Installation failed – Add nodes step

I can not finalise the installation when I am trying add nodes.
Actually, it failed during installation of ruby-libs.
When I try yum install rubylibs , my system tells me that it requires libreadlines.so.5 even if compat-readline5 is installed !
My system is RHEL 6.

Topic

[zuhair attyaMember]

I don’t know if you still have the issue, but I found that “Registering” my RHEL server with Redhat support resolved the issues of dependancies.. if that is what you are having. in fact yum will update its repos once registered, so that it downloads all the prerequisites from Redhat public repo’s… if you cannot register your server, try using Centos at least you will get all the repos automatically downloaded.
Excuse my knowledge in Linux… I am just a beginner..

[Larry LiuModerator]

Hi, Fabrice,

Thanks for getting log for me. Let’s continue working offline.

Larry

[fbvdkaMember]

I runned ambari-server with -Djavax.net.debug=ssl:handshake
in /var/log/ambari-server/ambari-server.out :

qtp1402163909-30, fatal error: 46: General SSLEngine problem
sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors
%% Invalidated: [Session-22, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA]
qtp1402163909-30, SEND TLSv1.2 ALERT: fatal, description = certificate_unknown
qtp1402163909-30, WRITE: TLSv1.2 Alert, length = 2
qtp1402163909-30, fatal: engine already closed. Rethrowing javax.net.ssl.SSLHandshakeException: General SSLEngine problem


[Larry LiuModerator]

My email: lliu@hortonworks.com
my phone: 408-645-7043

[fbvdkaMember]

Hi Larry,

Could you give me your email in order to send you my phone number ?

[Larry LiuModerator]

Hi, Fabrice,

Can we talk about the issue over the phone? What is your phone number?

Larry

[fbvdkaMember]

The openssl version I have on my master is OpenSSL 1.0.0-fips 29 Mar 2010

[fbvdkaMember]

Hi,
After a reinstallation, and removed all keys on nodes and master, I have now the following message in node /var/log/ambari-agent/ambari-agent.log

INFO 2013-01-24 11:29:25,656 Controller.py:103 - Unable to connect to: https://p-h1tfc-serv1.xxx.xx:84$
Traceback (most recent call last):
File "/usr/lib/python2.6/site-packages/ambari_agent/Controller.py", line 88, in registerWithServer
response = self.sendRequest(self.registerUrl, data)
File "/usr/lib/python2.6/site-packages/ambari_agent/Controller.py", line 235, in sendRequest
self.cachedconnect = security.CachedHTTPSConnection(self.config)
File "/usr/lib/python2.6/site-packages/ambari_agent/security.py", line 76, in __init__
self.connect()
File "/usr/lib/python2.6/site-packages/ambari_agent/security.py", line 81, in connect
self.httpsconn.connect()
File "/usr/lib/python2.6/site-packages/ambari_agent/security.py", line 65, in connect
ca_certs=server_crt)
File "/usr/lib64/python2.6/ssl.py", line 338, in wrap_socket
suppress_ragged_eofs=suppress_ragged_eofs)
File "/usr/lib64/python2.6/ssl.py", line 120, in __init__
self.do_handshake()
File "/usr/lib64/python2.6/ssl.py", line 279, in do_handshake
self._sslobj.do_handshake()
SSLError: [Errno 8] _ssl.c:490: EOF occurred in violation of protocol

Always a problem with ssl

I tested openssl command from node in debug mode and I have the following message :

SSL_connect:SSLv3 write client key exchange A
write to 0x28451b0 [0x28572c0] (139 bytes => -1 (0xFFFFFFFFFFFFFFFF))
SSL_connect:error in SSLv3 write change cipher spec A
SSL_connect:error in SSLv3 write change cipher spec A
write:errno=32


[Larry LiuModerator]

Hi, Fabrice

Yes, you can.

Here is the command:

“openssl req -new -newkey rsa:1024 -nodes -keyout %(keysdir)s/%(hostname)s.key\
-subj /OU=%(hostname)s/\
-out %(keysdir)s/%(hostname)s.csr”

I recommend you to install with a clean system.

Larry

[fbvdkaMember]

Do you know if is it possible to create manually certificates (on master /var/lib/ambari-server/keys and on nodes /var/lib/ambari-agent/keys) with openssl and test with openssl ?

[fbvdkaMember]

Hi Larry,

Yes I did. I am pretty sure it is due to certificate or ssl problems.
Actually I switched from the 0.9 version. I have cleaned before my system.

[Larry LiuModerator]

Hi, Fabrice

Did you have a clean system when you switch from 1.1 to 1.2? If not, this might be the issue. Please have a clean OS installation before start HDP 1.2 installation.

Thanks

Larry

[fbvdkaMember]

Hi Larry,

Identical results for hostname and hostname -f.
From my point of view, I believe there is a problem with certificate and openssl.

[Larry LiuModerator]

Hi Fabrice,

Can you please run the following command on each host and make sure their results are identical?

hostname
hostname -f

Thanks

Larry

[fbvdkaMember]

I have done the following openssl command from one node (called serv2) :
openssl s_client -connect serv1:8441 -cert serv2.crt -key serv2.key -CAfile ca.crt

I received the following results :

CONNECTED(00000003)
depth=0 C = XX, L = Default City, O = Default Company Ltd
verify return:1
140209702324040:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:184:
---
Certificate chain
0 s:/C=XX/L=Default City/O=Default Company Ltd
i:/C=XX/L=Default City/O=Default Company Ltd
---
Server certificate
-----BEGIN CERTIFICATE-----
..........
-----END CERTIFICATE-----
subject=/C=XX/L=Default City/O=Default Company Ltd
issuer=/C=XX/L=Default City/O=Default Company Ltd
---
Acceptable client certificate CA names
/C=XX/L=Default City/O=Default Company Ltd
---
SSL handshake has read 2276 bytes and written 2465 bytes
---
New, TLSv1/SSLv3, Cipher is EDH-RSA-DES-CBC3-SHA
Server public key is 4096 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1
Cipher : EDH-RSA-DES-CBC3-SHA
Session-ID: 50FD175107A7A2B66E6E7D923BC2D919DB10EC03E92B529FE40226FC6B628E3B
Session-ID-ctx:
Master-Key: xxxx
Key-Arg : None
Krb5 Principal: None
PSK identity: None
PSK identity hint: None
Start Time: 1358763857
Timeout : 300 (sec)
Verify return code: 0 (ok)
---


[Author]

Replies