Workaround 1 – Prevent fallback to the expired Root CA
With the removal of the expired IdenTrust DST Root CA X3 in Certificate Bundle version 1.28, it is possible to prevent fallback to the expired root CA by blocking FortiGate access to apps.identrust.com, resulting in the correct root CA being used. This can be achieved by using either DNS blackholing or via an FQDN policy to block access to apps.identrust.com.
This will force the FortiGate device to rebuild the certificate chain and find the ISRC Root X1 Root CA Cert in the local certificate in the store.
config system dns-database
edit "1"
set domain "identrust.com"
config dns-entry
edit 1
set hostname "apps"
set ip 127.0.0.1
next
end
next
end
Workaround 2 – Accept the expired certificates
For third-party sites outside of your control, customers can turn off this certificate expiration validation using the following CLI as a temporary workaround:
config firewall ssl-ssh-profile
edit "certificate-inspection"
config https
set expired-server-cert allow
set untrusted-server-cert allow
end
root@nanopi:~# iptables -t nat -L -v
Chain PREROUTING (policy ACCEPT 2756 packets, 474K bytes)
pkts bytes target prot opt in out source destination
185 32012 MARK all -- any any anywhere anywhere statistic mode nth every 15 MARK set 0x11
184 28575 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 1 MARK set 0x12
184 31952 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 2 MARK set 0x13
184 31323 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 3 MARK set 0x14
184 33123 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 4 MARK set 0x15
184 36047 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 5 MARK set 0x16
184 32939 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 6 MARK set 0x17
184 33412 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 7 MARK set 0x18
184 29916 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 8 MARK set 0x19
184 28526 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 9 MARK set 0x1a
184 29308 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 10 MARK set 0x1b
183 32364 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 11 MARK set 0x1c
183 30150 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 12 MARK set 0x1d
183 29944 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 13 MARK set 0x1e
183 34100 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 14 MARK set 0x1f
Chain INPUT (policy ACCEPT 598 packets, 40818 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 67 packets, 5056 bytes)
pkts bytes target prot opt in out source destination
5 372 MARK all -- any any anywhere anywhere statistic mode nth every 15 MARK set 0x11
5 372 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 1 MARK set 0x12
5 372 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 2 MARK set 0x13
5 372 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 3 MARK set 0x14
5 380 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 4 MARK set 0x15
5 380 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 5 MARK set 0x16
5 380 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 6 MARK set 0x17
4 300 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 7 MARK set 0x18
4 304 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 8 MARK set 0x19
4 304 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 9 MARK set 0x1a
4 304 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 10 MARK set 0x1b
4 304 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 11 MARK set 0x1c
4 304 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 12 MARK set 0x1d
4 304 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 13 MARK set 0x1e
4 304 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 14 MARK set 0x1f
Chain POSTROUTING (policy ACCEPT 23 packets, 1064 bytes)
pkts bytes target prot opt in out source destination
2 168 SNAT icmp -- any map-wan_map anywhere anywhere mark match 0x11 to:xxx.xxx.xxx.xxx:5856-5871
41 2607 SNAT tcp -- any map-wan_map anywhere anywhere mark match 0x11 to:xxx.xxx.xxx.xxx:5856-5871
8 557 SNAT udp -- any map-wan_map anywhere anywhere mark match 0x11 to:xxx.xxx.xxx.xxx:5856-5871
4 336 SNAT icmp -- any map-wan_map anywhere anywhere mark match 0x12 to:xxx.xxx.xxx.xxx:9952-9967
50 3503 SNAT tcp -- any map-wan_map anywhere anywhere mark match 0x12 to:xxx.xxx.xxx.xxx:9952-9967
13 868 SNAT udp -- any map-wan_map anywhere anywhere mark match 0x12 to:xxx.xxx.xxx.xxx:9952-9967
0 0 SNAT icmp -- any map-wan_map anywhere anywhere mark match 0x13 to:xxx.xxx.xxx.xxx:14048-14063
46 2981 SNAT tcp -- any map-wan_map anywhere anywhere mark match 0x13 to:xxx.xxx.xxx.xxx:14048-14063
11 771 SNAT udp -- any map-wan_map anywhere anywhere mark match 0x13 to:xxx.xxx.xxx.xxx:14048-14063
0 0 SNAT icmp -- any map-wan_map anywhere anywhere mark match 0x14 to:xxx.xxx.xxx.xxx:18144-18159
33 1991 SNAT tcp -- any map-wan_map anywhere anywhere mark match 0x14 to:xxx.xxx.xxx.xxx:18144-18159
10 709 SNAT udp -- any map-wan_map anywhere anywhere mark match 0x14 to:xxx.xxx.xxx.xxx:18144-18159
2 168 SNAT icmp -- any map-wan_map anywhere anywhere mark match 0x15 to:xxx.xxx.xxx.xxx:22240-22255
38 2280 SNAT tcp -- any map-wan_map anywhere anywhere mark match 0x15 to:xxx.xxx.xxx.xxx:22240-22255
13 950 SNAT udp -- any map-wan_map anywhere anywhere mark match 0x15 to:xxx.xxx.xxx.xxx:22240-22255
0 0 SNAT icmp -- any map-wan_map anywhere anywhere mark match 0x16 to:xxx.xxx.xxx.xxx:26336-26351
42 3095 SNAT tcp -- any map-wan_map anywhere anywhere mark match 0x16 to:xxx.xxx.xxx.xxx:26336-26351
11 831 SNAT udp -- any map-wan_map anywhere anywhere mark match 0x16 to:xxx.xxx.xxx.xxx:26336-26351
0 0 SNAT icmp -- any map-wan_map anywhere anywhere mark match 0x17 to:xxx.xxx.xxx.xxx:30432-30447
51 3838 SNAT tcp -- any map-wan_map anywhere anywhere mark match 0x17 to:xxx.xxx.xxx.xxx:30432-30447
11 823 SNAT udp -- any map-wan_map anywhere anywhere mark match 0x17 to:xxx.xxx.xxx.xxx:30432-30447
1 84 SNAT icmp -- any map-wan_map anywhere anywhere mark match 0x18 to:xxx.xxx.xxx.xxx:34528-34543
41 2564 SNAT tcp -- any map-wan_map anywhere anywhere mark match 0x18 to:xxx.xxx.xxx.xxx:34528-34543
9 656 SNAT udp -- any map-wan_map anywhere anywhere mark match 0x18 to:xxx.xxx.xxx.xxx:34528-34543
0 0 SNAT icmp -- any map-wan_map anywhere anywhere mark match 0x19 to:xxx.xxx.xxx.xxx:38624-38639
44 2665 SNAT tcp -- any map-wan_map anywhere anywhere mark match 0x19 to:xxx.xxx.xxx.xxx:38624-38639
9 629 SNAT udp -- any map-wan_map anywhere anywhere mark match 0x19 to:xxx.xxx.xxx.xxx:38624-38639
0 0 SNAT icmp -- any map-wan_map anywhere anywhere mark match 0x1a to:xxx.xxx.xxx.xxx:42720-42735
55 3841 SNAT tcp -- any map-wan_map anywhere anywhere mark match 0x1a to:xxx.xxx.xxx.xxx:42720-42735
11 762 SNAT udp -- any map-wan_map anywhere anywhere mark match 0x1a to:xxx.xxx.xxx.xxx:42720-42735
1 84 SNAT icmp -- any map-wan_map anywhere anywhere mark match 0x1b to:xxx.xxx.xxx.xxx:46816-46831
53 3161 SNAT tcp -- any map-wan_map anywhere anywhere mark match 0x1b to:xxx.xxx.xxx.xxx:46816-46831
10 699 SNAT udp -- any map-wan_map anywhere anywhere mark match 0x1b to:xxx.xxx.xxx.xxx:46816-46831
2 168 SNAT icmp -- any map-wan_map anywhere anywhere mark match 0x1c to:xxx.xxx.xxx.xxx:50912-50927
46 2965 SNAT tcp -- any map-wan_map anywhere anywhere mark match 0x1c to:xxx.xxx.xxx.xxx:50912-50927
9 632 SNAT udp -- any map-wan_map anywhere anywhere mark match 0x1c to:xxx.xxx.xxx.xxx:50912-50927
1 84 SNAT icmp -- any map-wan_map anywhere anywhere mark match 0x1d to:xxx.xxx.xxx.xxx:55008-55023
45 2700 SNAT tcp -- any map-wan_map anywhere anywhere mark match 0x1d to:xxx.xxx.xxx.xxx:55008-55023
10 671 SNAT udp -- any map-wan_map anywhere anywhere mark match 0x1d to:xxx.xxx.xxx.xxx:55008-55023
1 84 SNAT icmp -- any map-wan_map anywhere anywhere mark match 0x1e to:xxx.xxx.xxx.xxx:59104-59119
48 2992 SNAT tcp -- any map-wan_map anywhere anywhere mark match 0x1e to:xxx.xxx.xxx.xxx:59104-59119
15 1003 SNAT udp -- any map-wan_map anywhere anywhere mark match 0x1e to:xxx.xxx.xxx.xxx:59104-59119
1 84 SNAT icmp -- any map-wan_map anywhere anywhere mark match 0x1f to:xxx.xxx.xxx.xxx:63200-63215
38 2280 SNAT tcp -- any map-wan_map anywhere anywhere mark match 0x1f to:xxx.xxx.xxx.xxx:63200-63215
9 615 SNAT udp -- any map-wan_map anywhere anywhere mark match 0x1f to:xxx.xxx.xxx.xxx:63200-63215
Chain postrouting_lan_rule (1 references)
pkts bytes target prot opt in out source destination
Chain postrouting_rule (0 references)
pkts bytes target prot opt in out source destination
Chain postrouting_wan_rule (1 references)
pkts bytes target prot opt in out source destination
Chain prerouting_lan_rule (1 references)
pkts bytes target prot opt in out source destination
Chain prerouting_rule (0 references)
pkts bytes target prot opt in out source destination
Chain prerouting_wan_rule (1 references)
pkts bytes target prot opt in out source destination
Chain zone_lan_postrouting (0 references)
pkts bytes target prot opt in out source destination
0 0 postrouting_lan_rule all -- any any anywhere anywhere /* !fw3: Custom lan postrouting rule chain */
Chain zone_lan_prerouting (0 references)
pkts bytes target prot opt in out source destination
389 44358 prerouting_lan_rule all -- any any anywhere anywhere /* !fw3: Custom lan prerouting rule chain */
Chain zone_wan_postrouting (0 references)
pkts bytes target prot opt in out source destination
0 0 postrouting_wan_rule all -- any any anywhere anywhere /* !fw3: Custom wan postrouting rule chain */
0 0 MASQUERADE all -- any any anywhere anywhere /* !fw3 */
Chain zone_wan_prerouting (0 references)
pkts bytes target prot opt in out source destination
6 786 prerouting_wan_rule all -- any any anywhere anywhere /* !fw3: Custom wan prerouting rule chain */
root@nanopi:~#
2021/09/22追記: 8日間稼働した後の状態
root@nanopi:~# iptables -t nat -L -v
Chain PREROUTING (policy ACCEPT 1434K packets, 285M bytes)
pkts bytes target prot opt in out source destination
95575 19M MARK all -- any any anywhere anywhere statistic mode nth every 15 MARK set 0x11
95574 19M MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 1 MARK set 0x12
95574 19M MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 2 MARK set 0x13
95574 19M MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 3 MARK set 0x14
95574 19M MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 4 MARK set 0x15
95574 19M MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 5 MARK set 0x16
95574 19M MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 6 MARK set 0x17
95573 19M MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 7 MARK set 0x18
95573 19M MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 8 MARK set 0x19
95573 19M MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 9 MARK set 0x1a
95573 19M MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 10 MARK set 0x1b
95573 19M MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 11 MARK set 0x1c
95573 19M MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 12 MARK set 0x1d
95573 19M MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 13 MARK set 0x1e
95573 19M MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 14 MARK set 0x1f
Chain INPUT (policy ACCEPT 231K packets, 17M bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 1399 packets, 222K bytes)
pkts bytes target prot opt in out source destination
94 15373 MARK all -- any any anywhere anywhere statistic mode nth every 15 MARK set 0x11
94 16668 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 1 MARK set 0x12
94 13812 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 2 MARK set 0x13
94 14151 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 3 MARK set 0x14
93 14819 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 4 MARK set 0x15
93 13431 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 5 MARK set 0x16
93 15387 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 6 MARK set 0x17
93 14528 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 7 MARK set 0x18
93 15124 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 8 MARK set 0x19
93 16367 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 9 MARK set 0x1a
93 14850 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 10 MARK set 0x1b
93 14763 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 11 MARK set 0x1c
93 14121 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 12 MARK set 0x1d
93 13029 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 13 MARK set 0x1e
93 15394 MARK all -- any any anywhere anywhere statistic mode nth every 15 packet 14 MARK set 0x1f
Chain POSTROUTING (policy ACCEPT 1289 packets, 186K bytes)
pkts bytes target prot opt in out source destination
772 64680 SNAT icmp -- any map-wan_map anywhere anywhere mark match 0x11 to:xxx.xxx.xxx.xxx:5856-5871
14703 948K SNAT tcp -- any map-wan_map anywhere anywhere mark match 0x11 to:xxx.xxx.xxx.xxx:5856-5871
3753 257K SNAT udp -- any map-wan_map anywhere anywhere mark match 0x11 to:xxx.xxx.xxx.xxx:5856-5871
837 70140 SNAT icmp -- any map-wan_map anywhere anywhere mark match 0x12 to:xxx.xxx.xxx.xxx:9952-9967
14623 945K SNAT tcp -- any map-wan_map anywhere anywhere mark match 0x12 to:xxx.xxx.xxx.xxx:9952-9967
3628 254K SNAT udp -- any map-wan_map anywhere anywhere mark match 0x12 to:xxx.xxx.xxx.xxx:9952-9967
806 67536 SNAT icmp -- any map-wan_map anywhere anywhere mark match 0x13 to:xxx.xxx.xxx.xxx:14048-14063
14690 930K SNAT tcp -- any map-wan_map anywhere anywhere mark match 0x13 to:xxx.xxx.xxx.xxx:14048-14063
3705 257K SNAT udp -- any map-wan_map anywhere anywhere mark match 0x13 to:xxx.xxx.xxx.xxx:14048-14063
853 71540 SNAT icmp -- any map-wan_map anywhere anywhere mark match 0x14 to:xxx.xxx.xxx.xxx:18144-18159
14620 936K SNAT tcp -- any map-wan_map anywhere anywhere mark match 0x14 to:xxx.xxx.xxx.xxx:18144-18159
3696 255K SNAT udp -- any map-wan_map anywhere anywhere mark match 0x14 to:xxx.xxx.xxx.xxx:18144-18159
802 67088 SNAT icmp -- any map-wan_map anywhere anywhere mark match 0x15 to:xxx.xxx.xxx.xxx:22240-22255
14833 942K SNAT tcp -- any map-wan_map anywhere anywhere mark match 0x15 to:xxx.xxx.xxx.xxx:22240-22255
3723 256K SNAT udp -- any map-wan_map anywhere anywhere mark match 0x15 to:xxx.xxx.xxx.xxx:22240-22255
834 69944 SNAT icmp -- any map-wan_map anywhere anywhere mark match 0x16 to:xxx.xxx.xxx.xxx:26336-26351
14759 930K SNAT tcp -- any map-wan_map anywhere anywhere mark match 0x16 to:xxx.xxx.xxx.xxx:26336-26351
3689 258K SNAT udp -- any map-wan_map anywhere anywhere mark match 0x16 to:xxx.xxx.xxx.xxx:26336-26351
804 67480 SNAT icmp -- any map-wan_map anywhere anywhere mark match 0x17 to:xxx.xxx.xxx.xxx:30432-30447
14874 946K SNAT tcp -- any map-wan_map anywhere anywhere mark match 0x17 to:xxx.xxx.xxx.xxx:30432-30447
3746 261K SNAT udp -- any map-wan_map anywhere anywhere mark match 0x17 to:xxx.xxx.xxx.xxx:30432-30447
868 72800 SNAT icmp -- any map-wan_map anywhere anywhere mark match 0x18 to:xxx.xxx.xxx.xxx:34528-34543
14703 937K SNAT tcp -- any map-wan_map anywhere anywhere mark match 0x18 to:xxx.xxx.xxx.xxx:34528-34543
3698 254K SNAT udp -- any map-wan_map anywhere anywhere mark match 0x18 to:xxx.xxx.xxx.xxx:34528-34543
843 70644 SNAT icmp -- any map-wan_map anywhere anywhere mark match 0x19 to:xxx.xxx.xxx.xxx:38624-38639
14651 931K SNAT tcp -- any map-wan_map anywhere anywhere mark match 0x19 to:xxx.xxx.xxx.xxx:38624-38639
3720 256K SNAT udp -- any map-wan_map anywhere anywhere mark match 0x19 to:xxx.xxx.xxx.xxx:38624-38639
768 64288 SNAT icmp -- any map-wan_map anywhere anywhere mark match 0x1a to:xxx.xxx.xxx.xxx:42720-42735
14731 942K SNAT tcp -- any map-wan_map anywhere anywhere mark match 0x1a to:xxx.xxx.xxx.xxx:42720-42735
3689 251K SNAT udp -- any map-wan_map anywhere anywhere mark match 0x1a to:xxx.xxx.xxx.xxx:42720-42735
839 70084 SNAT icmp -- any map-wan_map anywhere anywhere mark match 0x1b to:xxx.xxx.xxx.xxx:46816-46831
14826 944K SNAT tcp -- any map-wan_map anywhere anywhere mark match 0x1b to:xxx.xxx.xxx.xxx:46816-46831
3729 257K SNAT udp -- any map-wan_map anywhere anywhere mark match 0x1b to:xxx.xxx.xxx.xxx:46816-46831
841 70420 SNAT icmp -- any map-wan_map anywhere anywhere mark match 0x1c to:xxx.xxx.xxx.xxx:50912-50927
14751 939K SNAT tcp -- any map-wan_map anywhere anywhere mark match 0x1c to:xxx.xxx.xxx.xxx:50912-50927
3697 252K SNAT udp -- any map-wan_map anywhere anywhere mark match 0x1c to:xxx.xxx.xxx.xxx:50912-50927
783 65492 SNAT icmp -- any map-wan_map anywhere anywhere mark match 0x1d to:xxx.xxx.xxx.xxx:55008-55023
14802 937K SNAT tcp -- any map-wan_map anywhere anywhere mark match 0x1d to:xxx.xxx.xxx.xxx:55008-55023
3679 255K SNAT udp -- any map-wan_map anywhere anywhere mark match 0x1d to:xxx.xxx.xxx.xxx:55008-55023
850 71288 SNAT icmp -- any map-wan_map anywhere anywhere mark match 0x1e to:xxx.xxx.xxx.xxx:59104-59119
14824 942K SNAT tcp -- any map-wan_map anywhere anywhere mark match 0x1e to:xxx.xxx.xxx.xxx:59104-59119
3622 246K SNAT udp -- any map-wan_map anywhere anywhere mark match 0x1e to:xxx.xxx.xxx.xxx:59104-59119
870 72968 SNAT icmp -- any map-wan_map anywhere anywhere mark match 0x1f to:xxx.xxx.xxx.xxx:63200-63215
14802 941K SNAT tcp -- any map-wan_map anywhere anywhere mark match 0x1f to:xxx.xxx.xxx.xxx:63200-63215
3684 258K SNAT udp -- any map-wan_map anywhere anywhere mark match 0x1f to:xxx.xxx.xxx.xxx:63200-63215
Chain postrouting_lan_rule (1 references)
pkts bytes target prot opt in out source destination
Chain postrouting_rule (0 references)
pkts bytes target prot opt in out source destination
Chain postrouting_wan_rule (1 references)
pkts bytes target prot opt in out source destination
Chain prerouting_lan_rule (1 references)
pkts bytes target prot opt in out source destination
Chain prerouting_rule (0 references)
pkts bytes target prot opt in out source destination
Chain prerouting_wan_rule (1 references)
pkts bytes target prot opt in out source destination
Chain zone_lan_postrouting (0 references)
pkts bytes target prot opt in out source destination
0 0 postrouting_lan_rule all -- any any anywhere anywhere /* !fw3: Custom lan postrouting rule chain */
Chain zone_lan_prerouting (0 references)
pkts bytes target prot opt in out source destination
389 44358 prerouting_lan_rule all -- any any anywhere anywhere /* !fw3: Custom lan prerouting rule chain */
Chain zone_wan_postrouting (0 references)
pkts bytes target prot opt in out source destination
0 0 postrouting_wan_rule all -- any any anywhere anywhere /* !fw3: Custom wan postrouting rule chain */
0 0 MASQUERADE all -- any any anywhere anywhere /* !fw3 */
Chain zone_wan_prerouting (0 references)
pkts bytes target prot opt in out source destination
6 786 prerouting_wan_rule all -- any any anywhere anywhere /* !fw3: Custom wan prerouting rule chain */
root@nanopi:~#
Jul 13 10:50:05 ホスト名1 dovecot: dict(23024): Error: mysql(127.0.0.1): Connect failed to database (vmail): Can't connect to MySQL s
erver on '127.0.0.1' (111 "Connection refused") - waiting for 5 seconds before retry
Jul 13 10:50:05 ホスト名1 dovecot: dict(23024): Error: mysql(127.0.0.1): Connect failed to database (vmail): Can't connect to MySQL s
erver on '127.0.0.1' (111 "Connection refused") - waiting for 5 seconds before retry
Jul 13 10:50:10 ホスト名1 dovecot: dict: Error: #007Character set 'utf8' is not a compiled character set and is not specified in the '/usr/share/mysql/charsets/Index.xml' file
Jul 13 10:50:10 ホスト名1 dovecot: dict(23024): Error: mysql(127.0.0.1): Connect failed to database (vmail): Can't initialize character set utf8 (path: /usr/share/mysql/charsets/) - waiting for 25 seconds before retry
Jul 13 10:50:10 ホスト名1 dovecot: dict: Error: #007Character set 'utf8' is not a compiled character set and is not specified in the '/usr/share/mysql/charsets/Index.xml' file
Jul 13 10:50:10 ホスト名1 dovecot: dict(23024): Error: mysql(127.0.0.1): Connect failed to database (vmail): Can't initialize character set utf8 (path: /usr/share/mysql/charsets/) - waiting for 25 seconds before retry
Jul 13 10:50:11 ホスト名1 dovecot: dict: Error: #007Character set 'utf8' is not a compiled character set and is not specified in the '/usr/share/mysql/charsets/Index.xml' file
Jul 13 10:50:11 ホスト名1 dovecot: dict(23338): Error: mysql(127.0.0.1): Connect failed to database (vmail): Can't initialize character set utf8 (path: /usr/share/mysql/charsets/) - waiting for 1 seconds before retry
# mysql -u root
mysql: Warning: Charset id '33' csname 'utf8mb3' trying to replace existing csname 'utf8'
mysql: Warning: Charset id '83' csname 'utf8mb3' trying to replace existing csname 'utf8'
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 1103
Server version: 10.6.3-MariaDB-log MariaDB Server
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]>
起動したのでフォーラムにあった設定を入れる。
MariaDB [(none)]> show global variables like '%log_warnings%';
+---------------+-------+
| Variable_name | Value |
+---------------+-------+
| log_warnings | 2 |
+---------------+-------+
1 row in set (0.002 sec)
MariaDB [(none)]> set global log_warnings=1;
Query OK, 0 rows affected (0.000 sec)
MariaDB [(none)]> show global variables like '%log_warnings%';
+---------------+-------+
| Variable_name | Value |
+---------------+-------+
| log_warnings | 1 |
+---------------+-------+
1 row in set (0.002 sec)
MariaDB [(none)]> quit
Bye
#
しばらく放置・・・
Jul 13 13:40:01 ホスト名 mariadbd: 2021-07-13 13:40:01 313 [Warning] Aborted connection 313 to db: 'unconnected' user: 'unauthenticated' host: 'localhost' (This connection closed normally without authentication)
Jul 13 13:40:02 ホスト名 mariadbd: 2021-07-13 13:40:02 314 [Warning] Aborted connection 314 to db: 'unconnected' user: 'unauthenticated' host: 'localhost' (This connection closed normally without authentication)
Jul 13 13:40:04 ホスト名 mariadbd: 2021-07-13 13:40:04 315 [Warning] Aborted connection 315 to db: 'unconnected' user: 'unauthenticated' host: 'localhost' (This connection closed normally without authentication)
Jul 13 13:42:53 ホスト名 mariadbd: 2021-07-13 13:42:53 359 [Warning] Aborted connection 359 to db: 'vmail' user: 'vmail' host: 'localhost' (Got an error reading communication packets)
Jul 13 13:42:53 ホスト名 mariadbd: 2021-07-13 13:42:53 352 [Warning] Aborted connection 352 to db: 'vmail' user: 'vmail' host: 'localhost' (Got an error reading communication packets)
Jul 13 13:42:53 ホスト名 mariadbd: 2021-07-13 13:42:53 357 [Warning] Aborted connection 357 to db: 'vmail' user: 'vmail' host: 'localhost' (Got an error reading communication packets)
Jul 13 13:42:53 ホスト名 mariadbd: 2021-07-13 13:42:53 351 [Warning] Aborted connection 351 to db: 'vmail' user: 'vmail' host: 'localhost' (Got an error reading communication packets)
うーん？
あれ？反映されてない
# mysql -u root
mysql: Warning: Charset id '33' csname 'utf8mb3' trying to replace existing csname 'utf8'
mysql: Warning: Charset id '83' csname 'utf8mb3' trying to replace existing csname 'utf8'
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 474
Server version: 10.6.3-MariaDB-log MariaDB Server
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]> show global variables like '%log_warnings%';
+---------------+-------+
| Variable_name | Value |
+---------------+-------+
| log_warnings | 2 |
+---------------+-------+
1 row in set (0.002 sec)
MariaDB [(none)]> set global log_warnings=1;
Query OK, 0 rows aff
MariaDB [(none)]>
# mysql -u root
mysql: Warning: Charset id '33' csname 'utf8mb3' trying to replace existing csname 'utf8'
mysql: Warning: Charset id '83' csname 'utf8mb3' trying to replace existing csname 'utf8'
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 38510
Server version: 10.6.3-MariaDB-log MariaDB Server
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]> SELECT REPLACE(@@OLD_MODE, ',', '\n');
+--------------------------------+
| REPLACE(@@OLD_MODE, ',', '\n') |
+--------------------------------+
| UTF8_IS_UTF8MB3 |
+--------------------------------+
1 row in set (0.023 sec)
MariaDB [(none)]>
# mysql -u root
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 405
Server version: 10.6.3-MariaDB-log MariaDB Server
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]> exit
Bye
#
# Sample configuration file for ESMTP.
#
# Jose Fonseca
# Set SMTP host and service (port)
#
hostname = localhost:25
# Set the user name
#
username = "USERNAME"
# Set the password
password = "PASSWORD"
# Use the Starttls
#
#starttls = disabled
#
# It can be one of "enabled", "disabled" or "required". It defaults to
# disabled.
# Set the certificate passphrase
#
#certificate_passphrase = "CERTIFICATE_PASSPHRASE"
# Command to run before contacting the SMTP server
#
#preconnect = "ssh -f -L 2025:mail.isp.com:25 user@shell.isp.com 'sleep 5'"
# Same as above but for a different identity which can be selected with the
# '-f' flag. You can have as many you like.
#
identity = myself@somewhere.com
hostname = smtp.somewhere.com:25
username = "myself"
password = "secret"
#starttls = disabled
#
# NOTE: the default indentity settings aren't shared by the other identities.
# Everything (username, password, etc.) must be specified for every identity
# even if they don't differ from the default identity.
# Set the Mail Delivery Agent (MDA)
#
mda = "/usr/bin/procmail -d %T"
#
# Some possible MDAs are "/usr/bin/procmail -d %T", "/usr/bin/deliver" or
# "/usr/lib/mail.local %T".
さて、Oracle Linux 7環境でesmtpを設定してみたところ、cronで送られてくるメールが送信できていないようだ。
/etc/cron.daily/0logwatch:
You have old files in your logwatch tmpdir (/var/cache/logwatch):
logwatch.idrC25J0
logwatch.Hb7DUNNO
The directories listed above were most likely created by a
logwatch run that failed to complete successfully. If so, you
may delete these directories.
/bin/mktemp: failed to create directory via template '/root/.esmtp_queue/XXXXXXX
X': Permission denied
unable to create tempdir inside /root/.esmtp_queue
/etc/cron.daily/0yum-daily.cron:
# grep deni /var/log/audit/audit.log*|grep mail_home_rw_t
#============= logwatch_t ==============
#!!!! This avc is allowed in the current policy
allow logwatch_t mail_home_rw_t:dir create;
allow logwatch_t mail_home_rw_t:file create;
# grep deni /var/log/audit/audit.log*|grep mail_home_rw_t | audit2allow -M mktemp
******************** IMPORTANT ***********************
To make this policy package active, execute:
semodule -i mktemp.pp
# semodule -i mktemp.pp
# semodule -l | mktemp
mktemp 1.0
#
ただ、１回だけではだめで、何回か追加を繰り替えすことになった。
最終的に作成された mktemp.te ファイルは下記となった。
module mktemp 1.0.8;
require {
type logwatch_t;
type mail_home_rw_t;
class file { create link open read setattr unlink write };
class dir { add_name create read remove_name rmdir write };
}
#============= logwatch_t ==============
#!!!! This avc is allowed in the current policy
allow logwatch_t mail_home_rw_t:dir { add_name create read remove_name rmdir write };
#!!!! This avc is allowed in the current policy
allow logwatch_t mail_home_rw_t:file { create link open read setattr unlink write };
