Freerdp: Connection Failure to RDS farm host

[bigpjo]

When trying to connect to a host server in an RDS farm the connection fails with no error but from the logging I have found

[15:59:49:068] [8352:00002030] [ERROR][com.freerdp.core] - freerdp_set_last_error ERRCONNECT_PASSWORD_CERTAINLY_EXPIRED [0x0002000F]
[15:59:49:068] [8352:00002030] [ERROR][com.freerdp.core.transport] - BIO_read returned an error: error:14094438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error
[15:59:49:068] [8352:00002030] [ERROR][com.freerdp.core.transport] - BIO_read returned a system error 0: No error

The password is certainly not expired as I was logged on to another server with the same credentials!

[hardening]

We need more details =>https://github.com/FreeRDP/FreeRDP/wiki/BugReporting

[bigpjo]

Sorry my bad.

When I try to connect to a host which is a member of an farm there is nothing appears to happen, it just returns to the command line with no error.

the command line used is

wfreerdp /v:xxxx /w:640 /h:420 /bpp +compression /audio-mode:2 +clipboard +fonts - window-drag /gdi:sw /cert-itnore /u:xxxxx /p:xxxxx

I am running this from a Windows 7 Enterprise Desktop connecting to a Windows 2008 R2 server farm, access to the farm is determined by round-robin over a list of servers that are members of the same farm.

If I run using the command line switch /admin it will connect and work fine!

The freerdp version used is 2.0.0.0

[bigpjo]

Found the issue, I had one server in the farm that was not configured for NLA. Sorry

[c-lillini]

Hi,
I have the same problem:
[11:48:31:636] [10276:00002038] [DEBUG][com.freerdp.core.nego] - Enabling security layer negotiation: TRUE
[11:48:31:636] [10276:00002038] [DEBUG][com.freerdp.core.nego] - Enabling restricted admin mode: FALSE
[11:48:31:636] [10276:00002038] [DEBUG][com.freerdp.core.nego] - Enabling RDP security: TRUE
[11:48:31:636] [10276:00002038] [DEBUG][com.freerdp.core.nego] - Enabling TLS security: TRUE
[11:48:31:636] [10276:00002038] [DEBUG][com.freerdp.core.nego] - Enabling NLA security: TRUE
[11:48:31:636] [10276:00002038] [DEBUG][com.freerdp.core.nego] - Enabling NLA extended security: FALSE
[11:48:31:636] [10276:00002038] [DEBUG][com.freerdp.core.nego] - state: NEGO_STATE_NLA
[11:48:31:636] [10276:00002038] [DEBUG][com.freerdp.core.nego] - Attempting NLA security
[11:48:31:676] [10276:00002038] [DEBUG][com.freerdp.core.nego] - RequestedProtocols: 3
[11:48:31:707] [10276:00002038] [DEBUG][com.freerdp.core.nego] - RDP_NEG_RSP
[11:48:31:707] [10276:00002038] [DEBUG][com.freerdp.core.nego] - selected_protocol: 2
[11:48:31:707] [10276:00002038] [DEBUG][com.freerdp.core.nego] - state: NEGO_STATE_FINAL
[11:48:31:707] [10276:00002038] [DEBUG][com.freerdp.core.nego] - Negotiated NLA security
[11:48:31:708] [10276:00002038] [DEBUG][com.freerdp.core.nego] - nego_security_connect with PROTOCOL_NLA
[11:48:31:801] [10276:00002038] [DEBUG][com.winpr.sspi] - InitSecurityInterfaceExW
[11:48:31:802] [10276:00002038] [DEBUG][com.freerdp.core.nla] - nla_client_init 314 : packageName=N ; cbMaxToken=65791
[11:48:32:100] [10276:00002038] [TRACE][com.freerdp.core.nla] - InitializeSecurityContext status SEC_I_CONTINUE_NEEDED [0x00090312]
[11:48:32:100] [10276:00002038] [DEBUG][com.freerdp.core.nla] - Sending Authentication Token
...
[11:48:32:241] [10276:00002038] [TRACE][com.freerdp.core.nla] - InitializeSecurityContext SEC_I_CONTINUE_NEEDED [0x00090312]
[11:48:32:242] [10276:00002038] [DEBUG][com.freerdp.core.nla] - Sending Authentication Token
...
[11:48:32:343] [10276:00002038] [TRACE][com.freerdp.core.nla] - InitializeSecurityContext SEC_E_OK [0x00000000]
[11:48:32:346] [10276:00002038] [DEBUG][com.freerdp.core.nla] - Sending Authentication Token
...
[11:48:32:385] [10276:00002038] [ERROR][com.freerdp.core] - freerdp_set_last_error ERRCONNECT_PASSWORD_CERTAINLY_EXPIRED [0x0002000F]
[11:48:32:385] [10276:00002038] [ERROR][com.freerdp.core.transport] - BIO_read returned an error: error:14094438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error
[11:48:32:385] [10276:00002038] [DEBUG][com.freerdp.core.transport] - transport_check_fds: transport_read_pdu() - -1
[11:48:32:385] [10276:00002038] [DEBUG][com.freerdp.core.rdp] - transport_check_fds() - -1

Authentication works perfectly in FreeRDP version 1.1.

