Freerdp: nla-connection to Windows7 with CredSSP patch stopped working again (de83f4df2)

[hendwolt]

With current master (de83f4df2) nla connections to a Windows7 Prof. with CredSSP patch stopped working. With the older version f8baeb724 it still works.
Connecting with /sec:tls to Windows7 works with the new version.
Connecting with /sec:nla to Winsows10 (Insider) works with the new version.

xfreerdp /buildconfig :
This is FreeRDP version 2.0.0-dev2 (de83f4df2)
Build configuration: BUILD_TESTING=OFF BUILTIN_CHANNELS=OFF HAVE_AIO_H=1 HAVE_EXECINFO_H=1 HAVE_FCNTL_H=1 HAVE_INTTYPES_H=1 HAVE_JOURNALD_H=TRUE HAVE_MATH_C99_LONG_DOUBLE=1 HAVE_POLL_H=1 HAVE_PTHREAD_MUTEX_TIMEDLOCK=ON HAVE_PTHREAD_MUTEX_TIMEDLOCK_LIB=1 HAVE_PTHREAD_MUTEX_TIMEDLOCK_SYMBOL= HAVE_SYSLOG_H=1 HAVE_SYS_EVENTFD_H=1 HAVE_SYS_FILIO_H= HAVE_SYS_MODEM_H= HAVE_SYS_SELECT_H=1 HAVE_SYS_SOCKIO_H= HAVE_SYS_STRTIO_H= HAVE_SYS_TIMERFD_H=1 HAVE_TM_GMTOFF=1 HAVE_UNISTD_H=1 HAVE_XI_TOUCH_CLASS=1 WITH_ALSA=ON WITH_CCACHE=ON WITH_CHANNELS=ON WITH_CLIENT=ON WITH_CLIENT_AVAILABLE=1 WITH_CLIENT_CHANNELS=ON WITH_CLIENT_CHANNELS_AVAILABLE=1 WITH_CLIENT_COMMON=ON WITH_CLIENT_INTERFACE=OFF WITH_CUPS=ON WITH_DEBUG_ALL=OFF WITH_DEBUG_CAPABILITIES=OFF WITH_DEBUG_CERTIFICATE=OFF WITH_DEBUG_CHANNELS=OFF WITH_DEBUG_CLIPRDR=OFF WITH_DEBUG_DVC=OFF WITH_DEBUG_KBD=OFF WITH_DEBUG_LICENSE=OFF WITH_DEBUG_MUTEX=OFF WITH_DEBUG_NEGO=OFF WITH_DEBUG_NLA=OFF WITH_DEBUG_NTLM=OFF WITH_DEBUG_RAIL=OFF WITH_DEBUG_RDP=OFF WITH_DEBUG_RDPDR=OFF WITH_DEBUG_RDPEI=OFF WITH_DEBUG_REDIR=OFF WITH_DEBUG_RFX=OFF WITH_DEBUG_RINGBUFFER=OFF WITH_DEBUG_SCARD=OFF WITH_DEBUG_SND=OFF WITH_DEBUG_SVC=OFF WITH_DEBUG_SYMBOLS=OFF WITH_DEBUG_THREADS=OFF WITH_DEBUG_TIMEZONE=OFF WITH_DEBUG_TRANSPORT=OFF WITH_DEBUG_TSG=OFF WITH_DEBUG_TSMF=OFF WITH_DEBUG_WND=OFF WITH_DEBUG_X11=OFF WITH_DEBUG_X11_CLIPRDR=OFF WITH_DEBUG_X11_LOCAL_MOVESIZE=OFF WITH_DEBUG_XV=OFF WITH_DIRECTFB=OFF WITH_EVENTFD_READ_WRITE=1 WITH_FFMPEG=ON WITH_GFX_H264=ON WITH_GPROF=OFF WITH_GSM=ON WITH_GSSAPI=OFF WITH_GSTREAMER_0_10=OFF WITH_GSTREAMER_1_0=ON WITH_ICU=OFF WITH_IPP=OFF WITH_JPEG=ON WITH_KRB5=ON WITH_LIBRARY_VERSIONING=ON WITH_LIBSYSTEMD=ON WITH_MACAUDIO=OFF WITH_MACAUDIO=OFF WITH_MACAUDIO_AVAILABLE=0 WITH_MANPAGES=ON WITH_MBEDTLS=OFF WITH_OPENH264=OFF WITH_OPENSLES=OFF WITH_OPENSSL=ON WITH_OSS=OFF WITH_PCSC=ON WITH_PROFILER=OFF WITH_PULSE=ON WITH_SAMPLE=OFF WITH_SANITIZE_ADDRESS=OFF WITH_SANITIZE_ADDRESS_AVAILABLE=1 WITH_SANITIZE_LEAK=OFF WITH_SANITIZE_LEAK_AVAILABLE=1 WITH_SERVER=OFF WITH_SERVER_INTERFACE=ON WITH_SMARTCARD_INSPECT=ON WITH_SSE2=ON WITH_THIRD_PARTY=OFF WITH_VALGRIND_MEMCHECK=OFF WITH_VALGRIND_MEMCHECK_AVAILABLE=1 WITH_WAYLAND=ON WITH_X11=ON WITH_X264=OFF WITH_XCURSOR=ON WITH_XEXT=ON WITH_XFIXES=ON WITH_XI=ON WITH_XINERAMA=ON WITH_XKBFILE=ON WITH_XRANDR=ON WITH_XRENDER=ON WITH_XSHM=ON WITH_XV=ON WITH_ZLIB=ON
Build type: Release
CFLAGS: -march=i686 -Wall -Wno-unused-result -Wno-unused-but-set-variable -Wno-deprecated-declarations -fvisibility=hidden -Wimplicit-function-declaration -Wredundant-decls
Compiler: GNU, 7.3.1
Target architecture: x86

