General: This is the home page of a channel. It is similar to someone's profile "wall" in a social network context. Posts created by the channel are displayed according to the observer's viewing permissions.
Create a Post: If you have permission to create posts on the channel page, then you will see the post editor at the top.

Wed, 26 Dec 2018 18:39:01 -0500 last edited: Wed, 26 Dec 2018 21:11:24 -0500

HI everyone :)

After doing a fresh Hubzilla install last week I am now running in to a curious issue.

First off, I noticed after the fresh install that I'm getting "connection not secure" which I'm now seeing that Zotadel.net also has this issue.

2018-12-26_1828
by Cbickf on Screencast.com

On my old install I'm not getting this though.

2018-12-26_1829
by Cbickf on Screencast.com

My real worry is that I can't login at all on my new install #^https://hubz.odat.xyz ( was just about to try the nomadic ID finally)
When I enter my creds, the page just reloads without any error message.

I thought I might have forgotten my password, but reset password has me enter my email address (which I know is correct since I received the initial registration/admin account created email to this address) and it just goes back to the login page. No notification of sent email on the page and no email received.

under /ver/log/apache2/ error logs I'm not seeing anything related to this at all.

Other than trying a completely fresh install, I'm not sure how to troubleshoot this since I can't find any errors to research.

As far as I know I haven't touched hubzilla files since it was last working on 12/21/18 and the only changes to the server were installing Matrix Synapse and Nextcloud

Can anyone please recommend what to look in to for more info on what's going wrong?

show all 11 comments

Camron Bickford

Wed, 26 Dec 2018 20:53:49 -0500

Correction. Of course Zotadel.net doesn't have this "connection not secure" issue and it's just something going through from my account.

2018-12-26_2052
by Cbickf on Screencast.com

Grouchy

Wed, 26 Dec 2018 21:01:13 -0500

I see security warnings on the /network page on my own site. I suspect it's caused by a post in the stream with an embedded image that's on http instead of https.

Camron Bickford

Wed, 26 Dec 2018 21:09:20 -0500

Thanks for pointing that out @Grouchy Indeed I had these warnings right after the fresh install when I was able to log in fine, so I don't think it's necessarily related to my login issue.

I've noticed the registration page also does nothing but reload the same page again.

M. Dent

Wed, 26 Dec 2018 21:14:35 -0500

Try manually clearing the cookies in your browser. Also make sure to try with one of the "standard" browsers. I've run into problems on occassion with "off-brand" browsers (most notably Brave) that, even though they use one of the standard engines, they clearly do "something" to make things different.

Camron Bickford

Wed, 26 Dec 2018 21:30:00 -0500

(post to test email notifications for the new install)

Waitman Gobble

Thu, 27 Dec 2018 03:37:05 -0500 last edited: Thu, 27 Dec 2018 03:43:47 -0500

You could use something like mailjet or sendgrid for free. I have found Postmark to be the most reliable, but it is a paid service. Sendgrid is the cheapest i've found, when you go over the 2 million emails per month plan.
If you have DKIM and SPF set up you can easily get the same delivery rate at Sendgrid. However sending over 2 million emails a month can be like a snake swallowing a pig, if you don't have alot of dedicated resources.

Supposedly AWS is hella cheap for sending emails but i've not tried that one.

#^Postmark: Transactional Email Service with Exceptional Delivery

Trusted by thousands of developers, Postmark is a fast and reliable transactional email service. Send with Postmark to ensure your transactional emails get to the inbox on time, every time.

Max Kostikov

Thu, 27 Dec 2018 12:57:47 -0500

I suspect it's caused by a post in the stream with an embedded image that's on http instead of https.

Hubzilla should automatically 'sslify' all images with http:// by default so this can be some other link (not image).
You can enable 'sslify' for those links as well with [system][sslify_everything] variable.

Grouchy

Thu, 27 Dec 2018 14:05:51 -0500

Good to know. Thank you.

Camron Bickford

Thu, 17 Jan 2019 17:50:27 -0500 last edited: Thu, 17 Jan 2019 17:52:42 -0500

This is still giving me headaches.

My hub won't let me log in over https. The page just reloads when I enter my creds.

Sometimes I can see my feed for a second before the page goes back to the login screen.

Logging in without https works just fine but I'm running out of ideas.

I'm trying this with Firefox and Chrome on both Win 10 and Debian9. I don't think it's related to embedded images or cache or cookies.

Any more suggestions are much appreciated.

https://hubz.odat.xyz

Camron Bickford

Fri, 18 Jan 2019 01:08:54 -0500

the problem was not using https for the initial install and the switched to https later.

I resinstalled and used https from the start for the installer and this issue is resolved now :)

Thank you for the suggestions guys!

Camron Bickford

Fri, 18 Jan 2019 01:55:50 -0500

and just to quote the doc:

Please test your certificate prior to installation. A web tool for testing your
certificate is available at "http://www.digicert.com/help/". When visiting your
site for the first time, please use the SSL ("https://") URL if SSL is
available. This will avoid problems later. The installation routine will not
allow you to use a non browser-valid certificate.

