List:General Discussion« Previous MessageNext Message »
From:twig les Date:November 25 2002 9:57pm
Subject:Re: Need to force Mysql to use port, NOT socket
View as plain text  
I wish that was the answer (ego being less important
than sanity).  I've put a tcpdump box in the middle
and tcp sessions are going out to the mysql server on
3307 (the creative port I chose for stunnel to use for
mysql) but the session hangs for about a minute after
I send the password.  Here are the details:

From the MySQL server box.
================================
FreeBSD master02.com 4.7-RELEASE FreeBSD 4.7-RELEASE
#0: Tue Nov 19 15:24:12 PST 2002    
twigles@stripped:/usr/obj/usr/src/sys/FW  i386

master02# more /etc/hosts
127.0.0.1               master02.com localhost
192.168.1.6             master02.com master02
192.168.1.6             master02.com.
master02# 

master02# cat /usr/local/etc/stunnel/stunnel.conf
# Sample stunnel configuration file
# Copyright by Michal Trojnara 2002

# Comment it out on Win32
cert = /usr/local/etc/stunnel/mail.pem
chroot = /var/tmp/stunnel
# PID is created inside chroot jail
pid = /stunnel.pid
setuid = stunnel
setgid = stunnel

# Authentication stuff
#verify = 2
# don't forget about c_rehash CApath
# it is located inside chroot jail:
#CApath = /certs
# or simply use CAfile instead:
#CAfile = /usr/local/etc/stunnel/certs.pem

# Some debugging stuff
debug = 7
#output = stunnel.log

# Use it for client mode
#client = yes

foreground = yes

# Service-level configuration

[3307]
accept = 192.168.1.6:3307 
#connect = 127.0.0.1:3306
connect = master02.com:3306
#connect = 192.168.1.6:3306
#connect = localhost:3306

master02# more /etc/my.cnf
<snip comments>
# The following options will be passed to all MySQL
clients
[client]
#password       = 
port            = 3306
socket          = /tmp/mysql.sock

# Here follows entries for some specific programs

# The MySQL server
[mysqld]
port            = 3306
socket          = /tmp/mysql.sock
skip-locking
set-variable    = key_buffer=256M
set-variable    = max_allowed_packet=1M
set-variable    = table_cache=256
set-variable    = sort_buffer=1M
set-variable    = record_buffer=1M
set-variable    = myisam_sort_buffer_size=64M
set-variable    = thread_cache=8
# Try number of CPU's*2 for thread_concurrency
set-variable    = thread_concurrency=8
log-bin
server-id       = 1

# Uncomment the following if you are using BDB tables
#set-variable   = bdb_cache_size=64M
#set-variable   = bdb_max_lock=100000

# Uncomment the following if you are using InnoDB
tables
#innodb_data_home_dir = /var/db/mysql/
#innodb_data_file_path = ibdata1:10M:autoextend
#innodb_log_group_home_dir = /var/db/mysql/
#innodb_log_arch_dir = /var/db/mysql/
# You can set .._buffer_pool_size up to 50 - 80 %
# of RAM but beware of setting memory usage too high
#set-variable = innodb_buffer_pool_size=256M
#set-variable = innodb_additional_mem_pool_size=20M
# Set .._log_file_size to 25 % of buffer pool size
#set-variable = innodb_log_file_size=64M
#set-variable = innodb_log_buffer_size=8M
#innodb_flush_log_at_trx_commit=1
#set-variable = innodb_lock_wait_timeout=50

# Point the following paths to different dedicated
disks
#tmpdir         = /tmp/         
#log-update     =
/path-to-dedicated-directory/hostname

[mysqldump]
quick
set-variable    = max_allowed_packet=16M

[mysql]
no-auto-rehash
# Remove the next comment character if you are not
familiar with SQL
#safe-updates

[isamchk]
set-variable    = key_buffer=128M
set-variable    = sort_buffer=128M
set-variable    = read_buffer=2M
set-variable    = write_buffer=2M

[myisamchk]
set-variable    = key_buffer=128M
set-variable    = sort_buffer=128M
set-variable    = read_buffer=2M
set-variable    = write_buffer=2M

[mysqlhotcopy]
interactive-timeout


This is the debug output for stunnel, which is where I
see the TCP connection hang waiting for a socket from
Mysql.

