Topic: Upgrading from 9.2 to 10. ssl-param stuck at 100% [SOLVED]

[Trojan.Hussar]

I've finally got around to upgrading from SME 9.2 to 10 and have wasted an entire day banging my head against various hardware problems. Now I have installed SME 10 on a machine and successfully restored my 9.2 backup to the machine.

I've logged into the server console and run all the available updates, but any attempt to login to webmail just returns 'login failed' and console reveals that 'ssl-params' is chewing 100% processor time. I don't know if this is doing something useful, or some kind of problem that's just hogging the processor and stopping other things from working. This is a very old Intel Atom system that worked fine on 9.2 but doesn't seem to be coping with 10.

Currently very close to dropping the old 9.2 hard drive back in and reverting to an unsupported but working system.

Any suggestions?

[brianr]

I seem to recall that one of the actions that SME10 takes is to re-generate a security key. This has been logged as taking sometime before. If you have a low end server, then perhaps this is what is happening.  If you can then I suggest you leave the server to itself for a few hours?

Someone else may be along shortly to give you more details.

[ReetP]

Tell us more about your hardware.

Old CPU/Low RAM will take forever. The system is trying to generate a much stronger SSL key and that takes a while.

Waiting will probably let it finish, but the reality is this will probably be the start of your issues, not the end.

You really need a reasonable CPU and 4Gb Ram  - quite a lot is taken up by ClamAV.

See JPs comment here:

https://forums.koozali.org/index.php/topic,54672.msg287084.html#msg287084

Code: [Select]

imap needs a dh 4096 parameter. on a slow machine without many user interaction the entropy is low and it can take up to 24h to generate it.


[Trojan.Hussar]

Tell us more about your hardware.

Old CPU/Low RAM will take forever. The system is trying to generate a much stronger SSL key and that takes a while.

Waiting will probably let it finish, but the reality is this will probably be the start of your issues, not the end.

You really need a reasonable CPU and 4Gb Ram  - quite a lot is taken up by ClamAV.

See JPs comment here:

https://forums.koozali.org/index.php/topic,54672.msg287084.html#msg287084

Code: [Select]

imap needs a dh 4096 parameter. on a slow machine without many user interaction the entropy is low and it can take up to 24h to generate it.


The machine is a Intel D945GCLF mainboard (Atom 230 1.6GHz) with 2Gb of RAM and a 240Gb SSD. This worked flawlessly for the past four years under 9.2 it hosts three domains and a couple of basic websites. It doesn't see a lot of traffic so has never been an issue.

I do have an ASRock A330GC (Atom 330 1.6GHz dual core) with 4Gb RAM in storage somewhere, which whilst still very pedestrian might give things a boost.

Just logged into the machine via SSH and TOP is reporting that ssl-param is still at 100% with 240 minutes of runtime under its belt.

Regards,
Jason.

[ReetP]

Ahh - that'll explain it then.

Yup. Your box ran v9 fine. V8 and v7 were probably blistering.

But V9 was then. This is now, and even the CentOS 7 for v10 is long in the tooth.

I'm afraid for better or worse time marches on. We are bound by upstream. People want new toys, and that takes grunt.

We no longer run 8086 on 16mb ram.

I think Clam needs 1-2Gb by itself.

Time to upgrade your hardware at the same time as your OS.

[Edit: Fix typo]

[Jean-Philippe Pialasse]

normal behaviour, you just need to be patient.

Your machine needs to create this 4096 diffie Helman parameter, once it is done your are in peace.
Atom 230 1.6GHz is indeed a small CPU and it will take time, however the more you use your server the more you do entropie and you will make it faster.

[Trojan.Hussar]

normal behaviour, you just need to be patient.

Your machine needs to create this 4096 diffie Helman parameter, once it is done your are in peace.
Atom 230 1.6GHz is indeed a small CPU and it will take time, however the more you use your server the more you do entropie and you will make it faster.

It obviously finished overnight and I have awoken to my new mail on my phone and laptop. Webmail is now working fine and all the outstanding mail from yesterday seems to have been delivered. Thanks to everyone's response to be patient. At some point I'll find a quicker motherboard and upgrade from my Intel D945GCLF from 2008!

Thanks,
Jason.

[brianr]

It obviously finished overnight and I have awoken to my new mail on my phone and laptop. Webmail is now working fine and all the outstanding mail from yesterday seems to have been delivered. Thanks to everyone's response to be patient. At some point I'll find a quicker motherboard and upgrade from my Intel D945GCLF from 2008!

Thanks,
Jason.

Excellent news!!

[TerryF]

Sling another couple of GB of memory in it and you will be even happier

[Jean-Philippe Pialasse]

the issue to keep it running this way is more the memory than the CPU itself. For a home use the CPU should be sufficient after the generation of the DH parameter, however 2gb is just enough to run the antivirus. So 4gb is the bare minimum unless you deactivate the antivirus which is not a great way to do. 

[brianr]

Sling another couple of GB of memory in it and you will be even happier

Will only take 2gb:

https://ark.intel.com/content/www/us/en/ark/products/42490/intel-desktop-board-d945gclf.html