failed to create session #20
Comments
|
Hi @LeArmadillo, This made me think: You probably should change this line in your to this (removing the double quotes): |
|
Hi adepasquale, Thank you for your response, I've played around with the file-path for opsec.p12 a few times with no success. However removing the "" from the opsec_sic_name & lea_server opsec_entity_sic_name paths in lea.conf did change the output. FULL DEBUG OUTPUT: [root@opchs02cloudDN fw1-loggrabber]# ./fw1-loggrabber -c fw1-loggrabber.conf -l lea.conf [ 10749 4140537568]@opchs02cloudDN[18 Oct 15:12:47] opsec_initdir: opsec dir already initialized to: /tmp [ 10749 4140537568]@opchs02cloudDN[18 Oct 15:12:55] Could not find info for ...opsec_client... [ 10749 4140537568]@opchs02cloudDN[18 Oct 15:12:55] resolver_getaddrinfo_list: name=opchs02cloudDN, pref=0 [ 10749 4140537568]@opchs02cloudDN[18 Oct 15:12:55] fw_do_get_all_ipaddrs: found 0 addresses [ 10749 4140537568]@opchs02cloudDN[18 Oct 15:12:55] sic_init_myaddr_ex: could not get my own IPv6 addresses. [ 10749 4140537568]@opchs02cloudDN[18 Oct 15:12:55] pushing dgtype=1 len=0 to list=0x9967774 [ 10749 4140537568]@opchs02cloudDN[18 Oct 15:12:55] pushing dgtype=402 len=27 to list=0x9967774 DEBUG: OPSEC_SESSION_END_HANDLER called [ 10749 4140537568]@opchs02cloudDN[18 Oct 15:12:55] opsec_del_event : event ctx is not activated [ 10749 4140537568]@opchs02cloudDN[18 Oct 15:12:55] opsec_del_event : event ctx is not activated [ 10749 4140537568]@opchs02cloudDN[18 Oct 15:12:55] opsec_comm_is_needed:comm 0x9967758 1/1 sessions need the comm. [ 10749 4140537568]@opchs02cloudDN[18 Oct 15:12:55] opsec_initdir: opsec dir already initialized to: /tmp [ 10749 4140537568]@opchs02cloudDN[18 Oct 15:13:41] Could not find info for ...opsec_client... [ 10749 4140537568]@opchs02cloudDN[18 Oct 15:13:41] pushing dgtype=1 len=0 to list=0x996c01c [ 10749 4140537568]@opchs02cloudDN[18 Oct 15:13:41] pushing dgtype=402 len=29 to list=0x996c01c [ 10749 4140537568]@opchs02cloudDN[18 Oct 15:13:41] pushing dgtype=40c len=0 to list=0x996c01c DEBUG: OPSEC_SESSION_END_HANDLER called |
|
Upon further investigation it seems that it throws the error lea.conf: |
|
First, please clarify, would you like to use SSL CA or SSL OPSEC? https://github.com/certego/fw1-loggrabber/wiki/Configure-remote-Checkpoint-device |
|
Hi @adepasquale SSL CA, I was also trying SSL OPSEC to see if the output was different, however it is the same for both of them. I have verified that the opsec.p12 was generated correctly using opsec_pull_cert and the server has been configured as in the above guide for SSL CA. Still I'm getting the error: "opsec_read_cert_file: could not open file: /home/Bluesky/fw1-loggrabber/fw1-loggrabber/opsec.p12" The error gives back the file path quoted directly in lea.conf even if the opsec.p12 is not present hence the error is actually that the program can't find the file rather than can't open it. full debug trace SSL CA: [Bluesky@opchs02cloudDN fw1-loggrabber]$ ./fw1-loggrabber [ 13484 4140685024]@opchs02cloudDN[19 Oct 9:42:27] opsec_initdir: opsec dir already initialized to: /tmp [ 13484 4140685024]@opchs02cloudDN[19 Oct 9:42:51] create_rand_mutex: failed to create mutex: Operation not permitted [ 13484 4140685024]@opchs02cloudDN[19 Oct 9:42:51] Could not find info for ...opsec_client... [ 13484 4140685024]@opchs02cloudDN[19 Oct 9:42:51] resolver_getaddrinfo_list: name=opchs02cloudDN, pref=0 [ 13484 4140685024]@opchs02cloudDN[19 Oct 9:42:51] fw_do_get_all_ipaddrs: found 0 addresses [ 13484 4140685024]@opchs02cloudDN[19 Oct 9:42:51] sic_init_myaddr_ex: could not get my own IPv6 addresses. [ 13484 4140685024]@opchs02cloudDN[19 Oct 9:42:51] pushing dgtype=1 len=0 to list=0x8abe674 [ 13484 4140685024]@opchs02cloudDN[19 Oct 9:42:51] pushing dgtype=402 len=27 to list=0x8abe674 DEBUG: OPSEC_SESSION_END_HANDLER called [ 13484 4140685024]@opchs02cloudDN[19 Oct 9:42:51] opsec_del_event : event ctx is not activated [ 13484 4140685024]@opchs02cloudDN[19 Oct 9:42:51] opsec_del_event : event ctx is not activated [ 13484 4140685024]@opchs02cloudDN[19 Oct 9:42:51] opsec_comm_is_needed:comm 0x8abe658 1/1 sessions need the comm. [ 13484 4140685024]@opchs02cloudDN[19 Oct 9:42:51] opsec_initdir: opsec dir already initialized to: /tmp [ 13484 4140685024]@opchs02cloudDN[19 Oct 9:43:45] Could not find info for ...opsec_client... [ 13484 4140685024]@opchs02cloudDN[19 Oct 9:43:45] pushing dgtype=1 len=0 to list=0x8ac2f44 [ 13484 4140685024]@opchs02cloudDN[19 Oct 9:43:45] pushing dgtype=402 len=29 to list=0x8ac2f44 [ 13484 4140685024]@opchs02cloudDN[19 Oct 9:43:45] pushing dgtype=40c len=0 to list=0x8ac2f44 DEBUG: OPSEC_SESSION_END_HANDLER called |
|
Although I advise against doing this in production, you could try:
|
|
I made the above changes and still have the same error result: opsec_read_cert_file: could not open file: /tmp/opsec.p12 lea.conf |
|
Weird error, never seen before. Could you please try again with this |
|
Tried again, putting back in the quotes brought it back a step to the lea.conf: full debug: [ 19257 4140697312]@opchs02cloudDN[19 Oct 10:46:28] opsec_initdir: opsec dir already initialized to: /tmp [ 19257 4140697312]@opchs02cloudDN[19 Oct 10:46:30] cpprng_opsec_initialize: dev_urandom_poll returned 0 |
|
Would you be able to point out where the error is created in the code? opsec_read_cert_file is not in the code and produces no results on Google so it's very hard to debug. opsec_read_cert_file: could not open file: /home/Bluesky/fw1-loggrabber/fw1-loggrabber/opsec.p12 |
|
The highlighted parts correspond to your code path, where the LEA client/server pair is initialized: fw1-loggrabber/fw1-loggrabber.c Lines 570 to 608 in 21dfe88 fw1-loggrabber/fw1-loggrabber.c Lines 631 to 684 in 21dfe88 This code snippet is what in your debug output becomes: Unfortunately I've never tested fw1-loggrabber with a CLM, so the last thing I might suggest trying is to test the unauthenticated connection mode. Anyway, even if that works, I would NOT recommend to use unauthenticated mode in production. |
|
I have this issue also, does anyone have a solution? |
|
This happened to me because on the management side the file "$FWDIR/conf/fwopsec.conf " was changed, To because they apperantly configured it as "ssl_opsec" not "sslca", see description here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk32521 so in the lea configuration just change it according to the instructions in the loggrabber "ssl_opsec" reference. |
Hi,
I'm having trouble establishing a connection to a checkpoint CLM to pull logs using fw1-loggrabber. I'm getting a very generic error when using the default lea_server auth_type sslca of "ERROR: failed to initialize client/server-pair (NO Error)" debugging shows it to be the pServer object which fails to initialize (fw1-loggrabber.c line 1761).
When I change lea_server auth_type to ssl_opsec or auth_opsec I get the error "ERROR: failed to create session (Argument is NULL or lacks some data)" debugging shows it to be the pSession objects which fails to initialize (fw1-loggrabber.c line 1773).
In both cases I feel that the error may have something to do with the following output lines:
Is it possible to get more descriptive errors as I'm not really understanding why the client/server link is failing to initialize. Is there a way to rectify the failure to read the opsec.p12 file? As this file has the credentials for the CLM it makes sense that this is causing the connection to fail. Is the "failed to create session" error further along than the "failed to initialize client/server-pair" error? I will be very grateful for any advice offered, my apologies if these are basic/obvious questions but I'm a bit new to this :)
lea.conf:
fw1-loggrabber.conf:
full debug trace:
The text was updated successfully, but these errors were encountered: