Freerdp: SSL_Read: Failure in SSL library (protocol error?) on Win2k8 hosts

[askreet]

Getting the following when connecting to Windows 2008 server with NLA enabled:

SSL_read: Failure in SSL library (protocol error?)
Authentication failure, check credentials.
If credentials are valid, the NTLMSSP implementation may be to blame.

Works fine against our Windows 2003 systems. Using version 1.0.1 -- not sure where to begin troubleshooting.

[olegon-ru]

Workaround is to use:
--sec rdp
parameter

[yurii-github]

got same error with 1.0.1 version. No need for parameter, just add server at the end.

fail example:
/usr/local/bin/xfreerdp 127.0.0.1:123 -u yurii

success example:
/usr/local/bin/xfreerdp -u yurii 127.0.0.1:123

regards

[rrader]

Thanks, solution of @ykorotia worked

[andy24boyking]

When I try the way @ykorotia mentioned, it's still not working, I got the message as follow:

Could not open SAM file!
Could not open SAM file!
SSL_read: Failure in SSL library (protocol error?)
SSL_read: error:14094419:SSL routines:SSL3_READ_BYTES:tlsv1 alert access denied
credssp_recv() error: -1
Authentication failure, check credentials.
If credentials are valid, the NTLMSSP implementation may be to blame.
Error: protocol security negotiation or connection failure

[einars]

@andy24boyking Just had a similar problem, turned out that my password was expired and the server wanted me to change it. Worked around that by connecting with rdesktop, not xfeerdp, to change password (not a good workaround, yeah)

[sumkincpp]

I confirm this, in my case the issue was in necessity of changing password after first login to Windows.

[bmiklautz]

@ykorotia , @antigluk for 1.0.x the hostname needs always to be the last argument.
@einars if you use -sec-nla (for 1.1.x) when a password change is required it worked for me (parameter is --no-nla for 1.0.0).

[bmiklautz]

If nla is used you can't connect with nla. This is known issue with nla http://support.microsoft.com/kb/2648397 . If the server allows tls or rdp security use -sec-nla (--no-nla for 1.0.x) (as described above) otherwise you can't change the password remotely (see kb).

[bmiklautz]

@askreet do you still have issues or do the solutions above help you?

[askreet]

I'm no longer able to test, but I suspect it's NLA related, since I believe NLA was mandated. You can close this out. Thank you for your help, and sorry it took so long for me to notice this update :+1:

[gundamlh]

@yurii-github thanks, it works!

[harrytruman]

@yurii-github Moving server to the end worked for me as well. Thank you!

[emilf]

Moving server to the end worked for me as well

[cgmora12]

using --no-nla just worked for me, thx

[cristifalcas]

This did it for me:

rm -f ~/.freerdp/known_hosts

[alienth]

@yurii-github Moving the server to the end worked for me, as well! Definitely seems like a client bug? I'm on FreeRDP 1.0.2 on Linux.

[alienth]

@bmiklautz - This might need to be reopened. Looks like several folks got around the issue by simply moving the host to the end of the param list, including myself.

[bmiklautz]

@alienth for version 1.0.x the hostname _needs_ to be at the end. This isn't a client bug it's just the syntax the client requires.

As already mentioned this changed with the new command line introduced in 1.1.x and above.

[rdp]

yep that did it for me:

instead of
$ xfreerdp 10.X.X.X
$ xfreerdp -u username 10.X.X.X
and it works now. weird (1.0.2)

[myselfsufiyan]

@olegon-ru thanks your answer works like charm... --sec rdp :)
i am using Debian 8 Jessie & xfreerdp-x11

[ajupazhamayil]

Thank you soo much @olegon-ru .... It helped

[dhavalkamble]

@yurii-github Yes, it worked for me too. Thank you so much.

[qwipx94]

Thanks to all above.
-Adding the -sec rdp parameter alone didn't work.
-Putting the address at the end alone didn't work.
-Doing both worked like a charm.
:)