Custom Query (196 matches)

Currently lockername.scripts.mit.edu gives a certificate error. We have a valid certificate for *.scripts.mit.edu but it is currently not used. The problem is that (modulo recent extensions) the HTTPS protocol doesn’t support sending the virtual host name before the server must decide which certificate to present.

There have been two proposed solutions. One is to use the ​SNI extension. This requires upgrading OpenSSL to at least 0.9.8f, ​patching mod_ssl, and using relatively recent browsers (old browsers will fall back to the current behavior).

The other is to move *.scripts.mit.edu to a separate IP from scripts.mit.edu, so that the server knows which certificate to present based on the IP. This is less general (we can’t extend this to work with arbitrary vhosts), but we could probably implement it now.

In parallel-find.pl, we should

• replace find -fprint with find -print, so it runs on my laptop
• for each file found, use fs la to check that scripts-security-upd still has write bits; if not, we can ignore the directory
• for each file found, tail -1 to find the version and spit that out with the filename.

Also, it should be in svn, so these changes can have a history.

Quentin once wrote:

"""Once again, hosage on steve-dallas has struck hodge-podge. We really need to move hodge-podge to its own machine."""

It sounds like this was resolved today, though.