Do you have any idea?

[bigpjo]

Hi Christian

Something has changed and not if there server does not configured to use
NLA it fails

If you try using command line parameter /sec:tls

This resolved it for me

Regards

Paul

On 10 Dec 2017 10:54 am, "Christian Lillini" [e-mail]
wrote:

Hi,
I have the same problem:
[11:48:31:636] [10276:00002038] [DEBUG][com.freerdp.core.nego] - Enabling
security layer negotiation: TRUE
[11:48:31:636] [10276:00002038] [DEBUG][com.freerdp.core.nego] - Enabling
restricted admin mode: FALSE
[11:48:31:636] [10276:00002038] [DEBUG][com.freerdp.core.nego] - Enabling
RDP security: TRUE
[11:48:31:636] [10276:00002038] [DEBUG][com.freerdp.core.nego] - Enabling
TLS security: TRUE
[11:48:31:636] [10276:00002038] [DEBUG][com.freerdp.core.nego] - Enabling
NLA security: TRUE
[11:48:31:636] [10276:00002038] [DEBUG][com.freerdp.core.nego] - Enabling
NLA extended security: FALSE
[11:48:31:636] [10276:00002038] [DEBUG][com.freerdp.core.nego] - state:
NEGO_STATE_NLA
[11:48:31:636] [10276:00002038] [DEBUG][com.freerdp.core.nego] -
Attempting NLA security
[11:48:31:676] [10276:00002038] [DEBUG][com.freerdp.core.nego] -
RequestedProtocols: 3
[11:48:31:707] [10276:00002038] [DEBUG][com.freerdp.core.nego] -
RDP_NEG_RSP
[11:48:31:707] [10276:00002038] [DEBUG][com.freerdp.core.nego] -
selected_protocol: 2
[11:48:31:707] [10276:00002038] [DEBUG][com.freerdp.core.nego] - state:
NEGO_STATE_FINAL
[11:48:31:707] [10276:00002038] [DEBUG][com.freerdp.core.nego] -
Negotiated NLA security
[11:48:31:708] [10276:00002038] [DEBUG][com.freerdp.core.nego] -
nego_security_connect with PROTOCOL_NLA
[11:48:31:801] [10276:00002038] [DEBUG][com.winpr.sspi] -
InitSecurityInterfaceExW
[11:48:31:802] [10276:00002038] [DEBUG][com.freerdp.core.nla] -
nla_client_init 314 : packageName=N ; cbMaxToken=65791
[11:48:32:100] [10276:00002038] [TRACE][com.freerdp.core.nla] -
InitializeSecurityContext status SEC_I_CONTINUE_NEEDED [0x00090312]
[11:48:32:100] [10276:00002038] [DEBUG][com.freerdp.core.nla] - Sending
Authentication Token
...
[11:48:32:241] [10276:00002038] [TRACE][com.freerdp.core.nla] -
InitializeSecurityContext SEC_I_CONTINUE_NEEDED [0x00090312]
[11:48:32:242] [10276:00002038] [DEBUG][com.freerdp.core.nla] - Sending
Authentication Token
...
[11:48:32:343] [10276:00002038] [TRACE][com.freerdp.core.nla] -
InitializeSecurityContext SEC_E_OK [0x00000000]
[11:48:32:346] [10276:00002038] [DEBUG][com.freerdp.core.nla] - Sending
Authentication Token
...
[11:48:32:385] [10276:00002038] [ERROR][com.freerdp.core] -
freerdp_set_last_error ERRCONNECT_PASSWORD_CERTAINLY_EXPIRED [0x0002000F]
[11:48:32:385] [10276:00002038] [ERROR][com.freerdp.core.transport] -
BIO_read returned an error: error:14094438:SSL
routines:ssl3_read_bytes:tlsv1 alert internal error
[11:48:32:385] [10276:00002038] [DEBUG][com.freerdp.core.transport] -
transport_check_fds: transport_read_pdu() - -1
[11:48:32:385] [10276:00002038] [DEBUG][com.freerdp.core.rdp] -
transport_check_fds() - -1

Authentication works perfectly in FreeRDP version 1.1.

