Re: [Proftpd-user] can't connect to mariadb database, when the user requires SSL after update from 1.3.9 to 1.3.9a

>> >> There was a change to the mod_sql_mysql implementation with regards to configuring the client side TLS setup, for connecting via TLS to a MySQL/MariaDB; see:
>> >>
>> >>    https://github.com/proftpd/proftpd/issues/340
>> >>    https://github.com/proftpd/proftpd/commit/89becd5eee7dc857580addd71459655cc59d507b
>> >>
>> >> However, there was no intended change of user-visible behavior; the goal was simply to use the newer API provided by the client library in order to maintain the same TLS behavior.
>> >>
>> >> I'll try to reproduce the behavior you're seeing locally, try to narrow down what might be happening.
>> > 
>> > Thank you for the hint.
>> > After I added ssl-ca:/etc/ssl/certs to the SQLConnectInfo line,
>> > the mysql connection is encrypted and I can login to the mariadb.
>> > 
>> > Thank you very much for the link to the commit
>> > 
>> 
>> Is that new in proftp 1.3.9a in comparison to 1.3.9? I.e. should I 
>> mention that in the NEWS file?
>> 
>> Thanks,
>>    Hilmar
>
> I kind of have to chip in now, because:
>
> - this was already the case in 1.3.9 and I think even in some late 
> 1.3.8x version (I may be wrong on the last one)
> - this is not MariaDB-exclusive, I have had that with an Percona XtraDB 
> cluster as well

Correct.  Support for configuring the TLS setup in the SQLConnectInfo directive has been present since ProFTPD 1.3.6rc2; see:

  http://bugs.proftpd.org/show_bug.cgi?id=4200

What changed between 1.3.9 and 1.3.9a here is the internal MySQL/MariaDB client library API used to configure that TLS support, when connecting to the database.  I don't know why the original reporter's existing configuration worked, but did not after updating to 1.3.9a; that suggests that the client library used itself had some implementation differences.

When developing that patch to use the newer, non-deprecated APIs, I verified locally against a MySQL database, using libmysqlclient, but did not think to try using libmariadb and a MariaDB.  This difference in behavior makes me wonder what the libmariadb implementations, old and new, might look like.  I would have expected that configuring the trusted CAs would (and should) have been required from the beginning, regardless of the internal API change in 1.3.9a.

Cheers,
TJ


_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html