA_3DES_EDE_CBC_SHA1 0x00, 0x16 SSL3.0 TLS_DHE_DSS_AES_128_CBC_SHA1 0x00, 0x32 SSL3.0 TLS_DHE_DSS_AES_128_CBC_SHA256 0x00, 0x40 TLS1.0 TLS_DHE_DSS_CAMELLIA_128_CBC_SHA1 0x00, 0x44 SSL3.0 TLS_DHE_DSS_CAMELLIA_128_CBC_SHA256 0x00, 0xbd TLS1.0 TLS_DHE_DSS_AES_256_CBC_SHA1 0x00, 0x38 SSL3.0 TLS_DHE_DSS_AES_256_CBC_SHA256 0x00, 0x6a TLS1.0 TLS_DHE_DSS_CAMELLIA_256_CBC_SHA1 0x00, 0x87 SSL3.0 TLS_DHE_DSS_CAMELLIA_256_CBC_SHA256 0x00, 0xc3 TLS1.0 TLS_DHE_DSS_3DES_EDE_CBC_SHA1 0x00, 0x13 SSL3.0 TLS_DHE_DSS_ARCFOUR_128_SHA1 0x00, 0x66 SSL3.0 Certificate types: none Protocols: VERS-TLS1.2, VERS-TLS1.1, VERS-TLS1.0, VERS-SSL3.0, VERS-DTLS1.2, VERS-DTLS1.0 Compression: COMP-NULL Elliptic curves: CURVE-SECP256R1, CURVE-SECP384R1, CURVE-SECP521R1 PK-signatures: SIGN-RSA-SHA256, SIGN-DSA-SHA256, SIGN-ECDSA-SHA256, SIGN-RSA-SHA384, SIGN-ECDSA-SHA384, SIGN-RSA-SHA512, SIGN-ECDSA-SHA512, SIGN-RSA-SHA224, SIGN-DSA-SHA224, SIGN-ECDSA-SHA224, SIGN-RSA-SHA1, SIGN-DSA-SHA1, SIGN-ECDSA-SHA1 ############### rawhide ##################### [root@jetson kernel-yum]# systemctl status httpd.service -l ● httpd.service - The Apache HTTP Server Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled) Active: failed (Result: exit-code) since Tue 2014-10-07 14:14:20 CEST; 2s ago Process: 1765 ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND (code=exited, status=1/FAILURE) Main PID: 1765 (code=exited, status=1/FAILURE) Oct 07 14:14:20 jetson httpd[1765]: AH00526: Syntax error on line 5 of /etc/httpd/conf.d/mod_gnutls.conf: Oct 07 14:14:20 jetson httpd[1765]: GnuTLS: Syntax error parsing priorities string at: "@SYSTEM" Oct 07 14:14:20 jetson systemd[1]: httpd.service: main process exited, code=exited, status=1/FAILURE Oct 07 14:14:20 jetson systemd[1]: Failed to start The Apache HTTP Server. Oct 07 14:14:20 jetson systemd[1]: Unit httpd.service entered failed state. [root@jetson kernel-yum]# gnutls-cli -l --priority @SYSTEM Cipher suites for @SYSTEM TLS_ECDHE_RSA_AES_128_CBC_SHA1 0xc0, 0x13 SSL3.0 TLS_ECDHE_RSA_AES_128_CBC_SHA256 0xc0, 0x27 TLS1.0 TLS_ECDHE_RSA_CAMELLIA_128_CBC_SHA256 0xc0, 0x76 TLS1.0 TLS_ECDHE_RSA_AES_256_CBC_SHA1 0xc0, 0x14 SSL3.0 TLS_ECDHE_RSA_AES_256_CBC_SHA384 0xc0, 0x28 TLS1.0 TLS_ECDHE_RSA_CAMELLIA_256_CBC_SHA384 0xc0, 0x77 TLS1.0 TLS_ECDHE_RSA_3DES_EDE_CBC_SHA1 0xc0, 0x12 SSL3.0 TLS_ECDHE_RSA_ARCFOUR_128_SHA1 0xc0, 0x11 SSL3.0 TLS_ECDHE_ECDSA_AES_128_CBC_SHA1 0xc0, 0x09 SSL3.0 TLS_ECDHE_ECDSA_AES_128_CBC_SHA256 0xc0, 0x23 TLS1.0 TLS_ECDHE_ECDSA_CAMELLIA_128_CBC_SHA256 0xc0, 0x72 TLS1.0 TLS_ECDHE_ECDSA_AES_256_CBC_SHA1 0xc0, 0x0a SSL3.0 TLS_ECDHE_ECDSA_AES_256_CBC_SHA384 0xc0, 0x24 TLS1.0 TLS_ECDHE_ECDSA_CAMELLIA_256_CBC_SHA384 0xc0, 0x73 TLS1.0 TLS_ECDHE_ECDSA_3DES_EDE_CBC_SHA1 0xc0, 0x08 SSL3.0 TLS_ECDHE_ECDSA_ARCFOUR_128_SHA1 0xc0, 0x07 SSL3.0 TLS_RSA_AES_128_CBC_SHA1 0x00, 0x2f SSL3.0 TLS_RSA_AES_128_CBC_SHA256 0x00, 0x3c TLS1.0 TLS_RSA_CAMELLIA_128_CBC_SHA1 0x00, 0x41 SSL3.0 TLS_RSA_CAMELLIA_128_CBC_SHA256 0x00, 0xba TLS1.0 TLS_RSA_AES_256_CBC_SHA1 0x00, 0x35 SSL3.0 TLS_RSA_AES_256_CBC_SHA256 0x00, 0x3d TLS1.0 