Do you have any idea?

—
You are receiving this because you modified the open/close state.
Reply to this email directly, view it on GitHub
https://github.com/FreeRDP/FreeRDP/issues/4304#issuecomment-350539903,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AYgH5eCw1LKwkgwwhWARGp7O70PX9oiDks5s-7h_gaJpZM4Q60NT
.

[c-lillini]

Hi Paul,
I try sec parameter, but I got this error:
[17:14:34:528] [6756:000029d4] [WARN][com.freerdp.core.nego] - Error: HYBRID_REQUIRED_BY_SERVER
[17:14:34:528] [6756:000029d4] [ERROR][com.freerdp.core.nego] - Protocol Security Negotiation Failure
[17:14:34:528] [6756:000029d4] [ERROR][com.freerdp.core] - freerdp_set_last_error ERRCONNECT_SECURITY_NEGO_CONNECT_FAILED [0x0002000C]
[17:14:34:528] [6756:000029d4] [ERROR][com.freerdp.core.connection] - Error: protocol security negotiation or connection failure

[bigpjo]

Hi Christian

Did you try all options i.e. /sec:RDP as well?

I had this issue connecting to an RDS farm which the odd server were not
NLA enabled.

Using the /sec: parameter resolved the issue.

On 10 Dec 2017 4:17 pm, "Christian Lillini" [e-mail]
wrote:

Hi Paul,
I try sec parameter, but I got this error:
[17:14:34:528] [6756:000029d4] [WARN][com.freerdp.core.nego] - Error:
HYBRID_REQUIRED_BY_SERVER
[17:14:34:528] [6756:000029d4] [ERROR][com.freerdp.core.nego] - Protocol
Security Negotiation Failure
[17:14:34:528] [6756:000029d4] [ERROR][com.freerdp.core] -
freerdp_set_last_error ERRCONNECT_SECURITY_NEGO_CONNECT_FAILED
[0x0002000C]
[17:14:34:528] [6756:000029d4] [ERROR][com.freerdp.core.connection] -
Error: protocol security negotiation or connection failure

—
You are receiving this because you modified the open/close state.
Reply to this email directly, view it on GitHub
https://github.com/FreeRDP/FreeRDP/issues/4304#issuecomment-350559352,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AYgH5TS3f_RUQU7cZZUm3n55P7EtOICPks5s_AQngaJpZM4Q60NT
.

[c-lillini]

Hi Paul,
I tried all the values, but it does not work.
Maybe it's better to create a new issue.

Thanks.

[bigpjo]

I think so.

Sorry I could not be more help

On 11 Dec 2017 17:38, "Christian Lillini" [e-mail] wrote:

Hi Paul,
I tried all the values, but it does not work.
Maybe it's better to create a new issue.

Thanks.

—
You are receiving this because you modified the open/close state.
Reply to this email directly, view it on GitHub
https://github.com/FreeRDP/FreeRDP/issues/4304#issuecomment-350798731,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AYgH5Xm8e35XA9qJkzXnfrA5cxOozdv_ks5s_Wh3gaJpZM4Q60NT
.

[digital-abyss]

I've also started experiencing this issue, but wasn't sure if I should post it here or https://github.com/cedrozor/myrtille/issues/76.

Using xfreerdp on Linux Mint Sonya (18.2) to a Windows 10 Pro Server installed via QEMU/KVM. xfreerdp was working well until I tried today (not sure if windows ran some update?)

xfreerdp --version
This is FreeRDP version 2.0.0-dev (git n/a)

Command and Error when trying to connect:

xfreerdp +aero +fonts +window-drag +gfx-h264 +gfx-progressive /jpeg /compression:on /scale-desktop:200 /scale-device:180 /multitouch:on /gdi:hw /rfx /f /u:<username> /v:<ipv4addr>
[00:41:21:456] [6890:6891] [INFO][com.freerdp.client.common.cmdline] - loading channelEx drdynvc
Password: 
[00:41:25:533] [6890:6891] [ERROR][com.freerdp.core] - freerdp_set_last_error ERRCONNECT_PASSWORD_CERTAINLY_EXPIRED [0x0002000F]
[00:41:25:533] [6890:6891] [ERROR][com.freerdp.core.transport] - BIO_read returned an error: error:14094438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error
[00:41:25:533] [6890:6891] [ERROR][com.freerdp.client.x11] - Freerdp connect error exit status 1

Any help would be appreciated.

[akallabeth]

@digital-abyss See #4449