Questions[debian-jessie](server)

Using lftp to upload files to a remote server from two computers on my network. Using the exact same code this works fine on one and doesn't work on the other. Transcripts of a problem session and a successful session are shown below. The error that I get is:

Certificate verification: certificate common name doesn't match requested host name

Googling this error finds a solution that seems to work for most people (using: set ssl:verify-certificate no). But as you can see in the transcripts below this doesn't work for the "problem computer".

Because both computers use the same DNS and router to get on the internet I can only assume that this may be caused by a different setting on the problem computer. Would love to get suggestions for stuff to check other than lftp settings.

The problem computer

Stock Debian system jessie 8.7: 3.16.0-4-amd64 #1 SMP Debian 3.16.39-1 (2016-12-30) x86_64 GNU/Linux

lftp version being used:

$ apt show lftp
Package: lftp
Version: 4.6.0-1+deb8u1
:
:

Failing session (hostname replaced by "example"):

$ lftp
lftp :~> debug
lftp :~> set
set dns:order "inet6 inet"
set file:charset UTF-8
set ftp:timezone ""
set net:max-retries 2
set net:timeout 30
set ssl:verify-certificate no
set xfer:log yes
set xfer:log-file /tmp/lftp.log
set xfer:max-log-size 1048576
set xfer:max-redirections 10
set xfer:verify-command /usr/share/lftp/verify-file
lftp :~> open example.nl
---- using user `[email protected]' and password from ~/.netrc
---- Resolving host address...
---- 2 addresses found: (▮▮▮▮▮▮▮▮, ▮▮▮▮▮▮▮▮)
lftp [email protected]@example.nl:~> dir
---- Connecting to example.nl (▮▮▮▮▮▮▮▮) port 21
**** connect(control_sock): Network is unreachable
---- Closing control socket
---- Connecting to example.nl (▮▮▮▮▮▮▮▮) port 21
<--- 220 ProFTPD 1.3.5b Server ready.
---> FEAT
<--- 211-Features:
<---  CCC
<---  PBSZ
<---  AUTH TLS
<---  MFF modify;UNIX.group;UNIX.mode;
<---  REST STREAM
<---  MLST modify*;perm*;size*;type*;unique*;UNIX.group*;UNIX.mode*;UNIX.owner*;
<---  LANG en-US.UTF-8*
<---  UTF8
<---  EPRT
<---  EPSV
<---  MDTM
<---  SSCN
<---  TVFS
<---  MFMT
<---  SIZE
<---  PROT
<--- 211 End
---> AUTH TLS
<--- 234 AUTH TLS successful
---> LANG
Certificate: OU=Domain Control Validated,OU=PositiveSSL Wildcard,CN=*.zxcs.nl
 Issued by: C=GB,ST=Greater Manchester,L=Salford,O=COMODO CA Limited,CN=COMODO RSA Domain Validation Secure Server CA
WARNING: Certificate verification: Not trusted
WARNING: Certificate verification: certificate common name doesn't match requested host name ‘example.nl’
<--- 200 Using default language en_US.UTF-8
---> OPTS UTF8 ON
<--- 200 UTF8 set to on
---> OPTS MLST modify;perm;size;type;UNIX.group;UNIX.mode;UNIX.owner;
<--- 200 OPTS MLST modify;perm;size;type;UNIX.group;UNIX.mode;UNIX.owner;
---> USER [email protected]
<--- 331 Password required for [email protected]
---> PASS XXXX
<--- 230 User [email protected] logged in
---> PWD
<--- 257 "/" is the current directory
---> PBSZ 0
<--- 200 PBSZ 0 successful
---> PROT P
<--- 200 Protection set to Private
---> PASV
<--- 227 Entering Passive Mode (▮▮▮▮▮▮▮▮).
---- Connecting data socket to (▮▮▮▮▮▮▮▮) port 35302
---- Data connection established
---> LIST
<--- 150 Opening ASCII mode data connection for file list
Certificate: OU=Domain Control Validated,OU=PositiveSSL Wildcard,CN=*.zxcs.nl
 Issued by: C=GB,ST=Greater Manchester,L=Salford,O=COMODO CA Limited,CN=COMODO RSA Domain Validation Secure Server CA
WARNING: Certificate verification: Not trusted
WARNING: Certificate verification: certificate common name doesn't match requested host name ‘ example.nl’
<--- 425 Unable to build data connection: Operation not permitted
---- Closing data socket
<--- 450 LIST: Operation not permitted
**** extra server response
ls: Fatal error: max-retries exceeded
lftp [email protected]@example.nl:/>