[hendwolt]

The error:

19:57:55:788] [6794:6795] [ERROR][com.freerdp.core] - freerdp_set_last_error ERRCONNECT_PASSWORD_CERTAINLY_EXPIRED [0x0002000F]
[19:57:55:789] [6794:6795] [ERROR][com.freerdp.core.transport] - BIO_read returned an error: error:14094438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error

[akallabeth]

@hendwolt Could you give some additional details of your server setup?
Can connect to our windows 7 test vm fine, so there must be some difference.
(got NLA version 2 in nla_decode_ts_request so maybe you have another config enforcing a higher level?)

[mfleisz]

@hendwolt Just tried with Win 7 Pro x64 and Ultimate x64 - can connect to both of them using either release or debug builds of current master. Please give us some more details on the server setup.

[marrowsuck]

I can confirm @hendwolt experience.
Current master 15fb91726713ac94792c555409d21a061ba7579d fails to connect to Win7 Prof 64 Bit and Windows Server 2008. A checkout of f8baeb7 works just fine.

[akallabeth]

@marrowsuck and we still don't know your setups and can not reproduce.
Anyone want to answer that question?

[marrowsuck]

What information do you need?

[hendwolt]

I get higher version numbers:

nla-version from input:
18:05:41:931] [4114:4115] [ERROR][com.freerdp.core.nla] - NLA version 6

version from ber_read_integer(s, &version):
[18:05:41:932] [4114:4115] [ERROR][com.freerdp.core.nla] - version 5

Here is the debug log plus the version numbers:
[18:05:41:887] [4114:4115] [WARN][com.winpr.sspi] - InitializeSecurityContextA status SEC_E_NO_CREDENTIALS [0x8009030E]
[18:05:41:887] [4114:4115] [INFO][com.winpr.sspi.NTLM] - VERSION ={
[18:05:41:887] [4114:4115] [INFO][com.winpr.sspi.NTLM] - ProductMajorVersion: 6
[18:05:41:887] [4114:4115] [INFO][com.winpr.sspi.NTLM] - ProductMinorVersion: 1
[18:05:41:887] [4114:4115] [INFO][com.winpr.sspi.NTLM] - ProductBuild: 7601
[18:05:41:887] [4114:4115] [INFO][com.winpr.sspi.NTLM] - Reserved: 0x000000
[18:05:41:887] [4114:4115] [INFO][com.winpr.sspi.NTLM] - NTLMRevisionCurrent: 0x0F
[18:05:41:931] [4114:4115] [ERROR][com.freerdp.core.nla] - NLA version 6
[18:05:41:932] [4114:4115] [ERROR][com.freerdp.core.nla] - version 5
[18:05:41:932] [4114:4115] [INFO][com.winpr.sspi.NTLM] - negotiateFlags "0xE2898235"
[18:05:41:932] [4114:4115] [INFO][com.winpr.sspi.NTLM] - NTLMSSP_NEGOTIATE_56 (0),
[18:05:41:932] [4114:4115] [INFO][com.winpr.sspi.NTLM] - NTLMSSP_NEGOTIATE_KEY_EXCH (1),
[18:05:41:932] [4114:4115] [INFO][com.winpr.sspi.NTLM] - NTLMSSP_NEGOTIATE_128 (2),
[18:05:41:932] [4114:4115] [INFO][com.winpr.sspi.NTLM] - NTLMSSP_NEGOTIATE_VERSION (6),
[18:05:41:933] [4114:4115] [INFO][com.winpr.sspi.NTLM] - NTLMSSP_NEGOTIATE_TARGET_INFO (8),
[18:05:41:933] [4114:4115] [INFO][com.winpr.sspi.NTLM] - NTLMSSP_NEGOTIATE_EXTENDED_SESSION_SECURITY (12),
[18:05:41:933] [4114:4115] [INFO][com.winpr.sspi.NTLM] - NTLMSSP_TARGET_TYPE_DOMAIN (15),
[18:05:41:933] [4114:4115] [INFO][com.winpr.sspi.NTLM] - NTLMSSP_NEGOTIATE_ALWAYS_SIGN (16),
[18:05:41:933] [4114:4115] [INFO][com.winpr.sspi.NTLM] - NTLMSSP_NEGOTIATE_NTLM (22),
[18:05:41:933] [4114:4115] [INFO][com.winpr.sspi.NTLM] - NTLMSSP_NEGOTIATE_SEAL (26),
[18:05:41:933] [4114:4115] [INFO][com.winpr.sspi.NTLM] - NTLMSSP_NEGOTIATE_SIGN (27),
[18:05:41:933] [4114:4115] [INFO][com.winpr.sspi.NTLM] - NTLMSSP_REQUEST_TARGET (29),
[18:05:41:933] [4114:4115] [INFO][com.winpr.sspi.NTLM] - NTLMSSP_NEGOTIATE_UNICODE (31),
[18:05:41:933] [4114:4115] [INFO][com.winpr.sspi.NTLM] - VERSION ={
[18:05:41:933] [4114:4115] [INFO][com.winpr.sspi.NTLM] - ProductMajorVersion: 6
[18:05:41:934] [4114:4115] [INFO][com.winpr.sspi.NTLM] - ProductMinorVersion: 1
[18:05:41:934] [4114:4115] [INFO][com.winpr.sspi.NTLM] - ProductBuild: 7601
[18:05:41:934] [4114:4115] [INFO][com.winpr.sspi.NTLM] - Reserved: 0x000000
[18:05:41:934] [4114:4115] [INFO][com.winpr.sspi.NTLM] - NTLMRevisionCurrent: 0x0F
[18:05:41:934] [4114:4115] [INFO][com.winpr.sspi.NTLM] - AV_PAIRs =
[18:05:41:934] [4114:4115] [INFO][com.winpr.sspi.NTLM] - MsvAvNbDomainName AvId: 2 AvLen: 4
[18:05:41:937] [4114:4115] [INFO][com.winpr.sspi.NTLM] - 0000 5a 00 57 00 Z.W.
[18:05:41:937] [4114:4115] [INFO][com.winpr.sspi.NTLM] - MsvAvNbComputerName AvId: 1 AvLen: 26
[18:05:41:938] [4114:4115] [INFO][com.winpr.sspi.NTLM] - 0000 4c 00 59 00 4e 00 58 00 2d 00 48 00 45 00 4e 00 L.Y.N.X.-.H.E.N.
[18:05:41:938] [4114:4115] [INFO][com.winpr.sspi.NTLM] - 0010 44 00 57 00 4f 00 4c 00 54 00 D.W.O.L.T.
[18:05:41:938] [4114:4115] [INFO][com.winpr.sspi.NTLM] - MsvAvDnsDomainName AvId: 4 AvLen: 20
[18:05:41:938] [4114:4115] [INFO][com.winpr.sspi.NTLM] - 0000 7a 00 77 00 2e 00 78 00 63 00 6f 00 6d 00 2e 00 z.w...x.c.o.m...
[18:05:41:938] [4114:4115] [INFO][com.winpr.sspi.NTLM] - 0010 64 00 65 00 d.e.
[18:05:41:938] [4114:4115] [INFO][com.winpr.sspi.NTLM] - MsvAvDnsComputerName AvId: 3 AvLen: 48
[18:05:41:938] [4114:4115] [INFO][com.winpr.sspi.NTLM] - 0000 6c 00 79 00 6e 00 78 00 2d 00 68 00 65 00 6e 00 l.y.n.x.-.h.e.n.
[18:05:41:938] [4114:4115] [INFO][com.winpr.sspi.NTLM] - 0010 64 00 77 00 6f 00 6c 00 74 00 2e 00 7a 00 77 00 d.w.o.l.t...z.w.
[18:05:41:938] [4114:4115] [INFO][com.winpr.sspi.NTLM] - 0020 2e 00 78 00 63 00 6f 00 6d 00 2e 00 64 00 65 00 ..x.c.o.m...d.e.
[18:05:41:938] [4114:4115] [INFO][com.winpr.sspi.NTLM] - MsvAvTimestamp AvId: 7 AvLen: 8
[18:05:41:938] [4114:4115] [INFO][com.winpr.sspi.NTLM] - 0000 3f c3 ef d7 36 c1 d3 01 ?...6...
[18:05:41:940] [4114:4115] [INFO][com.winpr.sspi.NTLM] - negotiateFlags "0xE288B235"
