apache SSL seg Fault

[Snowman30]

We have a server running apache 2.2 and php 5.2.4 which has been running fine for a while but suddently has started having seg faults and wont run ssl

/etc/init.d/httpd: line 98: 7913 Segmentation fault $HTTPD -k start -DSSL

we have rebuilt twice now and still the same issue

anyone have any suggestions?

[cpanelnick]

We have a server running apache 2.2 and php 5.2.4 which has been running fine for a while but suddently has started having seg faults and wont run ssl



we have rebuilt twice now and still the same issue

anyone have any suggestions?

Install the latest version of openssl into /opt, and rebuild apache.


See
https://bugzilla.redhat.com/show_bug.cgi?id=236164

[Snowman30]

tried that already Nick but i believe Jesse is loking into my ticket now about it so hopefully the issue can be found

[internetfab]

Same issue we had, downgraded to apache 1.3 which solved it.
Then we installed latest openssl http://www.openssl.org/source/openssl-0.9.8g.tar.gz in /opt/openssl and rebuilt with apache2.2 php5.2.3 and php4.4.7 and it works well.

make sure you configure openssl to be installed in /opt/openssl

We didn't do anything other than that I'm afraid..

[wolfjlupus]

I can't seem to find the info for this...

Where do you rebuild apache if you can't use /scripts/easyapache due to the openSSL issue?

I've aready built openssl in the /opt/openssl folder.

[internetfab]

No no, you do use easyapache. If you have openssl installed in /opt/openssl - it uses that version instead of the system version.

[wolfjlupus]

No no, you do use easyapache. If you have openssl installed in /opt/openssl - it uses that version instead of the system version.

I don't understand what the issue is then because mine is still giving me the error when I use easyapache, does the /opt/openssl folder need special permissions?

[internetfab]

I dont know.

1. Open a ticket.
2. You could try the download the yaml file i supplied here. Remove the .txt extension of it (had to add it to post it on boards) and upload it you your /var/cpanel/easy/apache/profile/custom/ and then open up easyapache again. It is for php4 / php5 and the modules Ive chosen work with the builds.

[wolfjlupus]

I already made one myself, much like yours. SSL just won't work with easyapache for me for whatever reason...

Of course now httpd is needing to be restarted every chkservd check it seems.

IDK, it may have something to do with getting rid of the dummy from RPM and running yum update for using glibc-common since that was my original issue when trying to run easyapache on my VPS cent 4.5 Ent.

No idea, will probably have to check into it tomorrow some more.

[4u123]

I'm not having any seg fault problems but I cant run easyapache because every time I try, this error pops up about possibly having an openssl bug and it wont let me continue.

This page http://www.cpanel.net/support/docs/e...n_ssl_bug.html

Says one of the options is...

Patch Apache 2.x - At this time, cPanel patches Apache 2.0 and 2.2 mod_ssl to avoid the call to RAND_status() for older versions of OpenSSL. On some systems, this is sufficient to avoid any problems. Reordering the call to RSA_generate_key() is more involved since that function must not run before other initialization functions have executed. It is possible that other function calls during mod_ssl's initialization also cause segmentation faults under some circumstances.

Great - so cpanel patches it automatically. I guess it already did mine the last time I built it.

I now want to recompile because of a different issue and I cant because it wont let me use easyapache.

[cPanelKenneth]

I'm not having any seg fault problems but I cant run easyapache because every time I try, this error pops up about possibly having an openssl bug and it wont let me continue.

This page http://www.cpanel.net/support/docs/e...n_ssl_bug.html

Says one of the options is...



Great - so cpanel patches it automatically. I guess it already did mine the last time I built it.

I now want to recompile because of a different issue and I cant because it wont let me use easyapache.

That's odd. YOu are blocked from using EA3 via both /scripts/easyapache and WHM >> Software >> Apache Update? Would you mind sending me a screen shot of the entire page/screen along with your exact cPanel version (PM me if you need my email address).

[4UHChris]

Hi Kenneth,

I've not tried the command line version - just WHM. Using 11.15.0-R17853

Heres what happens...

1. I click the apache update link
2. A browser dialog box pops up saying "Internet explorer cannot open the internet site https://ip.ip.ip.ip:2087. Operation aborted.
3. I click OK
4. I see the cpanel info message in a white box with a blue header with the openssl bug notice in it and also the following page opens in a new window http://www.cpanel.net/support/docs/e...n_ssl_bug.html

I've also installed the latest version of openssl into /opt/openssl and tried again but i'm guessing EA3 isnt checking for that when I try and use it.

Are you saying the command line version will probably work ok ?

[cPDan]

If 2.x exhibits this bug (even with the patch we do to avoid part of it, see "Patch Apache 2.x" at the URL below)
and /opt/openssl does not help (see "What Problems May Arise From Having A Different OpenSSL In /opt/openssl?" at the URL below), then your 2 options are:

a) use apache 1.3
b) update your OS to one that is not buggy

Details are outlined here:
http://www.cpanel.net/support/docs/e...n_ssl_bug.html

[cPDan]

I've also installed the latest version of openssl into /opt/openssl and tried again but i'm guessing EA3 isnt checking for that when I try and use it.

Don't guess, look in the output, does it mention /opt/openssl anywhere? there is only one method used to determine the openssl prefix and if /opt/openssl is there it uses that.

Are you saying the command line version will probably work ok ?

That or a browser besides IE.

Can you send a screen shot of the error IE is giving? Are you sure its a 'could not open xxxx:2087/' error or is it an error about a popup for the open ssl bug documentation being blocked?

[cPanelKenneth]

Hi Kenneth,

I've not tried the command line version - just WHM. Using 11.15.0-R17853

Heres what happens...

1. I click the apache update link
2. A browser dialog box pops up saying "Internet explorer cannot open the internet site https://ip.ip.ip.ip:2087. Operation aborted.
3. I click OK
4. I see the cpanel info message in a white box with a blue header with the openssl bug notice in it and also the following page opens in a new window http://www.cpanel.net/support/docs/e...n_ssl_bug.html

I've also installed the latest version of openssl into /opt/openssl and tried again but i'm guessing EA3 isnt checking for that when I try and use it.

Are you saying the command line version will probably work ok ?

The command line will work. Thanks to your message, we traced this problem to some interaction with Internet Explorer, which we are currently addressing. Thank you.