<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thank you, Heikki. Would the same debugging configuration work for EAP TLS?</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks!</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
-p</div>
<div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div></div>
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-size:13px; font-family:Tahoma">
<div style="font-size:12px; color:rgb(18,48,84); font-family:Arial,Helvetica,sans-serif; background-color:rgb(255,255,255)">
<p class="MsoNormal"><span style="color:#1F497D">--<br>
</span><span style="color:rgb(31,73,125)">Pat Hirayama<br>
</span><span style="font-family:Arial,Helvetica,sans-serif; font-size:12px; color:rgb(31,73,125)">Systems Engineer | CIT / Systems Engineering | 206.667.4856 |
</span><a href="mailto:phirayam@fredhutch.org" style="font-family:Arial,Helvetica,sans-serif; font-size:12px">phirayam@fredhutch.org</a><span style="font-family:Arial,Helvetica,sans-serif; font-size:12px; color:rgb(31,73,125)"> | Fred Hutch | Cures Start Here</span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> radiator <radiator-bounces@lists.open.com.au> on behalf of Heikki Vatiainen <hvn@open.com.au><br>
<b>Sent:</b> Friday, February 26, 2021 02:04<br>
<b>To:</b> radiator@lists.open.com.au <radiator@lists.open.com.au><br>
<b>Subject:</b> Re: [RADIATOR] ERR: AuthLDAP2 Could not open LDAP connection to AD domain controllers</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">On 25.1.2021 19.00, Hirayama, Pat wrote:<br>
<br>
> Thank you for the tip about enabling TLS socket debugging using<br>
> <br>
> StartupHook sub { use IO::Socket::SSL qw(debug3); }<br>
<br>
The latest updates to Radiator now have a new configuration parameter <br>
for all LDAP clauses that can enable IO::Socket::SSL debugging without <br>
StartupHook. It works for both direct LDAPS and LDAP with StartTLS. For <br>
example:<br>
<br>
<AuthBy LDAP2><br>
# Existing parameters<br>
<br>
# Enable all available IO::Socket:SSL debugging<br>
DebugTLS 3<br>
<br>
# Possibly debug LDAP too<br>
#Debug 255<br>
<br>
# More parameters<br>
</AuthBy><br>
<br>
Because this is an alternative method to enable IO::Socket::SSL <br>
debugging, the debug messages are still written to STDERR. They can be <br>
viewed directly from console or, for example on operating systems with <br>
systemd, with the journalctl utility or from system log files.<br>
<br>
The number is defined by IO::Socket::SSL and currently goes from 0 (off) <br>
to 3 for the largest amount of information.<br>
<br>
This will be part of the next release and it's already available in the <br>
patch builds.<br>
<br>
Please see below for an example of what IO::Socket::SSL logs when <br>
debugging is enabled.<br>
<br>
Thanks,<br>
Heikki<br>
<br>
<br>
> This allowed me to see that the reason why my connections were failing <br>
> despite having what appeared to be the correct SSLCiphers line was that <br>
> the key specified in SSLCAClientKey didn't match the certificate <br>
> specified in SSLCAClientCert!<br>
> <br>
> Thanks again!<br>
> <br>
> -p<br>
> <br>
> --<br>
> Pat Hirayama<br>
> Systems Engineer | CIT / Systems Engineering | 206.667.4856 | <br>
> phirayam@fredhutch.org <<a href="mailto:phirayam@fredhutch.org">mailto:phirayam@fredhutch.org</a>>| Fred Hutch |
<br>
> Cures Start Here<br>
> <br>
