Posted: 2019-07-17 08:47:31 by Alasdair Keyes
I upgraded my home server to Debian 10 (Buster) this week. It's running on quite an old HP Proliant Microserver so I bought a new SSD to use for the OS partitions to give it a little extra life. As such, it was a fresh install rather than an in-place upgrade.
As you would imagine 10 is much the same as 9 in most respects. But there were a couple of points of note...
The Buster Puppet install was using version
5.5.10 whereas my Puppet Master (On Debian Stretch) was using
4.8.2 when connecting to the master the new install would error with
Warning: SSL_connect returned=1 errno=0 state=error: dh key too small
The answer to this was found at another chap's blog https://blog.steve.fi/upgraded_my_first_host_to_buster.html and is to do with system-wide SSL settings, although I fixed it slightly differently.
/etc/ssl/openssl.cnf I updated the line
CipherString = DEFAULT@SECLEVEL=2
CipherString = DEFAULT@SECLEVEL=1
It turns out this is a non-standard, custom security setting made by Debian https://wiki.debian.org/ContinuousIntegration/TriagingTips/openssl-1.1.1
It doesn't appear that you can define a custom set of Diffie Hellman params for a Puppet Master as you can for other software like NGINX and Apache. As soon as I have my Puppet Master on the later version I'll be changing this setting back, assuming it doesn't interfere with anything else.
check_disk_ioNagios plugin was failing
It turns out the output of the
iostat command had changed slightly and required a tweak to continue working. Commit https://gitlab.com/alasdairkeyes/nagios-plugin-check_disk_io/commit/0708ba7b9cb0017f6f36554d54ee3e37a9b58d63
debsecanpackage is enabled by default
I wasn't aware this package existed until it started emailing me with all the system vulnerabilities. I can see a use for it, but as my systems are updated regularly, it's now purged by Puppet.
SMBus PIIX4 adapterdevice
sensors utility used by the
check_sensors Nagios plugin was erroring that I had a critical alarm.
It turns out that there is no max/critical temp information for the thermometer on this device so the reported temperature is always higher than the threshold of 0C
# sensors ... jc42-i2c-0-18 Adapter: SMBus PIIX4 adapter port 0 at 0b00 temp1: +31.0°C (low = +0.0°C) ALARM (HIGH, CRIT) (high = +0.0°C, hyst = +0.0°C) (crit = +0.0°C, hyst = +0.0°C) ...
As I have other temperature sensors available I disabled this one by creating the following file
chip "jc42-i2c-0-18" bus "i2c-0" "SMBus PIIX4 adapter port 0 at 0b00" ignore temp1
Other than that it was all pretty seamless.
If you found this useful, please feel free to donate via bitcoin to 1NT2ErDzLDBPB8CDLk6j1qUdT6FmxkMmNz
I'm now available for IT consultancy and software development services - Cloudee LTD.
Happy user of Digital Ocean (Affiliate link)