The other computer

Debian-based Raspbian jessie 8.0 : 4.4.38+ #938 Thu Dec 15 15:17:54 GMT 2016 armv6l GNU/Linux On this computer I have the exact same version of lftp:

$ apt show lftp
Package: lftp
Version: 4.6.0-1+deb8u1
:
:

But now the lftp session gives no problems:

$ lftp
lftp :~> debug
lftp :~> set
set dns:order "inet6 inet"
set file:charset UTF-8
set ftp:timezone ""
set net:max-retries 2
set net:timeout 30
set ssl:verify-certificate no
set xfer:log yes
set xfer:log-file /tmp/lftp.log
set xfer:max-log-size 1048576
set xfer:max-redirections 10
set xfer:verify-command /usr/share/lftp/verify-file
lftp :~> open example.nl
---- using user `[email protected]' and password from ~/.netrc
---- Resolving host address...
---- 2 addresses found: ▮▮▮▮▮▮▮▮, ▮▮▮▮▮▮▮▮
lftp [email protected]@example.nl:~> dir
---- Connecting to example.nl (▮▮▮▮▮▮▮▮) port 21
**** connect(control_sock): Network is unreachable
---- Closing control socket
---- Connecting to example.nl (▮▮▮▮▮▮▮▮) port 21
<--- 220 ProFTPD 1.3.5b Server ready.
---> FEAT
<--- 211-Features:
<---  CCC
<---  PBSZ
<---  AUTH TLS
<---  MFF modify;UNIX.group;UNIX.mode;
<---  REST STREAM
<---  MLST modify*;perm*;size*;type*;unique*;UNIX.group*;UNIX.mode*;UNIX.owner*;
<---  LANG en-US.UTF-8*
<---  UTF8
<---  EPRT
<---  EPSV
<---  MDTM
<---  SSCN
<---  TVFS
<---  MFMT
<---  SIZE
<---  PROT
<--- 211 End
---> AUTH TLS
<--- 234 AUTH TLS successful
---> LANG
Certificate: OU=Domain Control Validated,OU=PositiveSSL Wildcard,CN=*.zxcs.nl
 Issued by: C=GB,ST=Greater Manchester,L=Salford,O=COMODO CA Limited,CN=COMODO RSA Domain Validation Secure Server CA
WARNING: Certificate verification: Not trusted
WARNING: Certificate verification: certificate common name doesn't match requested host name ‘example.nl’
<--- 200 Using default language en_US.UTF-8
---> OPTS UTF8 ON
<--- 200 UTF8 set to on
---> OPTS MLST modify;perm;size;type;UNIX.group;UNIX.mode;UNIX.owner;
<--- 200 OPTS MLST modify;perm;size;type;UNIX.group;UNIX.mode;UNIX.owner;
---> USER [email protected]
<--- 331 Password required for [email protected]
---> PASS XXXX
<--- 230 User [email protected] logged in
---> PWD
<--- 257 "/" is the current directory
---> PBSZ 0
<--- 200 PBSZ 0 successful
---> PROT P
<--- 200 Protection set to Private
---> PASV
<--- 227 Entering Passive Mode (▮▮▮▮▮▮▮▮).
---- Connecting data socket to (▮▮▮▮▮▮▮▮) port 35035
---- Data connection established
---> LIST
<--- 150 Opening ASCII mode data connection for file list
Certificate: OU=Domain Control Validated,OU=PositiveSSL Wildcard,CN=*.zxcs.nl
 Issued by: C=GB,ST=Greater Manchester,L=Salford,O=COMODO CA Limited,CN=COMODO RSA Domain Validation Secure Server CA
WARNING: Certificate verification: Not trusted
WARNING: Certificate verification: certificate common name doesn't match requested host name ‘example.nl’
---- Got EOF on data connection
---- Closing data socket
drwxr-xr-x  11 ftp      ftp          4096 Feb 11 16:56 .
drwxr-xr-x  11 ftp      ftp          4096 Feb 11 16:56 ..
drwxr-xr-x   2 ftp      ftp          4096 Dec 29 10:48 01.home
lftp [email protected]@example.nl:/>

