<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi Heikki,</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thank you for the tip about enabling TLS socket debugging using</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color:rgb(32, 31, 30);font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, system-ui, Roboto, "Helvetica Neue", sans-serif;font-size:14.6667px;background-color:rgb(255, 255, 255);display:inline !important"><span><br>
</span></span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color:rgb(32, 31, 30);font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, system-ui, Roboto, "Helvetica Neue", sans-serif;font-size:14.6667px;background-color:rgb(255, 255, 255);display:inline !important"><span> </span>StartupHook
sub { use IO::Socket::SSL qw(debug3); }</span></div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);">This allowed me to see that the reason why my connections were failing despite having what appeared to be the correct SSLCiphers
line was that the key specified in </span><span style="background-color: rgba(0, 0, 0, 0); color: rgb(0, 0, 0); font-family: calibri, helvetica, sans-serif; font-size: 12pt; font-variant-ligatures: no-common-ligatures;">SSLCAClientKey didn't match the certificate
specified in </span><span style="background-color: rgba(0, 0, 0, 0); color: rgb(0, 0, 0); font-family: calibri, helvetica, sans-serif; font-size: 12pt; font-variant-ligatures: no-common-ligatures;">SSLCAClientCert!</span></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span style="background-color: rgba(0, 0, 0, 0); color: rgb(0, 0, 0); font-family: calibri, helvetica, sans-serif; font-size: 12pt; font-variant-ligatures: no-common-ligatures;"><br>
</span></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span style="background-color: rgba(0, 0, 0, 0); color: rgb(0, 0, 0); font-family: calibri, helvetica, sans-serif; font-size: 12pt; font-variant-ligatures: no-common-ligatures;">Thanks again!</span></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span style="background-color: rgba(0, 0, 0, 0); color: rgb(0, 0, 0); font-family: calibri, helvetica, sans-serif; font-size: 12pt; font-variant-ligatures: no-common-ligatures;"><br>
</span></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span style="background-color: rgba(0, 0, 0, 0); color: rgb(0, 0, 0); font-family: calibri, helvetica, sans-serif; font-size: 12pt; font-variant-ligatures: no-common-ligatures;"> -p</span></div>
<div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div></div>
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-size:13px; font-family:Tahoma">
<div style="font-size:12px; color:rgb(18,48,84); font-family:Arial,Helvetica,sans-serif; background-color:rgb(255,255,255)">
<p class="MsoNormal"><span style="color:#1F497D">--<br>
</span><span style="color:rgb(31,73,125)">Pat Hirayama<br>
</span><span style="font-family:Arial,Helvetica,sans-serif; font-size:12px; color:rgb(31,73,125)">Systems Engineer | CIT / Systems Engineering | 206.667.4856 |
</span><a href="mailto:phirayam@fredhutch.org" style="font-family:Arial,Helvetica,sans-serif; font-size:12px">phirayam@fredhutch.org</a><span style="font-family:Arial,Helvetica,sans-serif; font-size:12px; color:rgb(31,73,125)"> | Fred Hutch | Cures Start Here</span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> radiator <radiator-bounces@lists.open.com.au> on behalf of Heikki Vatiainen <hvn@open.com.au><br>
<b>Sent:</b> Thursday, January 21, 2021 05:28<br>
<b>To:</b> radiator@lists.open.com.au <radiator@lists.open.com.au><br>
<b>Subject:</b> Re: [RADIATOR] ERR: AuthLDAP2 Could not open LDAP connection to AD domain controllers</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">On 20.1.2021 20.49, Hirayama, Pat wrote:<br>
<br>
> Thank you for taking a look. The TLS setting is certainly suggestive -- <br>
> and would explain why it works fine on CentOS 6 and not on Ubuntu 20. I <br>
> actually got it working with Radiator 4.12 on CentOS 8 -- which is why <br>
> the increased security stance on Ubuntu 20 looks like a promising avenue <br>
> to investigate. Unfortunately, none of the suggestions at those links <br>
> has gotten it working yet.<br>
<br>
Here's what I found out: when I set up an LDAP listener with only TLSv1 <br>
enabled, a connection attempt from Radiator on Ubuntu 20.04 fails <br>
similar to what you saw.<br>
<br>
Enabling TLS debug for Net::LDAP required loading TLS socket support <br>