#^https://framagit.org/hubzilla/core/blob/master/install/INSTALL.txt

Fresh install, SSL trouble

Camron Bickford

Fri, 21 Dec 2018 13:15:03 -0500 last edited: Fri, 21 Dec 2018 13:38:49 -0500

2018-12-21_1305
by Cbickf on Screencast.com

Trying a fresh install on my home network and debian 9.

Hubzilla Server - Setup - System check


Url rewrite in .htaccess is not working. Check your server configuration.Test: array ( 'return_code' => 0, 'success' => false, 'header' => '', 'body' => '', 'error' => 'SSL: certificate subject name \'Broadband Router\' does not match target host name \'hubz.odat.xyz\'', 'debug' => array ( 'url' => 'https://hubz.odat.xyz/setup/testrewrite', 'content_type' => NULL, 'http_code' => 0, 'header_size' => 0, 'request_size' => 0, 'filetime' => -1, 
....

I don't really understand what the problem is since I hadn't tried setting up ssl yet.
(mod ssl and mod rewrite are enabled)

Any pointers would be great guys.

my .htaccess file

show all 15 comments

Waitman Gobble

Fri, 21 Dec 2018 14:25:00 -0500

The subject of the cert needs to be hubz.odat.xyz

Generate a csr and get it signed by a ca.

Camron Bickford

Fri, 21 Dec 2018 14:33:44 -0500 last edited: Fri, 21 Dec 2018 14:34:34 -0500

thanks @Alex If I understood correctly, I've deactivated "disable_functions" and reloaded apache.

2018-12-21_1428
by Cbickf on Screencast.com

My only php.ini files are in etc/php/7.0/cli/php.ini and in

etc/php/7.0/apache2/php.ini

2018-12-21_1430
by Cbickf on Screencast.com

I'm still get the same error as above though. Did I miss something there?

Camron Bickford

Fri, 21 Dec 2018 14:37:47 -0500

@Waitman Gobble I ran certbot successfully too (letsencrypt certonly --standalone) as described here

#^https://project.hubzilla.org/wiki/hubzilla/Hubzilla%2BProject/Installation%2BInstructions

Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/hubz.odat.xyz/fullchain.pem

Waitman Gobble

Fri, 21 Dec 2018 14:53:16 -0500

maybe dns issue? sni issue?


% host hubz.odat.xyz
hubz.odat.xyz has address 69.50.60.247
% host cloud.odat.xyz
cloud.odat.xyz has address 69.50.60.247

that screenshot kinda looked like an MS windows screenshot, it threw me off. for a moment I thought you were running apache and php on a windows machine. :)



% openssl s_client -showcerts -connect hubz.odat.xyz:443

CONNECTED(00000003)
depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
verify return:1
depth=0 CN = cloud.odat.xyz

[h2]verify return:1[/h2]

Certificate chain
 0 s:CN = cloud.odat.xyz
 i:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
 1 s:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
 i:O = Digital Signature Trust Co., CN = DST Root CA X3
-----BEGIN CERTIFICATE-----
...

[h2]-----END CERTIFICATE-----[/h2]

Server certificate
subject=CN = cloud.odat.xyz

issuer=C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3[hr]No client certificate CA names sent
Peer signing digest: SHA512
Peer signature type: RSA

[h2]Server Temp Key: ECDH, P-256, 256 bits[/h2]

SSL handshake has read 3052 bytes and written 443 bytes

[h2]Verification: OK[/h2]

New, TLSv1.2, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
 Protocol : TLSv1.2
 Cipher : ECDHE-RSA-AES128-GCM-SHA256
 Session-ID: 3D66650D3E8B79B95C83BAC6D60D6B539C69D5428FB123E0A9C577F1DE61EE88
 Session-ID-ctx: 
 Master-Key: 4950B16C0BF9F21656125C98BA292D3E01EFE2369B0368CC0680D942D949B0333E47B03B92E1BAA4930DBD31CAD27F64
 PSK identity: None
 PSK identity hint: None
 SRP username: None
 Start Time: 1545421513
 Timeout : 7200 (sec)
 Verify return code: 0 (ok)

[h2] Extended master secret: no[/h2]

closed

cloud.odat.xyz is an installation of nextcloud.

Waitman Gobble

Fri, 21 Dec 2018 15:01:35 -0500

here, an image of the code block.. the web site should not be able to screw that up. :)

Camron Bickford

Fri, 21 Dec 2018 15:17:24 -0500

Lolz :) Thank you!

Apache using the wrong cert seems to be the problem. I'll see if I can't figure out why. The 2 other subdomains are running without issues.

Waitman Gobble

Fri, 21 Dec 2018 15:28:40 -0500

Could be caused if the httpd host (Apache) is inside the network with a local ip, and gets traffic by NAT, DMZ zone, etc. On the firewall and/or router. Check your ssl vhosts, i think everything needs to be * instead of specific ips. An idea.

Camron Bickford

Fri, 21 Dec 2018 15:32:51 -0500

seems to me SSL is working fine now after making some changes to my vhost config for hubz.odat.xyz.

Unfortunately still this strange error.