> ------------------------------------------------------------------------<br>
> *From:* radiator <radiator-bounces@lists.open.com.au> on behalf of <br>
> Heikki Vatiainen <hvn@open.com.au><br>
> *Sent:* Thursday, January 21, 2021 05:28<br>
> *To:* radiator@lists.open.com.au <radiator@lists.open.com.au><br>
> *Subject:* Re: [RADIATOR] ERR: AuthLDAP2 Could not open LDAP connection <br>
> to AD domain controllers<br>
> On 20.1.2021 20.49, Hirayama, Pat wrote:<br>
> <br>
>> Thank you for taking a look. The TLS setting is certainly suggestive -- <br>
>> and would explain why it works fine on CentOS 6 and not on Ubuntu 20. I <br>
>> actually got it working with Radiator 4.12 on CentOS 8 -- which is why <br>
>> the increased security stance on Ubuntu 20 looks like a promising avenue <br>
>> to investigate. Unfortunately, none of the suggestions at those links <br>
>> has gotten it working yet.<br>
> <br>
> Here's what I found out: when I set up an LDAP listener with only TLSv1<br>
> enabled, a connection attempt from Radiator on Ubuntu 20.04 fails<br>
> similar to what you saw.<br>
> <br>
> Enabling TLS debug for Net::LDAP required loading TLS socket support<br>
> with debug enabled in Radiator configuration. To do this, add the<br>
> following somewhere near Radiator's configuration file:<br>
> <br>
> StartupHook sub { use IO::Socket::SSL qw(debug3); }<br>
> <br>
> I then started Radiator's radiusd directly from command line so that it<br>
> stays on the foreground. This also allows LDAP and TLS socket debugging<br>
> to be logged on the terminal too.<br>
> <br>
> % /opt/radiator/radiator/radiusd -trace 4 -foreground -log_stdout<br>
> -log_dir . -db_dir . -config ldap.cfg<br>
> <br>
> Below is a snippet from terminal log. The first and the last line are<br>
> Radiator's logging. The log in between comes from the TLS socket module<br>
> IO::Socket::SSL. The log shows that TLS handshake starts but doesn't<br>
> succeed because of TLS version problem.<br>
> <br>
> Test was done with Radiator on Ubuntu 20.04. SECLEVEL extra parameter<br>
> was not set.<br>
> <br>
> If this is set in Radiator's configuration: 'SSLCiphers<br>
> DEFAULT@SECLEVEL=1', then TLS handshake succeeds and LDAP can start.<br>
> <br>
> The remote end is RHEL 7 with TLS listener forced to TLSv1.0 only. In<br>
> your case it may also be something else than TLS version, but the debug<br>
> should show how far it gets. Please let us know how it goes.<br>
> <br>
> 00000000 Thu Jan 21 13:15:29 2021 621281: INFO: AuthLDAP2 Connecting to<br>
> 172.16.172.49 port 636<br>
> DEBUG: .../IO/Socket/SSL.pm:3010: new ctx 94622568855936<br>
> DEBUG: .../IO/Socket/SSL.pm:762: socket not yet connected<br>
> DEBUG: .../IO/Socket/SSL.pm:1177: global error: Undefined SSL object<br>
> DEBUG: .../IO/Socket/SSL.pm:1177: global error: Undefined SSL object<br>
> DEBUG: .../IO/Socket/SSL.pm:764: socket connected<br>
> DEBUG: .../IO/Socket/SSL.pm:787: ssl handshake not started<br>
> DEBUG: .../IO/Socket/SSL.pm:832: not using SNI because hostname is unknown<br>
> DEBUG: .../IO/Socket/SSL.pm:864: request OCSP stapling<br>
> DEBUG: .../IO/Socket/SSL.pm:880: set socket to non-blocking to enforce<br>
> timeout=10<br>
> DEBUG: .../IO/Socket/SSL.pm:894: call Net::SSLeay::connect<br>
> DEBUG: .../IO/Socket/SSL.pm:897: done Net::SSLeay::connect -> -1<br>
> DEBUG: .../IO/Socket/SSL.pm:907: ssl handshake in progress<br>
