Mailing-List: contact user-help@cassandra.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@cassandra.apache.org
Received-SPF: pass (nike.apache.org: domain of jeremy.hanna1234@gmail.com
 designates 209.85.213.44 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=subject:mime-version:content-type:from:in-reply-to:date:cc
         :content-transfer-encoding:message-id:references:to:x-mailer;
        b=iAV4ZmmkJQ3N2I4PkFFOpj0YsbPpkeVagpYF+YDzz1V2hKK6pzii9yiQFXcIAP5FWb
         6CxI0wW146m4Kltl2RgvwZRIAJW0ZqiHKe/AvOQ1SPqXD44Pq/PAmz7zta7TwOKbYkeD
         HI1LGfZX6oJ8G9XeCQy/3uV3da2lJOpDcul4A=
Subject: Re: How to configure internode encryption in 0.8.0?
Mime-Version: 1.0 (Apple Message framework v1084)
Content-Type: text/plain; charset=us-ascii
From: Jeremy Hanna <jeremy.hanna1234@gmail.com>
In-Reply-To: <BANLkTimULP=oCJtSh_4SbT47UE2JLzoXDA@mail.gmail.com>
Date: Wed, 18 May 2011 10:10:21 -0500
Cc: Nirmal Ranganathan <rnirmal@gmail.com>
Content-Transfer-Encoding: quoted-printable
Message-Id: <6F7FEE32-8CAD-48C2-A234-55185F817FF6@gmail.com>
References: <BANLkTin2OmZxh4Swo+t19BB=wn3aCzHOQQ@mail.gmail.com>
 <5E01F647-AB1B-4231-9C28-95B97C6A3168@gmail.com>
 <BANLkTimULP=oCJtSh_4SbT47UE2JLzoXDA@mail.gmail.com>
To: user@cassandra.apache.org

I'll CC Nirmal Ranganathan who implemented the internode encryption who =
might be able to give you some advice on this.

On May 17, 2011, at 7:47 PM, Sameer Farooqui wrote:

> Thanks for the link, Jeremy.
>=20
> I generated the keystore and truststore for inter-node communication =
using the link in the YAML file:
> =
http://download.oracle.com/javase/6/docs/technotes/guides/security/jsse/JS=
SERefGuide.html#CreateKeystore
>=20
> Unfortunately, the default instructions in the above link used =
TLS_RSA_WITH_AES_256_CBC_SHA. So, when I start Cassandra now, I get this =
error:
>=20
> ERROR 00:10:38,734 Exception encountered during startup.
> java.lang.IllegalArgumentException: Cannot support =
TLS_RSA_WITH_AES_256_CBC_SHA       with currently installed providers
>         at =
com.sun.net.ssl.internal.ssl.CipherSuiteList.<init>(CipherSuiteList.j    =
  ava:79)
>         at =
com.sun.net.ssl.internal.ssl.SSLServerSocketImpl.setEnabledCipherSuit    =
  es(SSLServerSocketImpl.java:166)
>         at =
org.apache.cassandra.security.SSLFactory.getServerSocket(SSLFactory.j    =
  ava:55)
>=20
>=20
> The YAML file states that the cipher suite for authentication should =
be: TLS_RSA_WITH_AES_128_CBC_SHA.
>=20
> This is my first time using keytool and I've searched the web to see =
how I can change the cipher from AES_256 to AES_128, but haven't found =
the answer.
>=20
> Anyone know how to change the cipher to AES_128?
>=20
> Here are the commands I used to generate the non-working keystore and =
truststore:
>=20
> 1) keytool -genkeypair -alias jdoe -keyalg RSA -validity 7 -keystore =
.keystore
> 2) keytool -list -v -keystore .keystore
> 3) keytool -export -alias jdoe -keystore .keystore -rfc -file jdoe.cer
> 4) cat jdoe.cer
> 5) keytool -import -alias jdoecert -file jdoe.cer -keystore =
.truststore
> 6) keytool -list -v -keystore .truststore
>=20
>=20
> - Sameer
>=20
> On Mon, May 16, 2011 at 5:35 PM, Jeremy Hanna =
<jeremy.hanna1234@gmail.com> wrote:
> Take a look at cassandra.yaml in your 0.8 download at the very bottom. =
 There are docs and examples there.
> e.g. =
http://svn.apache.org/repos/asf/cassandra/tags/cassandra-0.8.0-beta2/conf/=
cassandra.yaml
>=20
> On May 16, 2011, at 6:36 PM, Sameer Farooqui wrote:
>=20
> > I understand that 0.8.0 has configurable internode encryption =
(CASSANDRA-1567, 2152).
> >
> > I haven't been able to find any info on how to configure it though =
on this mailing list or the Datastax website.
> >
> > Can somebody point me towards how to set this up?
> >
> > - Sameer
>=20
>=20