Return-Path: X-Original-To: apmail-cassandra-user-archive@www.apache.org Delivered-To: apmail-cassandra-user-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id DA97B101FD for ; Tue, 3 Sep 2013 21:20:38 +0000 (UTC) Received: (qmail 17417 invoked by uid 500); 3 Sep 2013 21:20:36 -0000 Delivered-To: apmail-cassandra-user-archive@cassandra.apache.org Received: (qmail 17392 invoked by uid 500); 3 Sep 2013 21:20:36 -0000 Mailing-List: contact user-help@cassandra.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: user@cassandra.apache.org Delivered-To: mailing list user@cassandra.apache.org Received: (qmail 17384 invoked by uid 99); 3 Sep 2013 21:20:36 -0000 Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 03 Sep 2013 21:20:36 +0000 X-ASF-Spam-Status: No, hits=1.5 required=5.0 tests=HTML_MESSAGE,RCVD_IN_DNSWL_LOW,SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (nike.apache.org: domain of dave@stormpath.com designates 209.85.220.50 as permitted sender) Received: from [209.85.220.50] (HELO mail-pa0-f50.google.com) (209.85.220.50) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 03 Sep 2013 21:20:29 +0000 Received: by mail-pa0-f50.google.com with SMTP id fb10so6969265pad.37 for ; Tue, 03 Sep 2013 14:20:08 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:content-type:subject:message-id:date:to :mime-version; bh=X12siVjW198PThePDoG7z2oEdbXjZ0BUnHRwCw1Tsqg=; b=Q+JfLJ/hLy0mpyPGvGCTGlQuhKBy+8OzmfESggwBIT8aN5B7HQHnZiMwinMUUXjExG tO05C/FfFdGmUAVHXMTmqApQ9ZAHBbF5H8O5nyQrmsogSf7LJWyRRB2xqYN1N/hMUwnI dAFmWpuaNGzmtfgUB/nhhb16wRdKpke44POwoR4djo3BU59UvgjvGedm0uxsFKbHQMd6 cyN5Z4ezsEd4Kx/E3zWA6UNeegUUdJNB07HcF52thblDkf7jDA3X1egAIAtvCaaau537 9ED8gpbjSMoAEvME2G301TSuqTtykXt+Kl2KBjhy6ttQ9UlS1R4+DNy7hwZ1emCfOKCF RUhA== X-Gm-Message-State: ALoCoQlbF6AHotw+WBbQnJKEdkV64zqXYJiXjRMJCvbFckMjLFKQSCNvnBeXiGqNEnED9ApFpOIn X-Received: by 10.68.136.7 with SMTP id pw7mr33022023pbb.106.1378243206374; Tue, 03 Sep 2013 14:20:06 -0700 (PDT) Received: from [10.1.10.12] (50-196-172-118-static.hfc.comcastbusiness.net. [50.196.172.118]) by mx.google.com with ESMTPSA id zi1sm24523166pbb.28.1969.12.31.16.00.00 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 03 Sep 2013 14:20:05 -0700 (PDT) From: David Laube Content-Type: multipart/alternative; boundary="Apple-Mail=_65EB1735-C42B-4DD2-8926-22D6157A34D2" Subject: cqlsh error after enabling encryption Message-Id: <31FB2948-2AC8-415A-8479-CFADD77F1ABF@stormpath.com> Date: Tue, 3 Sep 2013 14:20:05 -0700 To: "user@cassandra.apache.org" Mime-Version: 1.0 (Mac OS X Mail 6.5 \(1508\)) X-Mailer: Apple Mail (2.1508) X-Virus-Checked: Checked by ClamAV on apache.org --Apple-Mail=_65EB1735-C42B-4DD2-8926-22D6157A34D2 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 Hi All, After enabling encryption on our Cassandra 1.2.8 nodes, we receiving the = error "Connection error: TSocket read 0 bytes" while attempting to use = CQLsh to talk to the ring. I've followed the docs over at = http://www.datastax.com/documentation/cassandra/1.2/webhelp/cassandra/secu= rity/secureCqlshSSL_t.html but can't seem to figure out why this isn't = working. Inter-node communication seems to be working properly since = "nodetool status" shows our nodes as up, but the CQLsh client is unable = to talk to a single node or any node in the cluster (specifying the IP = in .cqlshrc or on the CLI) for some reason. I'm providing the applicable = config file entries below for review. Any insight or suggestions would = be greatly appreciated! :) My ~/.cqlshrc file: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [connection] hostname =3D 127.0.0.1 port =3D 9160 factory =3D cqlshlib.ssl.ssl_transport_factory [ssl] certfile =3D /etc/cassandra/conf/cassandra_client.crt validate =3D true ## Optional, true by default. [certfiles] ## Optional section, overrides the default certfile in the = [ssl] section. 192.168.1.3 =3D ~/keys/cassandra01.cert 192.168.1.4 =3D ~/keys/cassandra02.cert =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Our cassandra.yaml file config blocks: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =85snip=85 server_encryption_options: internode_encryption: all keystore: /etc/cassandra/conf/.keystore keystore_password: yeah-right truststore: /etc/cassandra/conf/.truststore truststore_password: yeah-right # More advanced defaults below: # protocol: TLS # algorithm: SunX509 # store_type: JKS # cipher_suites: = [TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA] # require_client_auth: false # enable or disable client/server encryption. client_encryption_options: enabled: true keystore: /etc/cassandra/conf/.keystore keystore_password: yeah-right # require_client_auth: false # Set trustore and truststore_password if require_client_auth is = true # truststore: conf/.truststore # truststore_password: cassandra # More advanced defaults below: protocol: TLS algorithm: SunX509 store_type: JKS cipher_suites: = [TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA] =85snip... =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Thanks, -David Laube --Apple-Mail=_65EB1735-C42B-4DD2-8926-22D6157A34D2 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=windows-1252 http://www.datastax.com/documentation/= cassandra/1.2/webhelp/cassandra/security/secureCqlshSSL_t.html bu= t can't seem to figure out why this isn't working. Inter-node = communication seems to be working properly since "nodetool status" shows = our nodes as up, but the CQLsh client is unable to talk to a single node = or any node in the cluster (specifying the IP in .cqlshrc or on the CLI) = for some reason. I'm providing the applicable config file entries below = for review. Any insight or suggestions would be greatly appreciated! = :)