[18:05:41:940] [4114:4115] [INFO][com.winpr.sspi.NTLM] - NTLMSSP_NEGOTIATE_56 (0),
[18:05:41:940] [4114:4115] [INFO][com.winpr.sspi.NTLM] - NTLMSSP_NEGOTIATE_KEY_EXCH (1),
[18:05:41:941] [4114:4115] [INFO][com.winpr.sspi.NTLM] - NTLMSSP_NEGOTIATE_128 (2),
[18:05:41:941] [4114:4115] [INFO][com.winpr.sspi.NTLM] - NTLMSSP_NEGOTIATE_VERSION (6),
[18:05:41:941] [4114:4115] [INFO][com.winpr.sspi.NTLM] - NTLMSSP_NEGOTIATE_TARGET_INFO (8),
[18:05:41:941] [4114:4115] [INFO][com.winpr.sspi.NTLM] - NTLMSSP_NEGOTIATE_EXTENDED_SESSION_SECURITY (12),
[18:05:41:941] [4114:4115] [INFO][com.winpr.sspi.NTLM] - NTLMSSP_NEGOTIATE_ALWAYS_SIGN (16),
[18:05:41:941] [4114:4115] [INFO][com.winpr.sspi.NTLM] - NTLMSSP_NEGOTIATE_WORKSTATION_SUPPLIED (18),
[18:05:41:941] [4114:4115] [INFO][com.winpr.sspi.NTLM] - NTLMSSP_NEGOTIATE_DOMAIN_SUPPLIED (19),
[18:05:41:941] [4114:4115] [INFO][com.winpr.sspi.NTLM] - NTLMSSP_NEGOTIATE_NTLM (22),
[18:05:41:941] [4114:4115] [INFO][com.winpr.sspi.NTLM] - NTLMSSP_NEGOTIATE_SEAL (26),
[18:05:41:941] [4114:4115] [INFO][com.winpr.sspi.NTLM] - NTLMSSP_NEGOTIATE_SIGN (27),
[18:05:41:941] [4114:4115] [INFO][com.winpr.sspi.NTLM] - NTLMSSP_REQUEST_TARGET (29),
[18:05:41:941] [4114:4115] [INFO][com.winpr.sspi.NTLM] - NTLMSSP_NEGOTIATE_UNICODE (31),
[18:05:41:942] [4114:4115] [INFO][com.winpr.sspi.NTLM] - VERSION ={
[18:05:41:942] [4114:4115] [INFO][com.winpr.sspi.NTLM] - ProductMajorVersion: 6
[18:05:41:942] [4114:4115] [INFO][com.winpr.sspi.NTLM] - ProductMinorVersion: 1
[18:05:41:942] [4114:4115] [INFO][com.winpr.sspi.NTLM] - ProductBuild: 7601
[18:05:41:942] [4114:4115] [INFO][com.winpr.sspi.NTLM] - Reserved: 0x000000
[18:05:41:942] [4114:4115] [INFO][com.winpr.sspi.NTLM] - NTLMRevisionCurrent: 0x0F
[18:05:41:945] [4114:4115] [INFO][com.winpr.sspi.NTLM] - AV_PAIRs =
[18:05:41:945] [4114:4115] [INFO][com.winpr.sspi.NTLM] - MsvAvNbDomainName AvId: 2 AvLen: 4
[18:05:41:945] [4114:4115] [INFO][com.winpr.sspi.NTLM] - 0000 5a 00 57 00 Z.W.
[18:05:41:945] [4114:4115] [INFO][com.winpr.sspi.NTLM] - MsvAvNbComputerName AvId: 1 AvLen: 26
[18:05:41:945] [4114:4115] [INFO][com.winpr.sspi.NTLM] - 0000 4c 00 59 00 4e 00 58 00 2d 00 48 00 45 00 4e 00 L.Y.N.X.-.H.E.N.
[18:05:41:945] [4114:4115] [INFO][com.winpr.sspi.NTLM] - 0010 44 00 57 00 4f 00 4c 00 54 00 D.W.O.L.T.
[18:05:41:945] [4114:4115] [INFO][com.winpr.sspi.NTLM] - MsvAvDnsDomainName AvId: 4 AvLen: 20
[18:05:41:946] [4114:4115] [INFO][com.winpr.sspi.NTLM] - 0000 7a 00 77 00 2e 00 78 00 63 00 6f 00 6d 00 2e 00 z.w...x.c.o.m...
[18:05:41:946] [4114:4115] [INFO][com.winpr.sspi.NTLM] - 0010 64 00 65 00 d.e.
[18:05:41:946] [4114:4115] [INFO][com.winpr.sspi.NTLM] - MsvAvDnsComputerName AvId: 3 AvLen: 48
[18:05:41:946] [4114:4115] [INFO][com.winpr.sspi.NTLM] - 0000 6c 00 79 00 6e 00 78 00 2d 00 68 00 65 00 6e 00 l.y.n.x.-.h.e.n.
[18:05:41:946] [4114:4115] [INFO][com.winpr.sspi.NTLM] - 0010 64 00 77 00 6f 00 6c 00 74 00 2e 00 7a 00 77 00 d.w.o.l.t...z.w.
[18:05:41:946] [4114:4115] [INFO][com.winpr.sspi.NTLM] - 0020 2e 00 78 00 63 00 6f 00 6d 00 2e 00 64 00 65 00 ..x.c.o.m...d.e.
[18:05:41:946] [4114:4115] [INFO][com.winpr.sspi.NTLM] - MsvAvTimestamp AvId: 7 AvLen: 8
[18:05:41:946] [4114:4115] [INFO][com.winpr.sspi.NTLM] - 0000 3f c3 ef d7 36 c1 d3 01 ?...6...
[18:05:41:946] [4114:4115] [INFO][com.winpr.sspi.NTLM] - MsvAvFlags AvId: 6 AvLen: 4
[18:05:41:946] [4114:4115] [INFO][com.winpr.sspi.NTLM] - 0000 02 00 00 00 ....
[18:05:41:947] [4114:4115] [INFO][com.winpr.sspi.NTLM] - MsvChannelBindings AvId: 10 AvLen: 16
[18:05:41:947] [4114:4115] [INFO][com.winpr.sspi.NTLM] - 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[18:05:41:947] [4114:4115] [INFO][com.winpr.sspi.NTLM] - MsvAvTargetName AvId: 9 AvLen: 46
[18:05:41:947] [4114:4115] [INFO][com.winpr.sspi.NTLM] - 0000 54 00 45 00 52 00 4d 00 53 00 52 00 56 00 2f 00 T.E.R.M.S.R.V./.
[18:05:41:947] [4114:4115] [INFO][com.winpr.sspi.NTLM] - 0010 31 00 39 00 32 00 2e 00 31 00 36 00 38 00 2e 00 1.9.2...1.6.8...
[18:05:41:947] [4114:4115] [INFO][com.winpr.sspi.NTLM] - 0020 31 00 30 00 30 00 2e 00 31 00 32 00 31 00 1.0.0...1.2.1.

