Good morning all,
Last week I decided to run the commands to upgrade packages on my 14.04 Server to ensure that I was patched for the recently found Bash vulnerabilties. Per the info here (http://www.ubuntu.com/usn/usn-2362-1/) I ran an apt-get dist-upgrade. For reference, i ran apt-get update, apt-get dist-upgrade and then apt-get upgrade to try & make sure I had everything up to the latest versions (I routinely run the apt-get upgrade though).
After successfully doing this, I found that a number of my Perl scripts were no longer functioning. For reference, I use this server for Nagios to monitor all of my other servers. The scripts in question that are now failing all connect to a system via https, log into the host and query various bits of information.
Prior to the upgrade, I was able to add a line to each of my Perl scripts to make it ignore the SSL:
$ENV{PERL_LWP_SSL_VERIFY_HOSTNAME} = 0 }
However, after the upgrade, this seems to have no affect, and the scripts all fail because they can't verify the SSL certs (all self signed).
Here's some snips of what I'm seeing:
script execution:
nagios@nagios:/usr/local/nagios/libexec$ ./check_esx.pl -H 192.168.22.18 -u root -p password -l cpu
CHECK_ESX.PL CRITICAL - Can't connect to 192.168.22.18:443 (certificate verify failed)
LWP::Protocol::https::Socket: SSL connect attempt failed error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed at /usr/share/perl5/LWP/Protocol/http.pm line 41.
This particular Perl script utilizes the "VMware Infrastructure (VI) Perl Toolkit" to function. The script that I'm calling, check_esx.pl is available here
Here's a snip of the file http.pm around the line referenced in the above error; line 41 is the "die" line.
sub _new_socket
{
my($self, $host, $port, $timeout) = @_;
local($^W) = 0; # IO::Socket::INET can be noisy
my $sock = $self->socket_class->new(PeerAddr => $host,
PeerPort => $port,
LocalAddr => $self->{ua}{local_address},
Proto => 'tcp',
Timeout => $timeout,
KeepAlive => !!$self->{ua}{conn_cache},
SendTE => 1,
$self->_extra_sock_opts($host, $port),
);
unless ($sock) {
# IO::Socket::INET leaves additional error messages in $@
my $status = "Can't connect to $host:$port";
if ($@ =~ /\bconnect: (.*)/ ||
$@ =~ /\b(Bad hostname)\b/ ||
$@ =~ /\b(certificate verify failed)\b/ ||
$@ =~ /\b(Crypt-SSLeay can't verify hostnames)\b/
) {
$status .= " ($1)";
}
die "$status\n\n$@";
}
# perl 5.005's IO::Socket does not have the blocking method.
eval { $sock->blocking(0); };
$sock;
}
So I guess what I'm looking for here is one of two things
Either: (A) Is there a new/better/more correct way to make Perl ignore the SSL certs? or (B) Is there a way to import a self signed SSL cert from another host into Ubuntu so that the Perl script will recognize & trust it? Alternatively: (B-2) Is there a way to make Ubuntu recognize my windows active directory Cert Authority such that I could issue SSL certs from my CA to the systems in question, and have it recognized by the Perl scripts?
Thanks in advance everyone!