with debug enabled in Radiator configuration. To do this, add the <br>
following somewhere near Radiator's configuration file:<br>
<br>
StartupHook sub { use IO::Socket::SSL qw(debug3); }<br>
<br>
I then started Radiator's radiusd directly from command line so that it <br>
stays on the foreground. This also allows LDAP and TLS socket debugging <br>
to be logged on the terminal too.<br>
<br>
% /opt/radiator/radiator/radiusd -trace 4 -foreground -log_stdout <br>
-log_dir . -db_dir . -config ldap.cfg<br>
<br>
Below is a snippet from terminal log. The first and the last line are <br>
Radiator's logging. The log in between comes from the TLS socket module <br>
IO::Socket::SSL. The log shows that TLS handshake starts but doesn't <br>
succeed because of TLS version problem.<br>
<br>
Test was done with Radiator on Ubuntu 20.04. SECLEVEL extra parameter <br>
was not set.<br>
<br>
If this is set in Radiator's configuration: 'SSLCiphers <br>
DEFAULT@SECLEVEL=1', then TLS handshake succeeds and LDAP can start.<br>
<br>
The remote end is RHEL 7 with TLS listener forced to TLSv1.0 only. In <br>
your case it may also be something else than TLS version, but the debug <br>
should show how far it gets. Please let us know how it goes.<br>
<br>
00000000 Thu Jan 21 13:15:29 2021 621281: INFO: AuthLDAP2 Connecting to <br>
172.16.172.49 port 636<br>
DEBUG: .../IO/Socket/SSL.pm:3010: new ctx 94622568855936<br>
DEBUG: .../IO/Socket/SSL.pm:762: socket not yet connected<br>
DEBUG: .../IO/Socket/SSL.pm:1177: global error: Undefined SSL object<br>
DEBUG: .../IO/Socket/SSL.pm:1177: global error: Undefined SSL object<br>
DEBUG: .../IO/Socket/SSL.pm:764: socket connected<br>
DEBUG: .../IO/Socket/SSL.pm:787: ssl handshake not started<br>
DEBUG: .../IO/Socket/SSL.pm:832: not using SNI because hostname is unknown<br>
DEBUG: .../IO/Socket/SSL.pm:864: request OCSP stapling<br>
DEBUG: .../IO/Socket/SSL.pm:880: set socket to non-blocking to enforce <br>
timeout=10<br>
DEBUG: .../IO/Socket/SSL.pm:894: call Net::SSLeay::connect<br>
DEBUG: .../IO/Socket/SSL.pm:897: done Net::SSLeay::connect -> -1<br>
DEBUG: .../IO/Socket/SSL.pm:907: ssl handshake in progress<br>
DEBUG: .../IO/Socket/SSL.pm:917: waiting for fd to become ready: SSL <br>
wants a read first<br>
DEBUG: .../IO/Socket/SSL.pm:937: socket ready, retrying connect<br>
DEBUG: .../IO/Socket/SSL.pm:894: call Net::SSLeay::connect<br>
DEBUG: .../IO/Socket/SSL.pm:897: done Net::SSLeay::connect -> -1<br>
DEBUG: .../IO/Socket/SSL.pm:900: SSL connect attempt failed<br>
<br>
DEBUG: .../IO/Socket/SSL.pm:900: local error: SSL connect attempt failed <br>
error:1425F102:SSL routines:ssl_choose_client_version:unsupported protocol<br>
DEBUG: .../IO/Socket/SSL.pm:903: fatal SSL error: SSL connect attempt <br>
failed error:1425F102:SSL routines:ssl_choose_client_version:unsupported <br>
protocol<br>
DEBUG: ...5.30/IO/Socket.pm:48: ignoring less severe local error <br>
'IO::Socket::IP configuration failed', keep 'SSL connect attempt failed <br>
error:1425F102:SSL routines:ssl_choose_client_version:unsupported protocol'<br>
DEBUG: .../IO/Socket/SSL.pm:3059: free ctx 94622568855936 <br>
open=94622568855936<br>
DEBUG: .../IO/Socket/SSL.pm:3063: free ctx 94622568855936 callback<br>
DEBUG: .../IO/Socket/SSL.pm:3070: OK free ctx 94622568855936<br>
00000000 Thu Jan 21 13:15:29 2021 656392: ERR: AuthLDAP2 Could not open <br>
LDAP connection to 172.16.172.49 port 636. Backing off for 600 seconds.<br>
<br>
<br>
-- <br>
Heikki Vatiainen <hvn@open.com.au><br>
<br>
Radiator: the most portable, flexible and configurable RADIUS server<br>
anywhere. SQL, proxy, DBM, files, LDAP, TACACS+, PAM, Active Directory,<br>
EAP, TLS, TTLS, PEAP, WiMAX, RSA, Vasco, Yubikey, HOTP, TOTP,<br>
DIAMETER etc. Full source on Unix, Windows, MacOSX, Solaris, VMS, etc.<br>
_______________________________________________<br>
radiator mailing list<br>
radiator@lists.open.com.au<br>
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.open.com.au_mailman_listinfo_radiator&d=DwIF-g&c=eRAMFD45gAfqt84VtBcfhQ&r=lnQBMkNb1mBsioi6aP6ts4Sw0Ua5nVh4esYOAh4qTKU&m=Rn9JQSe7254zREmYjGKUQ9iR-NhQ84xz_wMYB0MEjxY&s=Y5A1RRCSLR8k8nZ196pTjcSajglGckvp2uD9CRk9Ufg&e=">https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.open.com.au_mailman_listinfo_radiator&d=DwIF-g&c=eRAMFD45gAfqt84VtBcfhQ&r=lnQBMkNb1mBsioi6aP6ts4Sw0Ua5nVh4esYOAh4qTKU&m=Rn9JQSe7254zREmYjGKUQ9iR-NhQ84xz_wMYB0MEjxY&s=Y5A1RRCSLR8k8nZ196pTjcSajglGckvp2uD9CRk9Ufg&e=</a>
<br>
</div>
</span></font></div>
</div>
</body>
</html>