Subject: Problems with apache+ mod_ssl on Solaris 8

From: Joerg Lehrke <[email-masked]>
Date: Sat, 02 Mar 2002 13:35:56 +0100

Hi,

I'm running apache-1.3.23+mod_ssl-2.8.7 compiled with mm-1.1.3 on Solaris 
8. The machine has the recommended patches (Jan/18/02)  for Solaris 8 
applied and the semaphore relevant entries on the machine in /etc/system 
are:
set semsys:seminfo_semmns=410
set semsys:seminfo_semmni=70
set semsys:seminfo_semmsl=210
set semsys:seminfo_semopm=100
set semsys:seminfo_semvmx=32767

I'm running two Apache instances, one on port 80/443 and the other instance 
on 82/445. I found that especially IE5.x can break the running apache at 
port 445 first partly (only this client is not getting the request) and 
finally even total (no further request is served).
I'm using SSLCipherSuite 
ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL

Whenever the problem occurs, the system is running out of semaphores or 
something related, because an application using a semaphore produces 
warnings during semaphore operations (No space left on device) after a few 
requests from IE to apache. This seems to be the reason for the total 
breakdown of Apache, too.

Has anyone observed a similar behavior and maybe a solution to the problem?

	Cheers!
- --
Joerg Lehrke                         GnuPG-KeyID: C66844AC
The Knoc                                  http://k.noc.de/
Bgm.-Haffner-Str. 7,      D-87600 Kaufbeuren,      Germany
Tel +49 8341 874647           GNU -- Protect your freedom!

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Joerg Lehrke <[email-masked]>
Date: Mon, 04 Mar 2002 19:43:17 +0100

Hi,

yesterday I wrote a request about problems running Apache with mod_ssl on 
Solaris. Now I found out more about my problem:
All browsers, which support multiple connections within one session (IE, 
Opera, ...), produce the errors. The only way to stop this problem was do 
disable the SSLSessionCache feature completely. I found the problem with a 
normal configuration running on port 443 as well.
Do I miss something, or could it be that the problem comes from the fact, 
that my session cache file was on a Solaris tmpfs file-system?

	Help wanted!

- --On Saturday, March 02, 2002 01:35:56 PM +0100 Joerg Lehrke 
<[email-masked]> wrote:

> I'm running two Apache instances, one on port 80/443 and the other
> instance  on 82/445. I found that especially IE5.x can break the running
> apache at  port 445 first partly (only this client is not getting the
> request) and  finally even total (no further request is served).
> I'm using SSLCipherSuite
> warnings during semaphore operations (No space left on device) after a
> few  requests from IE to apache. This seems to be the reason for the
> total  breakdown of Apache, too.
>

- --

---

From: Brad Burdick <[email-masked]>
Date: Mon, 4 Mar 2002 10:56:21 -0800 (PST)

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hi,
> 

i'm running apache 1.3.23 + mod_ssl 2.8.7-1.3.23 on a solaris 8 sparc without
problems.  i'm using dbm for the cache, though.

SSLSessionCache         dbm:logs/ssl_scache
SSLSessionCacheTimeout  300

-brad
-- 
Brad Burdick      | [email-masked]
http://media.org/ | The medium is NOT the message
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Joerg Lehrke <[email-masked]>
Date: Mon, 04 Mar 2002 22:12:31 +0100

Hi Brad,

do you also run Solaris 8 with 64 Bit extension? And are you sure, not to 
have the same problem? Have you ever tried e.g. Opera with 50 concurrent 
connections configured to get a page with 50 small images. This breaks my 
Apache with all possible SSLSessionCache-implementations.

- --On Monday, March 04, 2002 10:56:21 AM -0800 Brad Burdick 
<[email-masked]> wrote:

>> Hi,
>>
>> yesterday I wrote a request about problems running Apache with mod_ssl
>> on  Solaris. Now I found out more about my problem:
>> Opera, ...), produce the errors. The only way to stop this problem was
>> do  disable the SSLSessionCache feature completely. I found the problem
>> with a  normal configuration running on port 443 as well.
>> Do I miss something, or could it be that the problem comes from the
>> fact,  that my session cache file was on a Solaris tmpfs file-system?
>
> i'm running apache 1.3.23 + mod_ssl 2.8.7-1.3.23 on a solaris 8 sparc
> without problems.  i'm using dbm for the cache, though.
>

- --

---

From: Joerg Lehrke <[email-masked]>
Date: Tue, 05 Mar 2002 11:04:09 +0100

Hi Brad,

I'm now using the dbm implementation with your settings. First the problem 
was remaining until I disabled the SSLMutex. Now everything seems to be 
fine. So my investigations brought up two different problems:
1. At least the shmcb implementation in not clean until mod_ssl 2.8.7
2. The semaphore mechanism raises a dead lock situation under load.

	Thanks for your help!

- --