Upgrade to 5.0.1 from 4.3.3

[Bruno Bzeznik]

Hello,

Currently using icommands and irods server at version 4.3.3, I'm planning to upgrade to 5.0.1.

For now, I just tried to use irods icommands 5.0.1 with my 4.3.3 servers and I get this error message, which I suppose is normal and has maybe something to do with the openssl 3 migration?

remote addresses: XXX.XXX.XXX.XXX ERROR: [-]       /build/source/lib/core/src/sockComm.cpp:895:int connectToRhost(rcComm_t *, int, int) :  status [Unknown iRODS error]  errno [Operation not permitted] -- message [failed to call 'client start']
        [-]     /build/source/lib/core/src/sockComm.cpp:86:irods::error sockClientStart(irods::network_object_ptr, rodsEnv *) :  status [Unknown iRODS error]  errno [Operation not permitted] -- message [failed to call 'client start']
                [-]     /build/source/plugins/network/src/ssl.cpp:618:irods::error ssl_client_start(irods::plugin_context &, rodsEnv *) :  status [Unknown iRODS error]  errno [Operation not permitted] -- message [irodsEncryption error. Key size, salt size or num hash rounds is 0.]

remote addresses: XXX.XXX.XXX.XXX ERROR: _rcConnect: connectToRhost error, server on xxxx.xxx.xx:1247 is probably down status = -1 Unknown iRODS error, Operation not permitted

Do I have to take care of something important during the upgrade of the servers ?

[Kory Draughn]

Hi Bruno,

I assume the 5.0.1 icommands are being run from a computer other than the server. Is that correct?

Can you post the irods_environment.json file being used by the 5.0.1 icommands?

Please remove sensitive info before posting.

Kory Draughn

Chief Technologist

iRODS Consortium

--
--
The Integrated Rule-Oriented Data System (iRODS) - https://irods.org
 
iROD-Chat: http://groups.google.com/group/iROD-Chat
---
You received this message because you are subscribed to the Google Groups "iRODS-Chat" group.
To unsubscribe from this group and stop receiving emails from it, send an email to irod-chat+...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/irod-chat/6edebdef-de11-49f8-a071-230d7607e2a9n%40googlegroups.com.

[Bruno Bzeznik]

Yes, icommands run from a different computer.

irods_environment.json file (anonymized):

{
    "irods_authentication_scheme": "pam_password",
    "irods_host": "myServer.mydomain.fr",
    "irods_port": 1247,
    "irods_ssl_ca_certificate_file": "/etc/irods/chain.pem",
    "irods_ssl_verify_server": "cert",
    "irods_user_name": "myUsername",
    "irods_zone_name": "myZone"
}

[Kory Draughn]

Bruno,

You're missing the encryption settings.

See https://docs.irods.org/5.0.1/system_overview/tls/#encryption-settings for more information. 

Kory Draughn

Chief Technologist

iRODS Consortium

To view this discussion visit https://groups.google.com/d/msgid/irod-chat/e9a9fca1-b018-40bf-b19f-7b4c891c24ben%40googlegroups.com.

[Bruno Bzeznik]

Thanks!

It now work with just those few lines added to the client irods_environment.json file

    "irods_encryption_algorithm" : "AES-256-CBC",
    "irods_encryption_key_size" : 32,
    "irods_encryption_num_hash_rounds": 16,
    "irods_encryption_salt_size": 8

So, 5.0.1 clients seems compatible with 4.3.3 server as far as we add this to the client configuration

Regards