Re: OpenNMS HTTPS Monitor & IIS Rejecting connections

Hi All,

Figured out what it was in the end – I had “Require Server name indication” on all websites on IIS – That caused IIS just to reject any connection attempt which was directly to the IP.

Weird, you think it would make sense for it to accept the connection and check for an SNI at least before rejecting it!

Also I am using the org.opennms.netmgt.poller.monitors.HttpsMonitor class – I suspect the log entries that say http may be misleading!

Cheers

Joe.

From: Jonathan Heard [mailto:[email protected]]
Sent: 21 August 2017 14:26
To: [email protected]
Subject: Re: [opennms-discuss] OpenNMS HTTPS Monitor & IIS Rejecting connections

Hi Joe,

    I'm no IIS expert, but TLS/SSL can only be established using recognised names, so you'd typically not have an SSL certificate for the host's IP address unless you know that it's static and have issued the certificate to include the IP as one of the alternative names on the cert... Just maybe that's what's bothering curl??
Other thing to consider is Windows Firewall - I believe you could configure it to only allow requests to the hostname through. I'm assuming you've already checked that joe.test.co.uk definitely always resolves to the same IP Address as you're testing, and that you've done the curl tests from the OpenNMS host.

Regarding the monitor - From the stack, it looks to me like you're using HttpMonitor rather than HttpsMonitor which could be an issue (although it also looks from the stack like it's attempting to establish an SSL connection anyway).. Perhaps it's worth changing the class to the HttpsMonitor to see if that helps.
I'd also remove the leading and trailing spaces from the host-name value in case that's causing odd behaviour.

With my recent experiencing of trying to reload pollerd config on-the-fly, I'd not trust that such changes as above will actually take effect until OpenNMS is restarted.

I hope these ideas are useful in determining the cause of your problem.

Regards
Jonathan
On 21/08/17 13:21, Madden, Joe wrote:
Hi all,

The latest version of IIS seems to be giving me some headache on monitoring using OpenNMS.

Our IIS runs three web services using server name indication. Each one is a TLS website on port 443.


Our webserver will respond with this:

https://joe.test.co.uk/login.asp<https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fjoe.test.co.uk%2Flogin.asp&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ce2c6a27b7b374169a2de08d4e8ade5d1%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=kDZOQuZxAyGf8ytm5%2FtCDIL88NHBZzrjnImRdLAKmYQ%3D&reserved=0>
HTTP request sent, awaiting response... 200 OK
Length: 2591 (2.5K) [text/html]
Saving to: ‘login.asp’

but will not respond with this

https://192.168.201.30/login.asp<https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2F192.168.201.30%2Flogin.asp&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ce2c6a27b7b374169a2de08d4e8ade5d1%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=F6v%2FbyhuzaL4AWVuSUsY3kp5IpIaOHoXRrELcceACCI%3D&reserved=0>

Connecting to 192.168.201.30:443... connected.
Unable to establish SSL connection.

curl -1 https://192.168.201.30/login.asp<https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2F192.168.201.30%2Flogin.asp&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ce2c6a27b7b374169a2de08d4e8ade5d1%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=F6v%2FbyhuzaL4AWVuSUsY3kp5IpIaOHoXRrELcceACCI%3D&reserved=0>
curl: (35) TCP connection reset by peer

It seems that IIS rejects the connection when attempted to connect to via IP address. Does anyone have any what setting I need to change to permit it to connect via IP (And then use the SNI to check which server it actually services up)

The server I have setup is below – and it gets the java connection error message as below. I guess it falls into the same issue.


  <service name="CAB - TssPlansRegistry" interval="60000" user-defined="false" status="on">
         <parameter key="host-name" value=" joe.test.co.uk "/>
         <parameter key="retry" value="3"/>
         <parameter key="timeout" value="5000"/>
         <parameter key="port" value="443"/>
         <parameter key="url" value="/login.asp"/>
         <parameter key="response" value="200"/>
   </service>

2017-08-21 12:15:29,769 WARN  [pool-9-thread-298] o.o.n.p.m.HttpMonitor: SocketException while polling cab/192.168.201.30:CAB - TssPlansRegistry:443
java.net.SocketException: Connection reset
        at java.net.SocketInputStream.read(SocketInputStream.java:209) ~[?:1.8.0_112]
        at java.net.SocketInputStream.read(SocketInputStream.java:141) ~[?:1.8.0_112]
        at sun.security.ssl.InputRecord.readFully(InputRecord.java:465) ~[?:1.8.0_112]
        at sun.security.ssl.InputRecord.read(InputRecord.java:503) ~[?:1.8.0_112]
        at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:973) ~[?:1.8.0_112]
        at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375) ~[?:1.8.0_112]
        at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:747) ~[?:1.8.0_112]
        at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:123) ~[?:1.8.0_112]
        at java.io.OutputStream.write(OutputStream.java:75) ~[?:1.8.0_112]
        at org.opennms.netmgt.poller.monitors.HttpMonitor$HttpMonitorClient.sendHttpCommand(HttpMonitor.java:543) ~[opennms-services-20.0.1.jar:?]
        at org.opennms.netmgt.poller.monitors.HttpMonitor.poll(HttpMonitor.java:157) [opennms-services-20.0.1.jar:?]
        at org.opennms.netmgt.poller.client.rpc.PollerClientRpcModule$1.get(PollerClientRpcModule.java:77) [org.opennms.features.poller.client-rpc-20.0.1.jar:?]
        at org.opennms.netmgt.poller.client.rpc.PollerClientRpcModule$1.get(PollerClientRpcModule.java:71) [org.opennms.features.poller.client-rpc-20.0.1.jar:?]
        at java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java:1590) [?:1.8.0_112]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [?:1.8.0_112]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [?:1.8.0_112]
        at java.lang.Thread.run(Thread.java:745) [?:1.8.0_112]


Cheers for any help.

Joe.




------------------------------------------------------------------------------

Check out the vibrant tech community on one of the world's most

engaging tech sites, Slashdot.org! http://sdm.link/slashdot<https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsdm.link%2Fslashdot&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ce2c6a27b7b374169a2de08d4e8ade5d1%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=XhB%2BjoWg2AacKwfYwpr3VdsYel56wNDx9K6VJPegs6U%3D&reserved=0>




_______________________________________________

Please read the OpenNMS Mailing List FAQ:

http://www.opennms.org/index.php/Mailing_List_FAQ<https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.opennms.org%2Findex.php%2FMailing_List_FAQ&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ce2c6a27b7b374169a2de08d4e8ade5d1%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=%2FbZ2m0tShLOCu1CTnJiEyB3Sjp3%2FQ6nWk7WYkLzLURE%3D&reserved=0>



opennms-discuss mailing list



To *unsubscribe* or change your subscription options, see the bottom of this page:

https://lists.sourceforge.net/lists/listinfo/opennms-discuss<https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.sourceforge.net%2Flists%2Flistinfo%2Fopennms-discuss&data=01%7C01%7Cjoe.madden%40mottmac.com%7Ce2c6a27b7b374169a2de08d4e8ade5d1%7Ca2bed0c459574f73b0c2a811407590fb%7C0&sdata=hL1XVMj5wd4910jAYaehakIvvk2B5wG74ZQhJcBrEos%3D&reserved=0>

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot

_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/index.php/Mailing_List_FAQ

opennms-discuss mailing list

To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-discuss