[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#136052: marked as done (Cannot handle password protected keys)

Your message dated Thu, 30 Oct 2003 20:57:55 +0100 (CET)
with message-id <Pine.LNX.4.58.0310302055430.13268@trider-g7.ext.fabbione.net>
and subject line closing bugs
has caused the attached Bug report to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere.  Please contact me immediately.)

Debian bug tracking system administrator
(administrator, Debian Bugs database)

Received: (at submit) by bugs.debian.org; 27 Feb 2002 13:54:34 +0000
>From gebhardt@hrz.uni-marburg.de Wed Feb 27 07:54:34 2002
Return-path: <gebhardt@hrz.uni-marburg.de>
Received: from hrz.uni-marburg.de [] 
	by master.debian.org with esmtp (Exim 3.12 1 (Debian))
	id 16g4XS-0001KQ-00; Wed, 27 Feb 2002 07:54:34 -0600
Received: from pcrz175.HRZ.Uni-Marburg.DE (pcrz175.HRZ.Uni-Marburg.DE [])
	by HRZ.Uni-Marburg.DE (8.11.2/8.11.2) with ESMTP id g1RDrvQ33666
	for <submit@bugs.debian.org>; Wed, 27 Feb 2002 14:53:57 +0100
Received: from hrz.uni-marburg.de (localhost [])
	by pcrz175.HRZ.Uni-Marburg.DE (8.12.1/8.12.1/Debian -5) with ESMTP id g1RDru4W027179
	for <submit@bugs.debian.org>; Wed, 27 Feb 2002 14:53:56 +0100
Message-Id: <200202271353.g1RDru4W027179@pcrz175.HRZ.Uni-Marburg.DE>
X-Mailer: exmh version 2.3.1 01/18/2001 (debian 2.3.1-1) with nmh-1.0.4+dev
To: submit@bugs.debian.org
Subject: Cannot handle password protected keys
From: "Thomas Gebhardt" <gebhardt@HRZ.Uni-Marburg.DE>
X-Pmrqc: 1
X-Confirm-Reading-To: gebhardt@hrz.uni-marburg.de
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Wed, 27 Feb 2002 14:53:56 +0100
Sender: gebhardt@HRZ.Uni-Marburg.DE
X-MailScanner: Found to be clean
Delivered-To: submit@bugs.debian.org

Package: apache-ssl
Severity: important


it seems that apache-ssl/woody cannot handle password protected keys.
I discussed this in debian-security
tml) . Since no one could point out how to manage the problem, I conclude
that it is a flaw in the apache-ssl package.

Basically apache-ssl starts after prompting for the passphrase and
immediately dies with an error message that indicates that the server
key cannot be read (even if the passphrase was correct). I got this
behaviour on three systems that I upgraded from potato to testing.

How to reproduce the bug:

1. Install apache-ssl "apt-get install apache-ssl/testing" and
   let the postinst script create an selfsigned certificate,
   stored in /etc/apache-ssl/apache.pem

2. Test that the server works fine.

3. With a text editor split apache.pem into the certificate
   (cert.pem) and the key (key.pem). Redirect the symbolic link
   <hash>.0 from apache.pem to cert.pem in /etc/apache-ssl and
   edit httpd.conf:
   SSLCertificateFile /etc/apache-ssl/cert.pem
   SSLCertificateKeyFile /etc/apache-ssl/key.pem
   Make key.pem chmod 600 owned by root:root.

4. Check that the server still works fine.

5. Now provide a passphrase for the key file:
   # openssl rsa -des3 < key.pem > key-crypt.pem
   read RSA key
   writing RSA key
   Enter PEM pass phrase:
   Verifying password - Enter PEM pass phrase:
   # mv key-crypt.pem key.pem

   Make key.pem chmod 600 owned by root:root.

6. Try to start apache-ssl:
   ("/etc/init.d/apache-ssl start" won't work since isn't designed
    to work interactively)
   # /usr/sbin/apache-sslctl start
   Reading key for server <server>:443
   Enter PEM pass phrase:
   <enter passphrase here>
   Launching... /usr/lib/apache-ssl/gcache
   /usr/sbin/apache-sslctl start: httpsd started

   Seems to be ok, but the server isn't working.

   The error log says something like

[Wed Feb 27 14:43:40 2002] [crit] (22)Invalid argument: Error reading private 
key file /etc/apache-ssl/key.pem:
[Wed Feb 27 14:43:40 2002] [crit] error:0906406D:PEM 
routines:DEF_CALLBACK:problems getting password
[Wed Feb 27 14:43:40 2002] [crit] error:0906A068:PEM routines:PEM_do_header:bad
password read

    But the passphrase was ok, you get a warning when you type in
    the wrong passphrase:
    # /usr/sbin/apache-sslctl start
    Reading key for server <server>:443
    Enter PEM pass phrase:
    Bad passphrase - try again
    Enter PEM pass phrase:

I would appreciate if that could be fixed before woody is released.
In many circumstances it is necessary to protect the key not only
by file permissions but also by cryptography.

Cheers, Thomas
Th. Gebhardt (gebhardt@hrz.uni-marburg.de)
HRZ, Hans Meerwein Strasse,        Phone: +49-6421/28-23572
D-35032 Marburg, Germany           Fax  :            -26994

Received: (at 136052-done) by bugs.debian.org; 30 Oct 2003 19:58:10 +0000
>From fabbione@fabbione.net Thu Oct 30 13:58:09 2003
Return-path: <fabbione@fabbione.net>
Received: from port5.ds1-sby.adsl.cybercity.dk (trider-g7.fabbione.net) [] 
	by master.debian.org with esmtp (Exim 3.35 1 (Debian))
	id 1AFIvn-0006Fr-00; Thu, 30 Oct 2003 13:58:07 -0600
Received: from trider-g7.ext.fabbione.net (unknown [])
	by trider-g7.fabbione.net (Postfix) with ESMTP id 7BFFC16;
	Thu, 30 Oct 2003 20:58:05 +0100 (CET)
Date: Thu, 30 Oct 2003 20:57:55 +0100 (CET)
From: Fabio Massimo Di Nitto <fabbione@fabbione.net>
Sender: fabbione@trider-g7.ext.fabbione.net
To: 69122-done@bugs.debian.org, 136052-done@bugs.debian.org,
	215748-done@bugs.debian.org, 216286-done@bugs.debian.org
Subject: closing bugs
Message-ID: <Pine.LNX.4.58.0310302055430.13268@trider-g7.ext.fabbione.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Delivered-To: 136052-done@bugs.debian.org
X-Spam-Status: No, hits=0.0 required=4.0
X-Spam-Checker-Version: SpamAssassin 2.53-bugs.debian.org_2003_10_28 (

	due to a typo in the changelog file these bugs have not been
closed automatically. They have been fixed with apache


Our mission: make IPv6 the default IP protocol
"We are on a mission from God" - Elwood Blues


Reply to: