https://bugzilla.novell.com/show_bug.cgi?id=670580 https://bugzilla.novell.com/show_bug.cgi?id=670580#c Klaus Kämpf changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|kkaempf@novell.com |mvidner@novell.com -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=670580 https://bugzilla.novell.com/show_bug.cgi?id=670580#c2 J. Daniel Schmidt changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P4 - Low Status|NEW |ASSIGNED Severity|Minor |Enhancement --- Comment #2 from J. Daniel Schmidt 2011-02-10 18:40:17 UTC --- (In reply to comment #0)

the yastwc init script causes a dns lookup at boot when generating the self signed certificate.

Yes, but only if there is no certificate yet.

In less sheltered environments this may cause hangs due to dns timeouts.

Only during the first boot of the appliance.

The value returned isn't guaranteed to actually be resolvable either (e.g. due to foo.site entry in /etc/hosts). It would be better to refrain from the dns lookup.

The fallback is to use "webyast" as hostname if it can not be resolved. We need to create a certificate when the webserver starts, we can do this later. What we can do is to add a sleep before creating the certificate to give the network some time to come up. Would this help? The current compromise is the best we found back then. We just don't want to run WebYaST communication via HTTP unencrypted. So the script calculates the best hostname it can get and uses fallbacks in case of errors. Our main goal was not to have a self-signed certificate with the 100% correct domainname set. Just something so the WebYaST user can go on and use WebYaST without to fist SSH to the new appliance and manually configure WebYaSTs SSL certificate. This is something he can do later. Home-users might not even have an own DNS server running to resolve their internal host names.

A smarter solution would probably generate the certificate only when it's actually needed with the expected host name.

When is the certificate needed? IMHO when the webserver starts with https support. Creating an SSL certificate and restarting the webserver upon the first HTTP attempt to port 433 (and answering this first attempt) would require too much effort I think. But I am open for any improvement here and will have a look what magic cups uses. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=670580 https://bugzilla.novell.com/show_bug.cgi?id=670580#c4 Ladislav Slezak changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |NEEDINFO InfoProvider| |lnussel@suse.com --- Comment #4 from Ladislav Slezak 2012-08-08 07:58:29 UTC --- The initscript is basically the same even after refactoring. In 12.2 there is only one server running (the frontend and backend parts were merged). The idea of generating the certificate later at runtime is quite interesting. But the problem is that WebYaST needs the certificate at start up (nginx fails when it is missing). We would need a wrapper which creates the certificate and then starts the server upon receiving the first HTTP(S) request (maybe xinetd???). That's quite complicated... And can any hangs actually happen? I thought that the initscripts are executed in parallel (if possible), AFAIK webyast should not delay booting... Ludwig, any idea how to improve it? (The current initscript is here https://github.com/webyast/webyast/blob/master/webyast/package/rcwebyast) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=670580 https://bugzilla.novell.com/show_bug.cgi?id=670580#c5 Ludwig Nussel changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |ASSIGNED InfoProvider|lnussel@suse.com | --- Comment #5 from Ludwig Nussel 2013-01-16 17:27:02 CET --- you can also just take whats in /etc/HOSTNAME and not do any lookup at all. On a server /etc/HOSTNAME has to be correct anyways. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.