This Friday I saw that I had 2 held back packages for some reason when I ran apt-get upgrade, so naturally I did what any inexperienced sysadmin would do and uninstalled the packages in the hopes that I could simply re-install them and the problem would be solved.

Little did I know, I just made the situation worse. When I tried to reinstall openjdk-8-jre-headless, I got this:

$ apt-get install openjdk-8-jre-headless
Reading package lists... Done
Building dependency tree
Reading state information... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 openjdk-8-jre-headless : Depends: ca-certificates-java but it is not going to be installed
E: Unable to correct problems, you have held broken packages.

I tried to upgrade the mentioned package manually, but to no avail.

$ apt-get upgrade ca-certificates-java
Reading package lists... Done
Building dependency tree
Reading state information... Done
Calculating upgrade... ca-certificates-java is already the newest version.
Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

Looking around I saw no mention of a solution to this exact error anywhere.

I use ElasticSearch on the server, which I restarted, but I should've expected that it wouldn't start up at this point. So now I'm without Java and my users are without search. What is going on and how can I fix this?

When I run lsb_release on Debian 8, following error is appeared:

No LSB modules are available.

Is there any missing file causes this problem?

I installed Supervisor (v3.1.2) to manage ElastAlert but when I run supervisorctl it sometimes throws this error:

unix:///var/run/supervisor.sock no such file

and other times it throws this error:

unix:///tmp/supervisor.sock no such file

I'll note that it does bring me to the supervisor> prompt, but commands after that are the same errors as above. The /etc/supervisor/supervisor.conf file is configured to use /var/run, which seems at odds with the second error.

I created a link to /etc/supervisor.conf, as other help pages suggested this, but it didn't make a difference.

Two odd things, when I first installed Supervisor it worked fine, but it was after a reboot this problem started. And the other odd thing is that ElastAlert starts after a reboot, and continues to perform normally. So while it might be having errors it's doing its job. Not a show-stopper, but I would like for this to work properly.

Any ideas?

I am running debian jessie on my server and recently upgraded to new nginx web server with http/2 support (nginx 1.10). As today, it works great and webserver is delivering content with http2 protocol.

I have read, that chrome is dropping NPN support and only allows ALPN after 15.5.2016. ALPN is extension, which requires openssl 1.0.2 installed, but on debian jessie is only openssl 1.0.1 (also on debian backports and another repositories, there is no openssl 1.0.2 version for this debian).

And there is the problem - i have upgraded from SPDY to http2 and in few days, i will have to turn off http2 and cannot use SPDY because this version of nignx have only http2. I have also read, that this version of debian will stuck with openssl 1.0.1 and only debian stretch will have openssl 1.0.2. But to release date there is almost year and chrome will be dropping support soon, so i do not want to loose the benefit of http2 protocol.

Is there any solution, how to install openssl 1.0.2 on this system, without building own build (bad maintenance) or waiting for backports repository to have it? I also don't want two versions of openssl on my system if one of them must be linked and maintained manually.

Thanks for any help.