master02# sh stunnel.sh start
2002.11.25 13:45:02 LOG5[346:134594560]: stunnel 4.00
on i386-portbld-freebsd4.7 PTHREAD+LIBWRAP with
OpenSSL 0.9.6g 9 Aug 2002
2002.11.25 13:45:02 LOG7[346:134594560]: RAND_status
claims sufficient entropy for the PRNG
2002.11.25 13:45:02 LOG6[346:134594560]: PRNG seeded
successfully
2002.11.25 13:45:02 LOG7[346:134594560]: Certificate:
/usr/local/etc/stunnel/mail.pem
2002.11.25 13:45:02 LOG7[346:134594560]: Key file:
/usr/local/etc/stunnel/mail.pem
2002.11.25 13:45:02 LOG5[346:134594560]:
FD_SETSIZE=1024, file ulimit=1792 -> 500 clients
allowed
2002.11.25 13:45:02 LOG7[346:134594560]: FD 5 in
non-blocking mode
2002.11.25 13:45:02 LOG7[346:134594560]: SO_REUSEADDR
option set on accept socket
2002.11.25 13:45:02 LOG7[346:134594560]: 3307 bound to
192.168.1.6:3307
2002.11.25 13:45:02 LOG7[346:134594560]: Created pid
file /stunnel.pid
2002.11.25 13:45:21 LOG7[346:134594560]: 3307 accepted
FD=6 from 192.168.1.4:1058
2002.11.25 13:45:21 LOG7[346:134594560]: FD 6 in
non-blocking mode
2002.11.25 13:45:21 LOG7[346:134596608]: 3307 started
2002.11.25 13:45:21 LOG5[346:134596608]: 3307
connected from 192.168.1.4:1058
2002.11.25 13:45:21 LOG7[346:134596608]: FD 7 in
non-blocking mode
2002.11.25 13:45:21 LOG7[346:134596608]: 3307
connecting 127.0.0.1:3306
2002.11.25 13:45:21 LOG7[346:134596608]: Remote FD=7
initialized
2002.11.25 13:45:21 LOG7[346:134596608]: SSL state
(accept): before/accept initialization
2002.11.25 13:45:21 LOG7[346:134596608]:
waitforsocket: FD=6, DIR=read
2002.11.25 13:45:33 LOG7[346:134596608]:
waitforsocket: ok
2002.11.25 13:45:33 LOG3[346:134596608]: SSL_accept:
Peer suddenly disconnected
2002.11.25 13:45:33 LOG7[346:134596608]: 3307 finished
(0 left)
================================

From the MySQL client box
================================
same OS/version

sensor01# more /etc/hosts
127.0.0.1               localhost.com localhost
192.168.1.4             sensor01.com sensor01
192.168.1.4             sensor01.com.

sensor01# mysql -h 127.0.0.1 -u snortman -p
Enter password: 
ERROR 2013: Lost connection to MySQL server during
query

sensor01# cat /usr/local/etc/stunnel/stunnel.conf
# Sample stunnel configuration file
# Copyright by Michal Trojnara 2002

# Comment it out on Win32
cert = /usr/local/etc/stunnel/mail.pem
chroot = /var/tmp/stunnel
# PID is created inside chroot jail
pid = /stunnel.pid
setuid = stunnel
setgid = stunnel

# Authentication stuff
#verify = 2
# don't forget about c_rehash CApath
# it is located inside chroot jail:
#CApath = /certs
# or simply use CAfile instead:
#CAfile = /usr/local/etc/stunnel/certs.pem

# Some debugging stuff
debug = 7
#output = stunnel.log

# Use it for client mode
#client = yes

foreground = yes

# Service-level configuration

[3306]
accept = 127.0.0.1:3306
connect = 192.168.1.6:3307

Debug output from the client side of the same
connection as above.  This indicates that stunnel is
building a proper session.

sensor01# sh stunnel.sh start
2002.11.25 13:48:53 LOG5[344:134594560]: stunnel 4.00
on i386-portbld-freebsd4.7 PTHREAD+LIBWRAP with
OpenSSL 0.9.6g 9 Aug 2002
2002.11.25 13:48:53 LOG7[344:134594560]: RAND_status
claims sufficient entropy for the PRNG
2002.11.25 13:48:53 LOG6[344:134594560]: PRNG seeded
successfully
2002.11.25 13:48:53 LOG7[344:134594560]: Certificate:
/usr/local/etc/stunnel/mail.pem
2002.11.25 13:48:53 LOG7[344:134594560]: Key file:
/usr/local/etc/stunnel/mail.pem
2002.11.25 13:48:53 LOG5[344:134594560]:
FD_SETSIZE=1024, file ulimit=3636 -> 500 clients
allowed
2002.11.25 13:48:53 LOG7[344:134594560]: FD 5 in
non-blocking mode
2002.11.25 13:48:53 LOG7[344:134594560]: SO_REUSEADDR
option set on accept socket
2002.11.25 13:48:53 LOG7[344:134594560]: 3306 bound to
127.0.0.1:3306
2002.11.25 13:48:53 LOG7[344:134594560]: Created pid
file /stunnel.pid
2002.11.25 13:49:02 LOG7[344:134594560]: 3306 accepted
FD=6 from 127.0.0.1:1057
2002.11.25 13:49:02 LOG7[344:134594560]: FD 6 in
non-blocking mode
2002.11.25 13:49:02 LOG7[344:134596608]: 3306 started
2002.11.25 13:49:02 LOG5[344:134596608]: 3306
connected from 127.0.0.1:1057
2002.11.25 13:49:02 LOG7[344:134596608]: FD 7 in
non-blocking mode
2002.11.25 13:49:02 LOG7[344:134596608]: 3306
connecting 192.168.1.6:3307
2002.11.25 13:49:02 LOG7[344:134596608]: remote
connect #1: EINPROGRESS: retrying
2002.11.25 13:49:02 LOG7[344:134596608]:
waitforsocket: FD=7, DIR=write
2002.11.25 13:49:02 LOG7[344:134596608]:
waitforsocket: ok
2002.11.25 13:49:02 LOG7[344:134596608]: Remote FD=7
initialized
2002.11.25 13:49:02 LOG7[344:134596608]: SSL state
(accept): before/accept initialization
2002.11.25 13:49:02 LOG7[344:134596608]:
waitforsocket: FD=6, DIR=read
2002.11.25 13:49:13 LOG7[344:134596608]:
waitforsocket: ok
2002.11.25 13:49:13 LOG3[344:134596608]: SSL_accept:
Peer suddenly disconnected
2002.11.25 13:49:13 LOG7[344:134596608]: 3306 finished
(0 left)


================================

Everything I have read on mysql says it can be forced
to use a port, but I'm not connecting locally, it just
appears that way to the server; I can't send
arguments.  



--- Dan Nelson <dnelson@stripped> wrote:
> In the last episode (Nov 25), twig les said:
> > Hey all, I'm having a painful time trying to get
> stunnel and mysql to
> > play together.  My mysql works fine locally and
> remotely until I add
> > stunnel.  After chasing my tail for a week (and
> drinking a lot on the
> > weekend) I realized that Mysql is trying to open a
> socket on the
> > server machine instead of using the TCP port like
> stunnel needs it
> > to.  Is there a way to force Mysql to use the TCP
> port and not the
> > socket?
> 
> Try -h 127.0.0.1, or -h <hostname>.  Don't use -h
> localhost, because
> that means "use the socket".
> 
> -- 
> 	Dan Nelson
> 	dnelson@stripped


=====
-----------------------------------------------------------
If you give a man a fish, he can eat for a day
If you bludgeon him to death, you can eat the fish yourself                       
-----------------------------------------------------------

__________________________________________________
Do you Yahoo!?
Yahoo! Mail Plus http://mailplus.yahoo.com
Thread
Need to force Mysql to use port, NOT sockettwig les25 Nov
  • Re: Need to force Mysql to use port, NOT socketDan Nelson25 Nov
    • Re: Need to force Mysql to use port, NOT sockettwig les25 Nov
    • Connecting via 127.0.0.1 (was Need to force Mysql to use port, NOT socket)twig les26 Nov
      • Re: Connecting via 127.0.0.1 (was Need to force Mysql to use port, NOT socket)Dan Nelson26 Nov