View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0000339bareos-coredirectorpublic2014-09-18 15:442014-10-19 16:20
Reporterreaj Assigned To 
PrioritynormalSeverityminorReproducibilityalways
Status closedResolutionno change required 
PlatformLinuxOSCentOSOS Version6
Product Version13.2.2 
Summary0000339: TLS negotiation failed with FD
DescriptionI've been trying to get TLS working for my setup. I have followed http://www.devco.net/pubwiki/Bacula/TLS/ and http://blog.earth-works.com/2013/08/03/configuring-bacula-to-use-tls-to-encrypt-connections/ but I just can't get it to work.

The director's FD itself has no problem authenticating, but a remote FD just can't with the error:
Fatal error: TLS host certificate verification failed. Host name "<FQDN of client1>" did not match presented certificate
Fatal error: TLS negotiation failed with FD at "<FQDN of client1>:9102".

I have my own DNS and it's properly set.
TagsNo tags attached.

Activities

reaj

reaj

2014-09-18 15:44

reporter  

TLS negotiation failed with FD.txt (2,816 bytes)    
Client1 FD:
director-dir: bnet.c:763-0 who=client host=10.65.6.226 port=9101
director-dir: job.c:1634-0 wstorage=File
director-dir: job.c:1643-0 wstore=File where=Job resource
director-dir: job.c:1290-0 JobId=0 created Job=-Console-.2014-09-18_21.26.40_02
director-dir: cram-md5.c:64-0 send: auth cram-md5 <1369226305.1411046800@director-dir> ssl=1
director-dir: cram-md5.c:123-0 cram-get received: auth cram-md5 <1188801158.1411046800@bconsole> ssl=2
director-dir: cram-md5.c:142-0 sending resp to challenge: o5/UB3or3UAOr7VB+VIBwC
director-dir: bnet.c:292-0 TLS server negotiation established.
director-dir: ua_dotcmds.c:166-0 Cmd: .client
director-dir: ua_status.c:155-0 status:status client=client1-fd:
director-dir: bsock.c:168-0 All source addresses
director-dir: bsock.c:244-0 Current host[ipv4:10.65.0.200:9102]  All host[ipv4:10.65.0.200:9102]
director-dir: bsock.c:150-0 who=Client: client1-fd host=client1 port=9102
director-dir: fd_cmds.c:122-0 Opened connection with File daemon
director-dir: authenticate.c:212-0 Sent: Hello Director director-dir calling
director-dir: cram-md5.c:123-0 cram-get received: auth cram-md5 <63519341.1411046802@client1-fd> ssl=2
director-dir: cram-md5.c:142-0 sending resp to challenge: C7+2/HAjDB/3o/+EW5gyYD
director-dir: cram-md5.c:71-0 send: auth cram-md5 <46914750.1411046815@director-dir> ssl=2
director-dir: cram-md5.c:90-0 Authenticate OK 65+m8U/x7mB/d8+qk/lswB


Director FD:
director-dir: ua_status.c:155-0 status:status client=director-fd:
director-dir: bsock.c:168-0 All source addresses
director-dir: bsock.c:244-0 Current host[ipv4:10.65.6.226:9102]  All host[ipv4:10.65.6.226:9102]
director-dir: bsock.c:150-0 who=Client: director-fd host=director port=9102
director-dir: fd_cmds.c:122-0 Opened connection with File daemon
director-dir: authenticate.c:212-0 Sent: Hello Director director-dir calling
director-dir: cram-md5.c:123-0 cram-get received: auth cram-md5 <2036370405.1411046839@director-fd> ssl=2
director-dir: cram-md5.c:142-0 sending resp to challenge: xQ+6n9+pR8/Lg0/7Bj06mD
director-dir: cram-md5.c:71-0 send: auth cram-md5 <1150511095.1411046839@director-dir> ssl=2
director-dir: cram-md5.c:90-0 Authenticate OK B//QD7/uA5UJd6lMo+pf7D
director-dir: bnet.c:340-0 TLS client negotiation established.
director-dir: authenticate.c:289-0 >filed: 1000 OK auth
director-dir: authenticate.c:298-0 <filed: 2000 OK Hello 5
director-dir: fd_cmds.c:146-0 >filed: JobId=0 Job=-Console-.2014-09-18_21.26.40_02 SDid=0 SDtime=0 Authorization=dummy
director-dir: getmsg.c:135-0 bget_dirmsg 87: 2000 OK Job 13.2.2 (12Nov13) x86_64-unknown-linux-gnu,redhat,CentOS release 6.2 (Final)
director-dir: fd_cmds.c:148-0 <filed: 2000 OK Job 13.2.2 (12Nov13) x86_64-unknown-linux-gnu,redhat,CentOS release 6.2 (Final)director-dir: fd_cmds.c:925-0 Connected to file daemon
TLS negotiation failed with FD.txt (2,816 bytes)   
reaj

reaj

2014-09-18 15:48

reporter   ~0000985

BTW, I've setup a private CA.
mvwieringen

mvwieringen

2014-09-27 11:43

developer   ~0000989

By default peer verification is on for certificates. So for whatever
reason you use certificates that have a CN that doesn't match the reverse
DNS resolved name.

So you have a couple of options:

- disable peer verification (See docs) (Hint tlsverifypeer option)
- Use tlsallowedcn and specify the CN used in the certificate.

Issue History

Date Modified Username Field Change
2014-09-18 15:44 reaj New Issue
2014-09-18 15:44 reaj File Added: TLS negotiation failed with FD.txt
2014-09-18 15:48 reaj Note Added: 0000985
2014-09-27 11:43 mvwieringen Note Added: 0000989
2014-09-27 11:43 mvwieringen Severity major => minor
2014-09-27 11:43 mvwieringen Status new => feedback
2014-10-19 16:20 mvwieringen Status feedback => closed
2014-10-19 16:20 mvwieringen Resolution open => no change required