[hendwolt]

The remote Windows7 Prof. is a member of a domain. Otherwise the settings are pretty much standard.

[kb1ooo]

Same for me. Current master doesn't work, but f8baeb7 works.

[mdunc]

Can also confirm. I can no longer connect to my Windows 2012 server (no domain) with latest Windows updates applied with the current freerdp master. I get the overconfident error about my password "certainly" being expired which is certainly not the case. f8baeb7 works just fine.

@akallabeth and @mfleisz, do you have the latest Windows updates applied on your test machines? As I'm sure you know, the CredSSP patch that Microsoft released last week is what is causing issues which f8baeb7 fixed or at least worked around.

[akallabeth]

@mdunc Yes, these are applied. The first fix for that issue was to enforce NLA version 3.
The latest patches added NLA support for versions up to 6, which will be required soon.
The roadmap of MS is to disable older insecure NLA versions as far as I'm informed.

We did test these changes on our local VM test machines (so nearly all recent OS version),
but it looks like some configuration is required to force this error.

Working on it (documentation is quite fresh and some details are missing or vague) and should be resolved soon.
So, sorry for the inconvenience, but we need these fixes with feedback to know if it is working everywhere before we can tag the next release.

[mfleisz]

OK so I have done following tests - all with a Win 7 Ultimate x64 machine with latest updates installed:

• Machine not in domain, using machine account: works
• Machine in domain, using machine account: works
• Machine in domain, using domain account: works

In every case the server reports that it want's to use CredSSP protocol version 2 (the old code path) ...
I'm running out of ideas what is configured differently on your machines ...

Any ideas @hendwolt @kb1ooo , @mdunc ?

[mfleisz]

I also tried both client - wfreerdp and xfreerdp ... both work for me (same scenarios as described above)

[mfleisz]

OK - apparently when Windows Update says "No more updates available" it actually means go find and install them yourselves ...
After installing KB4088875 I can now reproduce the issue - trying to get it fixed asap. Sorry for the confusion ...

[mdunc]

Glad you got that figured out. We ran Windows updates for our Windows 2012 servers on March 14 and that patch came in then. Maybe it's not a regular patch for Windows 7? Anyway, thanks for looking in to it!

[tibob]

Thank you, it works again :-)

[Enverex]

As of current Master, should it be possible to connect using NLM again?

Connecting via TLS (if the force NLM requirement is disabled on the server) works fine, but trying to connect using NLM with the force NLM requirement on the server enabled, results in the error ERRCONNECT_LOGON_FAILURE.

[hendwolt]

Yes, it should work.

[tmunro55]

Hi all, I'm using "This is FreeRDP version 2.0.0-rc1 (2.0.0-rc1)" on Linux Mint 18.2, trying to connect to an NLA enforced windows endpoint. Command line is:
xfreerdp /f /sec-ext /sec-tls /sec-nla /u:domain\username /v:fqdn of machine

I'm also getting:

[12:35:52:582] [16099:16100] [ERROR][com.freerdp.core] - freerdp_set_last_error ERRCONNECT_PASSWORD_CERTAINLY_EXPIRED [0x0002000F]
[12:35:52:582] [16099:16100] [ERROR][com.freerdp.core.transport] - BIO_read returned an error: error:14094438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error
[12:35:52:582] [16099:16100] [ERROR][com.freerdp.client.x11] - Freerdp connect error exit status 1

Any help would be greatly appreciated.

[akallabeth]

@tmunro55 update, that version does not have the patches

[tmunro55]

OK Thank you. Any idea when the patched version will be available through apt-get and/or how can I otherwise obtain the patched version?

[akallabeth]

No idea, the patched version is in debian, but others must pick it up themselves.
You can use our nightly builds or the remmina ppa for up to date versions

[tmunro55]

OK Thanks.

[tmunro55]

Could not find a FreeRDP that would work. I did however install Remmina and it's working very nicely. I also like the target machine management features. Guess I'm a convert.

Thanks for your help.

[yan12125]

I'm still getting ERRCONNECT_PASSWORD_CERTAINLY_EXPIRED with freerdp 2.0.0-rc4. Here's my partial log (removed hexdump and my IP/port):

