Posted on

Language string failed to load: tls

We recently ran into this error while trying to get a mail service working from within PHP.   Our email service provider requires TLS security to validate our account before we are allowed to send mail through their system.  This is a good practice as it keeps rogue email traffic from flooding the outbound network queue.   However even after installing Mail and Net_SMTP from pear we still could not add mail to the outbound mail queue.

The solution was easy once we located the issue.  It turns out the new PHP installation on a development box was compiled without OpenSSL libraries.   The fix was to re-compile the source after configuring the build with openSSL enabled:

# ./configure <other-options-here> –with-openssl

We then restarted our Apache server to pick up  the new PHP executable & the pear Mail libs worked perfectly with the SSL auth keys enabled.

Posted on

SFTP Tips & Tricks

Using Keyfiles To Access SFTP Services

You can use the private key .pem files to allow you to connect via SFTP on a server that only allows key access.

The trick is to get the .pem file that Amazon gives you onto the sever that you will be using to connect to the EC2 instance.   When you store the .pem file on the local box, you will need to ensure the security level is set to 500 (r-x——).

Here is an example:

# sftp -o IdentityFile=my-amazon-given-key.pem root@domU-11-22-33-00-CC-11

We often use this trick to talk to our Amazon EC2 instances as they do not allow password based authentication by default.   This is a good security mechanism as only people with an authorized key file can gain access.   It also gives you a quick an easy way to shut down all access keys by disabling a single key file, essentially shutting down access from an entire group should there be a breach.

Create SFTP Logins Using Private Keyfiles

This is an example based on creating 3rd party access to SFTP on an Amazon EC2 instance.  The article is written for system administrators that wish to grant SFTP access to their server using a private key file they distribute to their users.  There can be multiple key files per username/directory.

  1. Logon to the EC2 instance with a privileged (root?) account.
  2. Create a keypair and save it to your PC.
  3. Start puttygen on your PC.
    1. Conversion/Import – load the key file you saved in step 2.
    2. Save as a private key (I like to add the -priv.ppk extension).
    3. Copy the Key data from the top private key info box (Public key for pasting into OpenSSH authorized_keys file:).
  4. Login to the server where you want the SFTP user to retrieve their files from.
  5. Change to the home directory of the user you want to grant SFTP access to.
  6. Create a .ssh directory.
    1. chmod 700 on that directory (rwx——)
    2. chmod 750 on that directory (rwxr-x—) to open access to other people in the same user group.
  7. Create an authorized_keys file within the .ssh directory.
    1. Create a SINGLE LINE that has the fingerprint you copied from puttygen above.
    2. Save the file.
    3. Chmod 600 on that file (rw——-)
      1. Use mode 640 (rw-r—–) to open access to other people in the same user group.

Now that you have the private key file from step 2.2 above, you can use that to login via PuTTY or SFTP from any system.  The only thing you need is local access to that key file.

Using Private Keys with Filezilla and EC2

After completing the creation of the key file & server-side tweaks to accept that key, you can now use desktop clients such as Filezilla to access your FTP content.   This assumes the system administrator of the server you are connecting to has given you a key file and they have installed the handshake privelages in the authorized_keys file on the remote end.

Pageant Method

  • Start by running pageant on your local system.
  • Add key
  • Find the key you generated with puttygen in step 3.2 above.
  • Start filezilla
  • In site manager enter the host name.  This will be the same server you logged into on step 4 above.
  • Servertype should be set to SFTP
  • Logontype Normal
  • User will be the name of the user that was given SFTP access (you created a .ssh/authorized_keys file in their home directory on the server)

Filezilla Specified Key Method

  • Start Filezilla
  • File/Site Manager – New Site
  • Enter the host name.  This will be the same server you logged into on step 4 from  Create SFTP Logins Using Private Keyfiles
  • Servertype should be set to SFTP
  • Logontype Normal
  • User will be the name of the user that was given SFTP access (you created a .ssh/authorized_keys file in their home directory on the server)
  • Click OK (NOT CONNECT)
  • Edit/Settings
    • Connection/SFTP
    • Add keyfile… and select the private keyfile you generated with puttygen above.
Filezilla - Edit Settings
Filezilla – Edit Settings
Filezilla Site Manager
Filezilla Site Manager

Now connect to that site.   Filezilla will read through the keys and find the right key for the user/server pair that you are connecting to.

Posted on

Creating and Installing SSL Certs via SSH

Certificate Signing Request (CSR)

Apache + Open SSL

Login as root
cd /usr/bin/ (/your path to openssl/)
openssl genrsa -des3 -out <name_of_your_certificate>.key 1024

You will need to enter a passphrase for your key here, and then enter it again in the next step.

openssl req -new -key <name_of_your_certificate>.key -out <name_of_your_certificate>.csr

At this point you’ll have to enter information about the site/owner of the SSL cert. Keep in mind that the common name (CM) is actually the address of the site (without http://, etc), and that each cert is only for one host. IE: yoursite.com is not the same as www.yoursite.com. Some certs can be created with multiple/alternative common names.

You’ll need the contents of the csr file to create the cert on godaddy or whichever cert site you’re using. Either download it or VI, and copy and paste the contents.

Installing SSL Certificate and the Intermediate Certificate

Once you’ve gotten the actual certs from the cert site (CRT files), you’ll need to upload them onto the server. You can put them wherever you want, but try to keep things organized because you’ll need to reference them later.

Next you’ll need to edit your conf files. In Apache 1.x this will be httpd.conf, Apache2 will most likely be ssl.conf (or some variation thereof), if the server is using virtual hosts there will be either separate conf files for each host, or seperate entries for each host within the ssl.conf or httpd.conf.
Either add, or uncomment these lines:

SSLCertificateFile /path/to/your/certificate/file

this is the CRT file provided by the cert site

SSLCertificateKeyFile /path/to/your/key/file

this is the KEY file you created previously

SSLCertificateChainFile /path/to/intermediate/bundle/file

an intermediate CRT file also provided by the cert site, this file is only required by certain cert providers

Server Restart

Next you’ll need to restart the web server, this can be done in numerous ways, but if you need to restart via SSH use the command:

apachectl -k graceful

This will restart the server and also allow any connections currently in place to finish. You may need to perform the restart twice, and enter the passphrase that you created your original key file with.