Ticket #750 (new maintenance)

Opened 2 years ago

Last modified 8 months ago

Annual update of SSL cert fingerprint for incomming emails to Trac

Reported by: chris Owned by: chris
Priority: major Milestone: Maintenance
Component: Trac Keywords:
Cc: sam Estimated Number of Hours: 0.0
Add Hours to Ticket: 0 Billable?: yes
Total Hours: 0.4

Description

Laura said she had replied to Trac email today but they didn't get through.

The issues has come up before, see wiki:TransitionTrac#Fetchmail

Change History

comment:1 Changed 2 years ago by chris

  • Add Hours to Ticket changed from 0.0 to 0.25
  • Total Hours changed from 0.0 to 0.25

Check for this issue:

su-trac    
fetchmail 
  fetchmail: mail.webarch.net fingerprints do not match!
  140106143241896:error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed:s3_clnt.c:1172:
  fetchmail: SSL connection failed.
  fetchmail: socket error while fetching from trac.tech.transitionnetwork.org@mail.webarch.net
  fetchmail: Query status=2 (SOCKET)

Get the new fingerprint:

fetchmail -v -p imap -u trac.tech.transitionnetwork.org mail.webarch.net | grep -i "key fingerprint"
fetchmail: mail.webarch.net key fingerprint: EE:E3:86:28:53:FB:E9:C4:97:68:C7:43:11:CA:CC:6C

Update /web/tech.transitionnetwork.org/.fetchmailrc with the new finmgerprint and test:

fetchmail 
22 messages for trac.tech.transitionnetwork.org at mail.webarch.net.
reading message trac.tech.transitionnetwork.org@mail.webarch.net:1 of 22 (2047 header octets) (2041 body octets) flushed
reading message trac.tech.transitionnetwork.org@mail.webarch.net:2 of 22 (1284 header octets) (10980 body octets) flushed
reading message trac.tech.transitionnetwork.org@mail.webarch.net:3 of 22 (1284 header octets) (10332 body octets) flushed
...

Sorry aboutv this, I have updated the wiki, wiki:TransitionTrac#Fetchmail and I'll ponder how to auotomate an alert to ensure this is picked up next time it happens.

comment:2 Changed 8 months ago by chris

  • Add Hours to Ticket changed from 0.0 to 0.15
  • Total Hours changed from 0.25 to 0.4

The mail.webarch.net TLS cert was updated a few days ago, so:

sudo -i
su-trac
fetchmail -v -p imap -u trac.tech.transitionnetwork.org mail.webarch.net
...
fetchmail: mail.webarch.net key fingerprint: EA:16:53:90:4B:57:71:35:0D:52:B5:6D:2F:75:43:D2
...
vi .fetchmailrc
fetchmail
fetchmail: No mail for trac.tech.transitionnetwork.org at mail.webarch.net

So that is sorted.

comment:3 Changed 8 months ago by chris

  • Cc ed removed

ed removed from Cc list.

Note: See TracTickets for help on using tickets.