$ WLOG_LEVEL=DEBUG xfreerdp /u:yen /v:<my_ip>:<port>
23:48:35:593] [8657:8657] [DEBUG][com.freerdp.utils] - Registering signal hook...
[23:48:35:597] [8657:8657] [DEBUG][com.freerdp.client.common.cmdline] - windows: 0/1 posix: -1000/0 compat: -1000/0
[23:48:35:597] [8657:8658] [DEBUG][com.freerdp.channels.cliprdr.client] - VirtualChannelEntryEx
[23:48:35:597] [8657:8658] [INFO][com.freerdp.client.common.cmdline] - loading channelEx cliprdr
[23:48:35:598] [8657:8658] [DEBUG][com.freerdp.client.x11] - Searching for XInput pointer device
[23:48:35:598] [8657:8658] [DEBUG][com.freerdp.client.x11] - Pointer device: 10
[23:48:35:601] [8657:8658] [DEBUG][com.freerdp.core.nego] - Enabling security layer negotiation: TRUE
[23:48:35:601] [8657:8658] [DEBUG][com.freerdp.core.nego] - Enabling restricted admin mode: FALSE
[23:48:35:601] [8657:8658] [DEBUG][com.freerdp.core.nego] - Enabling RDP security: TRUE
[23:48:35:601] [8657:8658] [DEBUG][com.freerdp.core.nego] - Enabling TLS security: TRUE
[23:48:35:601] [8657:8658] [DEBUG][com.freerdp.core.nego] - Enabling NLA security: TRUE
[23:48:35:601] [8657:8658] [DEBUG][com.freerdp.core.nego] - Enabling NLA extended security: FALSE
[23:48:35:601] [8657:8658] [DEBUG][com.freerdp.core.nego] - state: NEGO_STATE_NLA
[23:48:35:601] [8657:8658] [DEBUG][com.freerdp.core.nego] - Attempting NLA security
[23:48:35:601] [8657:8658] [DEBUG][com.freerdp.core] - connecting to peer <my_ip>
[23:48:35:618] [8657:8658] [DEBUG][com.freerdp.core.nego] - RequestedProtocols: 3
[23:48:35:642] [8657:8658] [DEBUG][com.freerdp.core.nego] - RDP_NEG_RSP
[23:48:35:642] [8657:8658] [DEBUG][com.freerdp.core.nego] - selected_protocol: 2
[23:48:35:642] [8657:8658] [DEBUG][com.freerdp.core.nego] - state: NEGO_STATE_FINAL
[23:48:35:642] [8657:8658] [DEBUG][com.freerdp.core.nego] - Negotiated NLA security
[23:48:35:643] [8657:8658] [DEBUG][com.freerdp.core.nego] - nego_security_connect with PROTOCOL_NLA
[23:48:35:685] [8657:8658] [DEBUG][com.winpr.utils] - Could not open SAM file!
Password: 
[23:48:37:705] [8657:8658] [DEBUG][com.winpr.sspi] - InitSecurityInterfaceExA
[23:48:37:705] [8657:8658] [DEBUG][com.freerdp.core.nla] - nla_client_init 349 : packageName=Negotiate ; cbMaxToken=12256
[23:48:37:705] [8657:8658] [DEBUG][com.freerdp.core.nla] - Sending Authentication Token
(some hexdump starting with NTLMSSP...)
[23:48:37:725] [8657:8658] [DEBUG][com.freerdp.core.nla] - CredSSP protocol support 6, peer supports 5
[23:48:37:725] [8657:8658] [DEBUG][com.freerdp.core.nla] - Sending Authentication Token
(some hexdump starting with NTLMSSP...)
[23:48:37:747] [8657:8658] [ERROR][com.freerdp.core] - freerdp_set_last_error ERRCONNECT_PASSWORD_CERTAINLY_EXPIRED [0x0002000F]
[23:48:37:747] [8657:8658] [ERROR][com.freerdp.core.transport] - BIO_read returned an error: error:14094438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error
[23:48:37:747] [8657:8658] [DEBUG][com.freerdp.core.transport] - transport_check_fds: transport_read_pdu() - -1
[23:48:37:747] [8657:8658] [DEBUG][com.freerdp.core.rdp] - transport_check_fds() - -1

I can log in with /sec:rdp, and I don't find KB4088875 in installed Windows updates as indicated in https://github.com/FreeRDP/FreeRDP/issues/4449#issuecomment-372977707.

I'm using Windows 7 SP1 x64, with freerdp 2.0.0_rc4 from Arch Linux.

Any idea what's going on?

[ozars]

I second @yan12125, I have similar issue with the package installed on Debian Buster. It was working normally with Debian Stretch a month ago, unfortunately I don't have that setup any more.

My trace is pretty much same with the one above:

$ WLOG_LEVEL=DEBUG remmina
StatusNotifier/Appindicator support: not supported by desktop. libappindicator will try to fallback to GtkStatusIcon/xembed
Running under Gnome Shell version 3.30.1

