DataStax Help Center

cqlsh Fails when using SSL

Summary

Client to node encryption causes cqlsh to fail to connect.

Symptoms

After enabling client-to-node encryption on a cluster running DSE 4.7 (C* 2.1), subsequent attempts to connect via cqlsh result in a failure to connect with the following error:

 

$ cqlsh --ssl

Connection error: ('Unable to connect to any servers', {'127.0.0.1': TypeError("member_descriptor' object is not callable",)})

Cause

The official cause at this time is not yet known. See CASSANDRA-7973  for more details on the current progress of determining a root cause. However, it appears that the issue is not present if Python 2.7+ is used.

Workaround

Upgrading Python to 2.7 will take care of the issue. However, on OS distributions using the yum package manager, upgrading Python for all users to 2.7 will break yum. In instances like these, Python 2.7 will need to be installed for the user running DSE, while leaving the root user using Python 2.6. The steps for doing that are as follows:

Install Python 2.7

All of the commands that follow must be executed with root permissions.

Begin by installing the Development tools group for yum, as well as a few other development packages for ssl, etc.


$ yum groupinstall "Development tools" $ yum install zlib-devel $ yum install bzip2-devel $ yum install openssl-devel $ yum install ncurses-devel $ yum install sqlite-devel

After yum has updated, you will need to download, compile and install python 2.7

All of the following is executed as root

$ cd /opt
$ wget --no-check-certificate https://www.python.org/ftp/python/2.7.6/Python-2.7.6.tar.xz
$ tar xf Python-2.7.6.tar.xz
$ cd Python-2.7.6
$ ./configure --prefix=/usr/local
$ make && make altinstall

Once Python 2.7 is installed, verify that 2.6 is installed for root, and 2.7 is installed for the user account that is runing DSE.

Verify that the $PATH for root does not have /usr/local/bin first

[root@localhost bin]# echo $PATH
/sbin:/bin:/usr/sbin:/usr/bin

Verify that the python version used for root is in /usr/bin/python 

[root@localhost bin]# which python
/usr/bin/python
[root@localhost bin]# exit
exit

Verify that the python version used for the DSE user account is in /usr/local/bin/python


user: which python
[user@localhost bin]$ which python
/usr/local/bin/python
[user@localhost bin]$ sudo su

At this point, root is running Python 2.6 (which is used for yum), and the user account that is running DSE is running Python 2.7

[root@localhost bin]# python -V
Python 2.6.6
[root@localhost bin]# exit
exit
[user@localhost bin]$ python -V
Python 2.7.6

 

After the above steps, cqlsh will work (assuming no other SSL configuration errors)

 

[user@localhost bin]$ cat /etc/redhat-release 
CentOS release 6.3 (Final)
[user@localhost bin]$ ./cqlsh --ssl
Connected to Test Cluster at 127.0.0.1:9042.
[cqlsh 5.0.1 | Cassandra 2.1.5.469 | DSE 4.7.0 | CQL spec 3.2.0 | Native protocol v3]
Use HELP for help.
cqlsh> 

And so does yum

[user@localhost bin]$ sudo yum install wireshark.x86_64
Loaded plugins: fastestmirror, refresh-packagekit, security
Loading mirror speeds from cached hostfile
<Redacted for Brevity>
Installed: wireshark.x86_64 0:1.8.10-8.el6_6
Dependency Installed: libsmi.x86_64 0:0.4.8-4.el6
Complete!
[user@localhost bin]$

 

Solution

At the time of this publication, CASSANDRA-7973 has no solution in place. Upgrading Python is the only fix at the moment.

 

Was this article helpful?
2 out of 2 found this helpful
Have more questions? Submit a request

Comments

  • Avatar
    Andrew Johnson

    A piece of literary excellence to join the likes of Hunter S. Thompson..

Powered by Zendesk