nut (UPS) and SSL certificates

Question

Today I installed nut on my Ubuntu server (Ubuntu 14.04 LTS).

$ uname -a
Linux boson 3.13.0-24-generic #47-Ubuntu SMP Fri May 2 23:30:00 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux

The UPS is connected to another server (called neutron), so I use nut-client to keep tabs on the UPS state.

When I do sudo upsc [email protected] I get:

Init SSL without certificate database
battery.charge: 15
battery.charge.low: 10
battery.charge.warning: 50
battery.date: not set
battery.mfr.date: 2012/11/27
:

The first line of the output concerns me. I've not seen this on other installations of nut on Debian-based servers.

What can I do to get rid of that line?

EDIT: This "Init SSL without certificate database" is extra annoying because it is not part of the output of upsc and therefore I cannot grep it out.

EDIT(2): To clarify, the (Synology) server (which talks directly to the UPS) is not set-up with SSL or certificates. Other (Debian/Raspbian) clients on the network do not have the above issue. No SSL certificates are installed (as far as I can find out).

find / |grep cert_db on either the server or the clients yields no results.

Answer 1

Your problem is due to the new NSS backend in nut, which was added in 2.7.1 (Changes from 2.6.5 to 2.7.1). The client tries first to contact tcp/3943 with a STARTTLS command and gets ERR FEATURE-NOT-CONFIGURED from upsd, so it shows that warning.

The rationale for this change is that you are transmitting passwords in plaintext over the wire and the developers added SSL certificate support to prevent that. The client is being noisy, after all.

The error message is actually from the client, but you cannot exclude it with a grep because it's coming from the error output (stderr).

The easiest way of solving your problem is to pipe it properly:

upsc [email protected] 2>&1 | grep -v '^Init SSL'

or if you're just using some part of the output for e.g. an RRD graph and you were getting garbage in your cron output, just add the 2>&1 and it will be a normal line:

upsc [email protected] 2>&1 | grep 'battery.charge:' | awk ...

The not-so-easy way of fixing this is to actually configure SSL certificates and the rest of the stuff, like described in 10. Notes on securing NUT | Configuring SSL.

Answer 2

(For others like me coming via Google)

Just do proper output redirection to filter out the warning message:

upsc [email protected] > /dev/stdout 2> /dev/null

Answer 3

You must underline where to find the certificate database, and also tell the certificate that clients will use and the password to decrypt the private key associated with your (public) key by editing upsd.conf:

1. CERTPATH /usr/local/ups/etc/cert_db
2. CERTIDENT 'certificate name' 'database password'