My ~/.cqlshrc = file:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

[connection]
hostname =3D = 127.0.0.1
port =3D 9160
factory =3D = cqlshlib.ssl.ssl_transport_factory

[ssl]
certfile =3D = /etc/cassandra/conf/cassandra_client.crt
validate =3D true ## = Optional, true by default.

[certfiles] ## = Optional section, overrides the default certfile in the [ssl] = section.
192.168.1.3 =3D = ~/keys/cassandra01.cert
192.168.1.4 =3D = ~/keys/cassandra02.cert
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D



Our cassandra.yaml file config = blocks:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D
=85snip=85

server_enc= ryption_options:
    internode_encryption: = all
    keystore: = /etc/cassandra/conf/.keystore
    keystore_password: = yeah-right
    truststore: = /etc/cassandra/conf/.truststore
    = truststore_password: yeah-right
    # More = advanced defaults below:
    # protocol: = TLS
    # algorithm: SunX509
    = # store_type: JKS
    # cipher_suites: = [TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA]
&nbs= p;   # require_client_auth: false

# enable = or disable client/server = encryption.
client_encryption_options:
    = enabled: true
    keystore: = /etc/cassandra/conf/.keystore
    = keystore_password: yeah-right
    # = require_client_auth: false
    # Set trustore and = truststore_password if require_client_auth is true
  =   # truststore: conf/.truststore
    # = truststore_password: cassandra
    # More advanced = defaults below:
    protocol: TLS
  =   algorithm: SunX509
    store_type: = JKS
    cipher_suites: = [TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA]

=85snip...
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D



Thanks,
-David = Laube

= --Apple-Mail=_65EB1735-C42B-4DD2-8926-22D6157A34D2--