SSL: certificate subject name \'Broadband Router\' does not match target host name \'hubz.odat.xyz\''

Camron Bickford

Fri, 21 Dec 2018 15:45:32 -0500

i think everything needs to be * instead of specific ips. An idea.

everything is set to "*"

I've added my internal IP for hubz.odat.xyz underetc/hosts and now I'm getting a different error.

The requested URL /setup/testrewrite was not found on this server.

Camron Bickford

Fri, 21 Dec 2018 15:49:40 -0500

#^http://hubz.odat.xyz/setup/testrewrite

returns "ok"

#^https://hubz.odat.xyz gives me "Not Found"

Camron Bickford

Fri, 21 Dec 2018 15:53:28 -0500

2018-12-21_1553
by Cbickf on Screencast.com

Camron Bickford

Fri, 21 Dec 2018 15:55:26 -0500

Very strange. I haven't had to add any of my other subdomains to the servers hosts file in order to get them working.

Continuing with caution :D
.

Waitman Gobble

Fri, 21 Dec 2018 16:07:24 -0500

I haven't used Apache for quite some time, but I think you have to put a seperate config section for port 80 and port 443/https ... On nginx and some other servers can iust have 'listen 80, listen 443 ssl' in same config section. Although most of the time these days its good to redirect all port 80 requests to https://$domain/$requesturi etc in one config section, then do just the 443/ssl configs for each vhost.

Camron Bickford

Fri, 21 Dec 2018 16:13:54 -0500

http://hubz.odat.xyz/profile/camron-b

I think all is working now :D

Do you know how I can verify if the poller is running correctly?

2018-12-21_1607
by Cbickf on Screencast.com

Camron Bickford

Fri, 21 Dec 2018 16:30:33 -0500

It was pure luck that I managed to throw together some part from a different config file I had for the ssl part.

if anyone else runs in to this: adding the servers local ip to the hosts file and the following config file did the trick.

<VirtualHost *:80>
ServerAdmin admin@odat.xyz
ServerName hubz.odat.xyz

DocumentRoot /var/www/hubzilla

DirectoryIndex index.php index.htm index.html
<Directory />
Options FollowSymLinks
AllowOverride All
</Directory>
<Directory /var/www/>
Options Indexes FollowSymLinks MultiViews
AllowOverride All
Order allow,deny
allow from all
</Directory>
ErrorLog ${APACHE_LOG_DIR}/hubzilla_error.log
LogLevel warn
CustomLog ${APACHE_LOG_DIR}/hubzilla_access.log combined
</VirtualHost>


<IfModule mod_ssl.c>
<VirtualHost *:443>
 DocumentRoot "/var/www/html/hubzilla"
 ServerName hubz.odat.xyz

Alias / "/var/www/hubzilla/"

 ErrorLog ${APACHE_LOG_DIR}/error.log
 CustomLog ${APACHE_LOG_DIR}/access.log combined

<Directory /var/www/html/hubzilla/>
 Options +FollowSymlinks
 AllowOverride All

 <IfModule mod_dav.c>
 Dav off
 </IfModule>

 SetEnv HOME /var/www/hubzilla
 SetEnv HTTP_HOME /var/www/hubzilla
 Satisfy Any

</Directory>

SSLCertificateFile /etc/letsencrypt/live/hubz.odat.xyz/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/hubz.odat.xyz/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>

Cam's test wiki - Everyone is welcome to play with it.

Camron Bickford

Fri, 16 Nov 2018 19:53:26 -0500

New Wiki

Cam's test wiki - Everyone is welcome to play with it.

Camron Bickford

Fri, 16 Nov 2018 20:17:06 -0500

great stuff :)

Camron Bickford

Wed, 14 Nov 2018 17:26:20 -0500

@Hubzilla Support Forum+ I'm having trouble figuring out how to update from my 3.0.1 version of Hubzilla since the repository moved to Framasoft.

cd /var/www/hubzilla/ && git pull && util/update_addon_repo hzaddons

gives me

remote: Repository not found.
fatal: repository 'https://github.com/redmatrix/hubzilla.git/' not found

Obviously ;)

I'm not very familiar with git. So I don't want to go experimenting too much and break my hub.

git remote add framasoft https://framagit.org/hubzilla/core

and then

cd /var/www/hubzilla/ && git pull framasoft && util/update_addon_repo hzaddons

I haven't been around much for a while, so I'm sure I missed some new tricks :)

Would this be the right thing to do and is there anything else I would need to do?

update framasoft

Mike Macgirvin

Wed, 14 Nov 2018 19:49:41 -0500

You'll need to add an entry to the addons directory as well.

Herbert Thielen

Thu, 15 Nov 2018 05:57:50 -0500

And safemode on/off was recommended, see the release note of 3.8.

Camron Bickford

Fri, 16 Nov 2018 18:55:02 -0500

Awesome. I've updated and it looks like everything went smooth. I changed the URL as Mike recommended and had to git -stash in my addons folder for some reason.

util/safemode on
util/udall
util/safemode off

Worked great by the looks. Thank you @Herbert Thielen and Mike!