TLS_RSA_CAMELLIA_256_CBC_SHA1 0x00, 0x84 SSL3.0 TLS_RSA_CAMELLIA_256_CBC_SHA256 0x00, 0xc0 TLS1.0 TLS_RSA_3DES_EDE_CBC_SHA1 0x00, 0x0a SSL3.0 TLS_RSA_ARCFOUR_128_SHA1 0x00, 0x05 SSL3.0 TLS_DHE_RSA_AES_128_CBC_SHA1 0x00, 0x33 SSL3.0 TLS_DHE_RSA_AES_128_CBC_SHA256 0x00, 0x67 TLS1.0 TLS_DHE_RSA_CAMELLIA_128_CBC_SHA1 0x00, 0x45 SSL3.0 TLS_DHE_RSA_CAMELLIA_128_CBC_SHA256 0x00, 0xbe TLS1.0 TLS_DHE_RSA_AES_256_CBC_SHA1 0x00, 0x39 SSL3.0 TLS_DHE_RSA_AES_256_CBC_SHA256 0x00, 0x6b TLS1.0 TLS_DHE_RSA_CAMELLIA_256_CBC_SHA1 0x00, 0x88 SSL3.0 TLS_DHE_RSA_CAMELLIA_256_CBC_SHA256 0x00, 0xc4 TLS1.0 TLS_DHE_RSA_3DES_EDE_CBC_SHA1 0x00, 0x16 SSL3.0 TLS_DHE_DSS_AES_128_CBC_SHA1 0x00, 0x32 SSL3.0 TLS_DHE_DSS_AES_128_CBC_SHA256 0x00, 0x40 TLS1.0 TLS_DHE_DSS_CAMELLIA_128_CBC_SHA1 0x00, 0x44 SSL3.0 TLS_DHE_DSS_CAMELLIA_128_CBC_SHA256 0x00, 0xbd TLS1.0 TLS_DHE_DSS_AES_256_CBC_SHA1 0x00, 0x38 SSL3.0 TLS_DHE_DSS_AES_256_CBC_SHA256 0x00, 0x6a TLS1.0 TLS_DHE_DSS_CAMELLIA_256_CBC_SHA1 0x00, 0x87 SSL3.0 TLS_DHE_DSS_CAMELLIA_256_CBC_SHA256 0x00, 0xc3 TLS1.0 TLS_DHE_DSS_3DES_EDE_CBC_SHA1 0x00, 0x13 SSL3.0 TLS_DHE_DSS_ARCFOUR_128_SHA1 0x00, 0x66 SSL3.0 Certificate types: none Protocols: VERS-TLS1.2, VERS-TLS1.1, VERS-TLS1.0, VERS-SSL3.0, VERS-DTLS1.2, VERS-DTLS1.0 Compression: COMP-NULL Elliptic curves: CURVE-SECP256R1, CURVE-SECP384R1, CURVE-SECP521R1 PK-signatures: SIGN-RSA-SHA256, SIGN-DSA-SHA256, SIGN-ECDSA-SHA256, SIGN-RSA-SHA384, SIGN-ECDSA-SHA384, SIGN-RSA-SHA512, SIGN-ECDSA-SHA512, SIGN-RSA-SHA224, SIGN-DSA-SHA224, SIGN-ECDSA-SHA224, SIGN-RSA-SHA1, SIGN-DSA-SHA1, SIGN-ECDSA-SHA1
Could you try running "httpd -X" under strace? I'm afraid that this may be SE-linux related, and apache doesn't have the necessary permissions to open /etc/crypto-policies/back-ends/gnutls.config.
it seems related to fact that gnutlspriorities parsing was added 2-3 months before 0.6 release. i'm going to release 0.6.
mod_gnutls-0.6-1.el7 has been submitted as an update for Fedora EPEL 7. https://admin.fedoraproject.org/updates/mod_gnutls-0.6-1.el7
mod_gnutls-0.6-1.fc21 has been submitted as an update for Fedora 21. https://admin.fedoraproject.org/updates/mod_gnutls-0.6-1.fc21
mod_gnutls-0.6-1.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/mod_gnutls-0.6-1.fc20
Package mod_gnutls-0.6-1.el7: * should fix your issue, * was pushed to the Fedora EPEL 7 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=epel-testing mod_gnutls-0.6-1.el7' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-3300/mod_gnutls-0.6-1.el7 then log in and leave karma (feedback).
The builds referenced here cannot be found in koji.
mod_gnutls-0.6-1.el7 has been pushed to the Fedora EPEL 7 stable repository. If problems still persist, please make note of it in this bug report.
mod_gnutls-0.7-1.fc21 has been submitted as an update for Fedora 21. https://admin.fedoraproject.org/updates/mod_gnutls-0.7-1.fc21
mod_gnutls-0.7-2.fc21 has been submitted as an update for Fedora 21. https://admin.fedoraproject.org/updates/mod_gnutls-0.7-2.fc21
mod_gnutls-0.7-2.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.