[LON-CAPA-admin] Not connected to network

Stuart Raeburn raeburn at msu.edu
Fri Sep 5 20:32:20 EDT 2014


Richard,

> connections going out to other institutions servers will look like   
> they're coming from the NAT address of the private network and not   
> from loncapa.purdue.edu.

They need to own up to the actual IP address of loncapa.purdue.edu  
(128.210.203.167).

> Does LON-CAPA do some sort of reverse dns on the connections and  verify?

In /home/httpd/perl/lond (which is the code to support connection  
requests from remote servers) you will find:

$server = IO::Socket::INET->new(LocalPort => $perlvar{'londPort'} ...

     $client = $server->accept() ...
     make_new_child($client);

And in the make_new_child() routine:

     my $caller = getpeername($client);
     my ($port,$iaddr);
     if (defined($caller) && length($caller) > 0) {
         ($port,$iaddr)=unpack_sockaddr_in($caller);
     }
     if (defined($iaddr)) {
         $clientip  = inet_ntoa($iaddr);
     }

which will eventually assign the IP address of the remote server from  
which a connection has been made to the scalars $clientip and $outsideip

         my $outsideip=$clientip;
         my $clientrec=defined(&Apache::lonnet::get_hosts_from_ip($outsideip));

If $outsideip is not recognized as the IP address of a known LON-CAPA  
host in the (cached) hosts data retrieved nightly from  
https://s10.lite.msu.edu/adm/dns/hosts, then the messages you reported  
from /home/httpd/perl/logs/lond.log will be logged:

<font color='blue'>WARNING: Unknown client $clientip</font>
<font color='blue'>WARNING: Rejected client $clientip, closing  
connection</font>
<font color='red'>CRITICAL: Disconnect from $clientip ($clientname)</font>

So if you are seeing $clientip set to 128.210.203.143 for a connection  
from msul1 (the MSU LON-CAPA library server) then your server will  
refuse connections from msul1, because the real IP address is  
35.8.100.228.

So, yes, you do need to configure your F5 Load Balancer hardware so  
that the IP address associated with the socket on port 5663 on  
loncapa.purdue.edu is for the remote server, and not the F5.

> ... I was thinking this functionality was working when we  first  
> switched to this configuration, however based on what I'm  seeing I  
> don't see how.

I don't know when the purdue LON-CAPA instance was switched from  
Purdue Biological Sciences to the current configuration managed by  
ITaP, but I found evidence that connectivity to the LON-CAPA network  
was unavailable from msul1 to purduel1 as far back as 7/15.


Stuart Raeburn
LON-CAPA Academic Consortium


Quoting "Lucas, Richard" <clucas at purdue.edu>:

> Stuart,
>
> Those PerlVars are both set to 1.
>
> I think I know what the issue is here, maybe you can confirm. When   
> we originally moved the server we have put it behind the F5 and gave  
>  the server and internal IP address. We configured the F5 to forward  
>  ports through since we only have the one server. However,   
> connections going out to other institutions servers will look like   
> they're coming from the NAT address of the private network and not   
> from loncapa.purdue.edu. Also the F5 is receiving the connection and  
>  forwards it on so to the LON-CAPA server it looks like the   
> connection is coming from the F5. I am seeing messages like this for  
>  connections in:
>
> Tue Sep  2 21:33:44 2014 (2184): <font color="green"> Attempting to   
> start child (IO::Socket::INET=GLOB(0x3e55dd8))</font>
> Tue Sep  2 21:33:44 2014 (22758): <font color="green"> existing host  
>  msul1</font>
>
> Tue Sep  2 21:33:44 2014 (22758): <font color='blue'>WARNING:   
> Unknown client 128.210.203.143</font>
> Tue Sep  2 21:33:44 2014 (22758): <font color='blue'>WARNING:   
> Rejected client 128.210.203.143, closing connection</font>
> Tue Sep  2 21:33:44 2014 (22758): <font color='red'>CRITICAL:   
> Disconnect from 128.210.203.143 ()</font>
> Tue Sep  2 21:33:44 2014 (2184): Child 22758 died
>
> Does LON-CAPA do some sort of reverse dns on the connections and   
> verify? I am working with the F5 admins here to try to get this   
> configuration changed. However, I'm wondering if you can shed some   
> lights on how this works and if there's anything else I can do   
> before that? I was thinking this functionality was working when we   
> first switched to this configuration, however based on what I'm   
> seeing I don't see how.
>
> Thanks,
> Richard
>
> -----Original Message-----
> From: lon-capa-admin-bounces at mail.lon-capa.org   
> [mailto:lon-capa-admin-bounces at mail.lon-capa.org] On Behalf Of   
> Stuart Raeburn
> Sent: Wednesday, September 03, 2014 12:20 AM
> To: lon-capa-admin at mail.lon-capa.org
> Subject: Re: [LON-CAPA-admin] Not connected to network
>
> Richard,
>
> I would agree that the LON-CAPA server for the purdue domain is   
> currently unable to connect to other LON-CAPA servers in the network.
>
> What is currently in /etc/httpd/conf/loncapa.conf for the two   
> PerlVars loncAllowInsecure and londAllowInsecure ?
>
> Looking at debug information in /home/httpd/perl/logs/lonc.log on   
> s12.lite.msu.edu I am seeing:
>
> [Tue Sep  2 21:33:43 2014: Connected to loncapa.purdue.edu] Created   
> connection 1 to host loncapa.purdue.edu LondWritable State =   
> Connected host = loncapa.purdue.edu LondWritable State = Initialized  
>  host = loncapa.purdue.edu LondReadable host = loncapa.purdue.edu   
> LondReadable called state = Initialized host = loncapa.purdue.edu   
> Readable returned: 0 host = loncapa.purdue.edu After read, state is   
> Initialized host = loncapa.purdue.edu LondReadable called state =   
> Initialized host = loncapa.purdue.edu [Tue Sep  2 21:33:43 2014:   
> Connected to loncapa.purdue.edu]
> Socket->Readable returned: -1 host = loncapa.purdue.edu
> [Tue Sep  2 21:33:43 2014: Connected to loncapa.purdue.edu] <font
> color='blue'>WARNING: Lond connection lost.</font>
>
> when connecting from s12.lite.msu.edu (the msudemo domain server).
>
> The transaction request which is failing is the init command:
>
> TransactionRequest -> init:ssl:'2.11.0-2014063012'
> TransactionReply -> refused
>
> Could you check lond.log in /home/httpd/perl/logs for messages such as:
>
> <font color="yellow">INFO: Connection, 35.9.66.242 (msudemol1)   
> connection type = client </font>"
>
> or
>
> <font color='blue'>WARNING: 35.9.66.242 failed to initialize:
>  >init:ssl:'2.11.0-2014063012'< </font>
>
> or
>
> <font color="yellow">Attempted insecure connection disallowed</font>
>
> or
>
> <font color='blue'>WARNING: Unknown client 35.9.66.242</font>
>
>
> Thanks,
>
> Stuart Raeburn
> LON-CAPA Academic Consortium
>
>
> Quoting "Lucas, Richard" <clucas at purdue.edu>:
>
>> I received a complaint that faculty are unable to browse resources
>> in other institutions. As far as I can tell our LON-CAPA instance is
>>  not connected to anyone else. I see a lot of connection messages
>> with "CRITICAL: Failed to make a connection with lond." and then
>> followed shortly after with "WARNING: Failing transaction sethost"
>> messages for host connections in the lonc.log. However, I'm not sure
>>  what that means or even if it's related. Any pointers on what I
>> should be looking at?
>>
>> Thanks,
>> Richard



More information about the LON-CAPA-admin mailing list