> DEBUG: .../IO/Socket/SSL.pm:917: waiting for fd to become ready: SSL<br>
> wants a read first<br>
> DEBUG: .../IO/Socket/SSL.pm:937: socket ready, retrying connect<br>
> DEBUG: .../IO/Socket/SSL.pm:894: call Net::SSLeay::connect<br>
> DEBUG: .../IO/Socket/SSL.pm:897: done Net::SSLeay::connect -> -1<br>
> DEBUG: .../IO/Socket/SSL.pm:900: SSL connect attempt failed<br>
> <br>
> DEBUG: .../IO/Socket/SSL.pm:900: local error: SSL connect attempt failed<br>
> error:1425F102:SSL routines:ssl_choose_client_version:unsupported protocol<br>
> DEBUG: .../IO/Socket/SSL.pm:903: fatal SSL error: SSL connect attempt<br>
> failed error:1425F102:SSL routines:ssl_choose_client_version:unsupported<br>
> protocol<br>
> DEBUG: ...5.30/IO/Socket.pm:48: ignoring less severe local error<br>
> 'IO::Socket::IP configuration failed', keep 'SSL connect attempt failed<br>
> error:1425F102:SSL routines:ssl_choose_client_version:unsupported protocol'<br>
> DEBUG: .../IO/Socket/SSL.pm:3059: free ctx 94622568855936<br>
> open=94622568855936<br>
> DEBUG: .../IO/Socket/SSL.pm:3063: free ctx 94622568855936 callback<br>
> DEBUG: .../IO/Socket/SSL.pm:3070: OK free ctx 94622568855936<br>
> 00000000 Thu Jan 21 13:15:29 2021 656392: ERR: AuthLDAP2 Could not open<br>
> LDAP connection to 172.16.172.49 port 636. Backing off for 600 seconds.<br>
> <br>
> <br>
> -- <br>
> Heikki Vatiainen <hvn@open.com.au><br>
> <br>
> Radiator: the most portable, flexible and configurable RADIUS server<br>
> anywhere. SQL, proxy, DBM, files, LDAP, TACACS+, PAM, Active Directory,<br>
> EAP, TLS, TTLS, PEAP, WiMAX, RSA, Vasco, Yubikey, HOTP, TOTP,<br>
> DIAMETER etc. Full source on Unix, Windows, MacOSX, Solaris, VMS, etc.<br>
> _______________________________________________<br>
> radiator mailing list<br>
> radiator@lists.open.com.au<br>
> <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.open.com.au_mailman_listinfo_radiator&d=DwIF-g&c=eRAMFD45gAfqt84VtBcfhQ&r=lnQBMkNb1mBsioi6aP6ts4Sw0Ua5nVh4esYOAh4qTKU&m=Rn9JQSe7254zREmYjGKUQ9iR-NhQ84xz_wMYB0MEjxY&s=Y5A1RRCSLR8k8nZ196pTjcSajglGckvp2uD9CRk9Ufg&e=">
https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.open.com.au_mailman_listinfo_radiator&d=DwIF-g&c=eRAMFD45gAfqt84VtBcfhQ&r=lnQBMkNb1mBsioi6aP6ts4Sw0Ua5nVh4esYOAh4qTKU&m=Rn9JQSe7254zREmYjGKUQ9iR-NhQ84xz_wMYB0MEjxY&s=Y5A1RRCSLR8k8nZ196pTjcSajglGckvp2uD9CRk9Ufg&e=</a>
<br>
> <br>
<br>
-- <br>
Heikki Vatiainen <hvn@open.com.au><br>
<br>
Radiator: the most portable, flexible and configurable RADIUS server<br>
anywhere. SQL, proxy, DBM, files, LDAP, TACACS+, PAM, Active Directory,<br>
EAP, TLS, TTLS, PEAP, WiMAX, RSA, Vasco, Yubikey, HOTP, TOTP,<br>
DIAMETER etc. Full source on Unix, Windows, MacOSX, Solaris, VMS, etc.<br>
_______________________________________________<br>
radiator mailing list<br>
radiator@lists.open.com.au<br>
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.open.com.au_mailman_listinfo_radiator&d=DwIF-g&c=eRAMFD45gAfqt84VtBcfhQ&r=lnQBMkNb1mBsioi6aP6ts4Sw0Ua5nVh4esYOAh4qTKU&m=CoBUksxYSOqvRWlHfJn64sIAC1cP_eHQ1TH9QQcstxQ&s=qTx-NeoFXXK7p8uGGRqGdzC-SwjoBoyRh05MKuBz8pc&e=">https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.open.com.au_mailman_listinfo_radiator&d=DwIF-g&c=eRAMFD45gAfqt84VtBcfhQ&r=lnQBMkNb1mBsioi6aP6ts4Sw0Ua5nVh4esYOAh4qTKU&m=CoBUksxYSOqvRWlHfJn64sIAC1cP_eHQ1TH9QQcstxQ&s=qTx-NeoFXXK7p8uGGRqGdzC-SwjoBoyRh05MKuBz8pc&e=</a>
<br>
</div>
</span></font></div>
</div>
</body>
</html>