(org.remmina.Remmina:20508): Gtk-WARNING **: 10:21:49.395: gtk_menu_attach_to_widget(): menu already attached to GtkMenuItem
[10:21:50:176] [20508:20513] [DEBUG][com.freerdp.channels.cliprdr.client] - VirtualChannelEntryEx
[10:21:50:176] [20508:20513] [INFO][com.freerdp.client.common.cmdline] - loading channelEx cliprdr
[10:21:50:176] [20508:20513] [DEBUG][com.freerdp.channels.drdynvc.client] - VirtualChannelEntryEx
[10:21:50:176] [20508:20513] [INFO][com.freerdp.client.common.cmdline] - loading channelEx drdynvc
[10:21:50:180] [20508:20513] [DEBUG][com.freerdp.core.nego] - Enabling security layer negotiation: TRUE
[10:21:50:180] [20508:20513] [DEBUG][com.freerdp.core.nego] - Enabling restricted admin mode: FALSE
[10:21:50:180] [20508:20513] [DEBUG][com.freerdp.core.nego] - Enabling RDP security: TRUE
[10:21:50:180] [20508:20513] [DEBUG][com.freerdp.core.nego] - Enabling TLS security: TRUE
[10:21:50:180] [20508:20513] [DEBUG][com.freerdp.core.nego] - Enabling NLA security: TRUE
[10:21:50:180] [20508:20513] [DEBUG][com.freerdp.core.nego] - Enabling NLA extended security: FALSE
[10:21:50:180] [20508:20513] [DEBUG][com.freerdp.core.nego] - state: NEGO_STATE_NLA
[10:21:50:180] [20508:20513] [DEBUG][com.freerdp.core.nego] - Attempting NLA security
[10:21:50:180] [20508:20513] [DEBUG][com.freerdp.core] - connecting to peer ((my_ip))
[10:21:51:194] [20508:20513] [DEBUG][com.freerdp.core.nego] - RequestedProtocols: 3
[10:21:51:210] [20508:20513] [DEBUG][com.freerdp.core.nego] - RDP_NEG_RSP
[10:21:51:210] [20508:20513] [DEBUG][com.freerdp.core.nego] - selected_protocol: 2
[10:21:51:210] [20508:20513] [DEBUG][com.freerdp.core.nego] - state: NEGO_STATE_FINAL
[10:21:51:210] [20508:20513] [DEBUG][com.freerdp.core.nego] - Negotiated NLA security
[10:21:51:210] [20508:20513] [DEBUG][com.freerdp.core.nego] - nego_security_connect with PROTOCOL_NLA
[10:21:51:241] [20508:20513] [DEBUG][com.winpr.utils] - Could not open SAM file!
[10:21:55:307] [20508:20513] [DEBUG][com.winpr.sspi] - InitSecurityInterfaceExA
[10:21:55:307] [20508:20513] [DEBUG][com.freerdp.core.nla] - nla_client_init 349 : packageName=Negotiate ; cbMaxToken=12256
[10:21:55:308] [20508:20513] [DEBUG][com.freerdp.core.nla] - Sending Authentication Token
((similarly some hexdump starting with NTLMSSP...))
[10:21:55:324] [20508:20513] [DEBUG][com.freerdp.core.nla] - CredSSP protocol support 6, peer supports 5
[10:21:55:324] [20508:20513] [DEBUG][com.freerdp.core.nla] - Sending Authentication Token
((similarly some hexdump starting with NTLMSSP...))
[10:21:55:340] [20508:20513] [ERROR][com.freerdp.core] - freerdp_set_last_error ERRCONNECT_PASSWORD_CERTAINLY_EXPIRED [0x0002000F]
[10:21:55:340] [20508:20513] [ERROR][com.freerdp.core.transport] - BIO_read returned an error: error:14094438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error
[10:21:55:340] [20508:20513] [DEBUG][com.freerdp.core.transport] - transport_check_fds: transport_read_pdu() - -1
[10:21:55:340] [20508:20513] [DEBUG][com.freerdp.core.rdp] - transport_check_fds() - -1
libfreerdp returned code is 0002000F

$ dpkg -l | grep freerdp        

ii  libfreerdp-client2-2:amd64             2.0.0~git20181120.1.e21b72c95+dfsg1-1 amd64        Free Remote Desktop Protocol library (client library)
ii  libfreerdp2-2:amd64                    2.0.0~git20181120.1.e21b72c95+dfsg1-1 amd64        Free Remote Desktop Protocol library (core library)

$ dpkg -l | grep remmina

ii  remmina                                1.2.32.1+dfsg-1                       amd64        GTK+ Remote Desktop Client
ii  remmina-common                         1.2.32.1+dfsg-1                       all          Common files for Remmina
ii  remmina-plugin-rdp:amd64               1.2.32.1+dfsg-1                       amd64        RDP plugin for Remmina
ii  remmina-plugin-secret:amd64            1.2.32.1+dfsg-1                       amd64        Secret plugin for Remmina
ii  remmina-plugin-vnc:amd64               1.2.32.1+dfsg-1                       amd64        VNC plugin for Remmina

---

Update: Upgrading to packages from unstable repo didn't solve the issue either.

$ dpkg -l | grep freerdp
ii  libfreerdp-client2-2:amd64             2.0.0~git20190204.1.2693389a+dfsg1-1  amd64        Free Remote Desktop Protocol library (client library)
ii  libfreerdp-server2-2:amd64             2.0.0~git20190204.1.2693389a+dfsg1-1  amd64        Free Remote Desktop Protocol library (server library)
ii  libfreerdp2-2:amd64                    2.0.0~git20190204.1.2693389a+dfsg1-1  amd64        Free Remote Desktop Protocol library (core library)

For the sake of completeness, here is the trace (only difference is that hexdump parts aren't printed anymore):

$ WLOG_LEVEL=DEBUG remmina
StatusNotifier/Appindicator support: not supported by desktop. libappindicator will try to fallback to GtkStatusIcon/xembed
Running under Gnome Shell version 3.30.1

