Can't access admin controls at specified URL

J4G · April 26, 2015, 1:15am

I think I’ve followed the instructions for setting up Mail-in-a-Box exactly. I set all my domain’s namespaces and installed on an Azure instance. The only difference is I had to use the subdomain “guy-email” instead of “box”. Whenever I try to connect to the IP address I’m supposed to be going to, the connection times out. Is there some troubleshooting I can follow to get this up and running?

Thanks!

EDIT: If it helps, I ran

wget -O - http://127.0.0.1/admin

and received

wget: unable to resolve host address ‘guy-email.breaksuit.com’

Which I assume means that there’s an issue with my DNS settings.

JoshData · April 26, 2015, 4:26pm

If you can’t connect by IP address, there’s probably a firewall setting in Azure getting in the way?

J4G · April 26, 2015, 6:02pm

Hey Josh, I actually resolved this. I couldn’t work out how to open the ports on Azure, but I figured it out a bit later.

If you’re interested I can put together a guide on deploying to Azure specifically. Thanks for all the great work you’re doing!

EDIT: Also I understand if you’d like me to start a new topic, but after getting an SSL certificate Chrome is reporting that “the page includes other resources that are not secure” and giving me a red lock. Any ideas on that?

JoshData · April 27, 2015, 1:08pm

Absolutely.

after getting an SSL certificate Chrome is reporting that “the page includes other resources that are not secure” and giving me a red lock

On the admin page? That’s not supposed to happen. Can you open the dev console and paste any relevant content errors?

J4G · April 27, 2015, 1:35pm

I did and there aren’t any insecure resources there. I think it’s just caching or something along those lines- Chrome on another computer showed everything was OK. The weird thing is even after clearing my cache and a restart the problem wasn’t fixed. Ah well, at this point it’s just a cosmetic issue for me.

I was also wondering if there’s a way to make the Mail-in-a-box Certificate Request ask for SHA-2 certificates. Chrome has started to display yellow triangle locks on the URL bar, and I think there are plans to phase it out entirely by 2017.

JoshData · April 27, 2015, 2:38pm

It does already:

github.com

mail-in-a-box/mailinabox/blob/2d1186e55d314ff3452bf154d3c923cd26cb2e46/management/web_update.py#L215


			"-days", "365",
			"-in", csr_fp.name,
			"-signkey", ssl_key,
			"-out", ssl_certificate])


def create_csr(domain, ssl_key, env):
	return shell("check_output", [
"openssl", "req", "-new",
"-key", ssl_key,
"-out",  "/dev/stdout",
"-sha256",
"-subj", "/C=%s/ST=/L=/O=/CN=%s" % (env["CSR_COUNTRY"], domain)])


def install_cert(domain, ssl_cert, ssl_chain, env):
	if domain not in get_web_domains(env):
		return "Invalid domain name."


	# Write the combined cert+chain to a temporary path and validate that it is OK.
	# The certificate always goes above the chain.
	import tempfile, os
	fd, fn = tempfile.mkstemp('.pem')

And for the default self-signed cert:

github.com

mail-in-a-box/mailinabox/blob/7c85694d60f11f6ee9e207bf180ff1482923c199/setup/ssl.sh#L36


# Set the umask so the key file is not world-readable.
if [ ! -f $STORAGE_ROOT/ssl/ssl_private_key.pem ]; then
	(umask 077; hide_output \
		openssl genrsa -out $STORAGE_ROOT/ssl/ssl_private_key.pem 2048)
fi


# Generate a certificate signing request.
if [ ! -f $STORAGE_ROOT/ssl/ssl_cert_sign_req.csr ]; then
	hide_output \
	openssl req -new -key $STORAGE_ROOT/ssl/ssl_private_key.pem -out $STORAGE_ROOT/ssl/ssl_cert_sign_req.csr \
	  -sha256 -subj "/C=$CSR_COUNTRY/ST=/L=/O=/CN=$PRIMARY_HOSTNAME"
fi


# Generate a SSL certificate by self-signing.
if [ ! -f $STORAGE_ROOT/ssl/ssl_certificate.pem ]; then
	hide_output \
	openssl x509 -req -days 365 \
	  -in $STORAGE_ROOT/ssl/ssl_cert_sign_req.csr -signkey $STORAGE_ROOT/ssl/ssl_private_key.pem -out $STORAGE_ROOT/ssl/ssl_certificate.pem
fi


# For nginx and postfix, pre-generate some Diffie-Hellman cipher bits which is

J4G · April 27, 2015, 8:23pm

Hmm… that’s strange. I’m using StartSSL. Here’s what Chrome says about the certificate.

Is that a StartSSL issue? I’m assuming Chrome is flagging it because of the thumbprint.