(org.remmina.Remmina:21683): Gtk-WARNING **: 11:21:15.170: gtk_menu_attach_to_widget(): menu already attached to GtkMenuItem
[11:21:16:912] [21683:21688] [DEBUG][com.freerdp.channels.cliprdr.client] - VirtualChannelEntryEx
[11:21:16:912] [21683:21688] [INFO][com.freerdp.client.common.cmdline] - loading channelEx cliprdr
[11:21:16:912] [21683:21688] [DEBUG][com.freerdp.channels.drdynvc.client] - VirtualChannelEntryEx
[11:21:16:912] [21683:21688] [INFO][com.freerdp.client.common.cmdline] - loading channelEx drdynvc
[11:21:16:917] [21683:21688] [DEBUG][com.freerdp.core.nego] - Enabling security layer negotiation: TRUE
[11:21:16:917] [21683:21688] [DEBUG][com.freerdp.core.nego] - Enabling restricted admin mode: FALSE
[11:21:16:917] [21683:21688] [DEBUG][com.freerdp.core.nego] - Enabling RDP security: TRUE
[11:21:16:917] [21683:21688] [DEBUG][com.freerdp.core.nego] - Enabling TLS security: TRUE
[11:21:16:917] [21683:21688] [DEBUG][com.freerdp.core.nego] - Enabling NLA security: TRUE
[11:21:16:917] [21683:21688] [DEBUG][com.freerdp.core.nego] - Enabling NLA extended security: FALSE
[11:21:16:917] [21683:21688] [DEBUG][com.freerdp.core.nego] - state: NEGO_STATE_NLA
[11:21:16:917] [21683:21688] [DEBUG][com.freerdp.core.nego] - Attempting NLA security
[11:21:16:917] [21683:21688] [DEBUG][com.freerdp.core] - connecting to peer ((my_ip))
[11:21:16:933] [21683:21688] [DEBUG][com.freerdp.core.nego] - RequestedProtocols: 3
[11:21:16:949] [21683:21688] [DEBUG][com.freerdp.core.nego] - RDP_NEG_RSP
[11:21:16:949] [21683:21688] [DEBUG][com.freerdp.core.nego] - selected_protocol: 2
[11:21:16:949] [21683:21688] [DEBUG][com.freerdp.core.nego] - state: NEGO_STATE_FINAL
[11:21:16:949] [21683:21688] [DEBUG][com.freerdp.core.nego] - Negotiated NLA security
[11:21:16:949] [21683:21688] [DEBUG][com.freerdp.core.nego] - nego_security_connect with PROTOCOL_HYBRID
[11:21:16:980] [21683:21688] [DEBUG][com.winpr.utils] - Could not open SAM file!
[11:21:19:420] [21683:21688] [DEBUG][com.winpr.sspi] - InitSecurityInterfaceExA
[11:21:19:420] [21683:21688] [DEBUG][com.freerdp.core.nla] - nla_client_init 396 : packageName=Negotiate ; cbMaxToken=12256
[11:21:19:420] [21683:21688] [DEBUG][com.freerdp.core.nla] - Sending Authentication Token
[11:21:19:435] [21683:21688] [DEBUG][com.freerdp.core.nla] - CredSSP protocol support 6, peer supports 5
[11:21:19:435] [21683:21688] [DEBUG][com.freerdp.core.nla] - Sending Authentication Token
[11:21:19:450] [21683:21688] [ERROR][com.freerdp.core] - freerdp_set_last_error ERRCONNECT_PASSWORD_CERTAINLY_EXPIRED [0x0002000F]
[11:21:19:450] [21683:21688] [ERROR][com.freerdp.core.transport] - BIO_read returned an error: error:14094438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error
[11:21:19:450] [21683:21688] [DEBUG][com.freerdp.core.transport] - transport_check_fds: transport_read_pdu() - -1
[11:21:19:450] [21683:21688] [DEBUG][com.freerdp.core.rdp] - transport_check_fds() - -1
libfreerdp returned code is 0002000F

[bmiklautz]

@yan12125 @ozars do you have KB4480970 installed on the machines you have troubles with?

With KB4480970 installed you can't connect anymore if your user is in the "Administrators" group.
This is a generic problem that does not only apply to FreeRDP but also happens with mstsc.

[ozars]

@bmiklautz I will be able to check it when I have physical access to the host in a few hours.

In KB4480970, it is noted this issue is later resolved by KB4487345. Will check both and post here.

[ozars]

@bmiklautz This is caused by KB4480970 in fact. Thanks! Installing the latter patch solved the issue.

[Ionic]

Thanks. Installing KB4487345 let me authenticate via NLA again.

Interestingly, sec-tls continued to work, but only connected to the user chooser, which then handled the authentication successfully, while sec-nla directly logs the provided user in.

rdesktop worked for me even without KB4487345, though, which sounds odd. Maybe there's still a bug in FreeRDP?

[tmunro55]

Just to let people know, I'm connecting Linux Mint 19.0 to a fully patch tightly secured (via Group Policy, I have no control over it) Windows 10 machine. I've cloned compiled and deployed FreeRDP 2.0.0-dev5 (2693389a1) and I'm using remmina as a front end. Security is set to NLA. It's working correctly. Once again a happy camper.

[yan12125]

Sorry for the late respones - was on Chinese New Year vacation last week :)

I can also confirm KB4487345 fixes the issue!