Profanity: Can't login via profanity on Debian Buster using Openfire

[SteveGZr]

I recently installed Debian Buster and now I can't login via profanity anymore.
When I open profanity I get the message login failed. On my old system it is still working.

I tried to use the current master branch and the binary from the debian repos, both have failed.

I have also looked through the logs of the openfire server I am trying to connect with and found the following:

WARN [socket_c2s-thread-11]: org.jivesoftware.openfire.nio.ConnectionHandler - Closing connection due to exception in session
javax.net.ssl.SSLHandshakeException: SSL handshake failed.

Environment

• profanity -v:

Profanity, version 0.7.1dev.master.b3ed2136
Copyright (C) 2012 - 2019 James Booth <[email protected]>.
Copyright (C) 2019 Michael Vetter <[email protected]>.
License GPLv3+: GNU GPL version 3 or later <https://www.gnu.org/licenses/gpl.html>

This is free software; you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Build information:
XMPP library: libmesode
Desktop notification support: Enabled
OTR support: Enabled (libotr 4.1.1)
PGP support: Enabled (libgpgme 1.12.0)
OMEMO support: Enabled
C plugins: Enabled
Python plugins: Disabled
GTK icons: Enabled

• Operating System/Distribution:
  Debian Buster

• glibc version:
  ldd (Debian GLIBC 2.28-10) 2.28

[pasis]

@SteveGZr , could you show debug logs to understand what went wrong? Remember to remove logins/passwords from the logs, especially from the following 2 lines, they both contain password which everyone can read:

conn DEBUG SENT: <auth mechanism="PLAIN" xmlns="urn:ietf:params:xml:ns:xmpp-sasl">AHRlc3QAdGVzdA==</auth>
...
conn DEBUG SENT: <iq id="_xmpp_auth1" type="set"><query xmlns="jabber:iq:auth"><username>test</username><password>test</password><resource>qwerty</resource></query></iq>

How to find debug logs: https://profanity-im.github.io/issues.html#proflogs

[jubalh]

I heard form other people on Debian Buster that it works with ejabberd and prosody.

[jubalh]

@SteveGZr can you find out which version of Openfire?
Is it possible your server is using a certificate signed by a CA that's not recognized?

[SteveGZr]

Here are the logs when I try to login (jid, server etc. changed):

08/10/2019 10:09:27: prof: INF: Starting Profanity (0.7.1dev.master.b3ed2136)...
08/10/2019 10:09:27: prof: INF: Initialising chat logs
08/10/2019 10:09:27: prof: INF: Initialising groupchat logs
08/10/2019 10:09:27: prof: INF: Loading accounts
08/10/2019 10:09:27: prof: INF: Loading theme "original_bright"
08/10/2019 10:09:27: prof: INF: Initialising UI
08/10/2019 10:09:27: prof: INF: Initialising XMPP
08/10/2019 10:09:27: prof: INF: Loading capabilities cache
08/10/2019 10:09:27: prof: INF: Initialising commands
08/10/2019 10:09:27: prof: INF: Initialising contact list
08/10/2019 10:09:27: prof: INF: Loading TLS certificates
08/10/2019 10:09:27: prof: INF: Initialising OTR
08/10/2019 10:09:27: prof: DBG: GPG: Found gpgme version: 1.12.0
08/10/2019 10:09:27: prof: INF: OMEMO: initialising
08/10/2019 10:09:27: prof: INF: Failed to load plugin: ascii.py
08/10/2019 10:09:27: prof: INF: Failed to load plugin: clients.py
08/10/2019 10:09:27: prof: INF: Failed to load plugin: sounds.py
08/10/2019 10:09:27: prof: INF: Failed to load plugin: whoami.py
08/10/2019 10:09:27: prof: INF: Failed to load plugin: browser.py
08/10/2019 10:09:27: prof: DBG: Env is GTK-ready: true
08/10/2019 10:09:27: prof: DBG: Building GTK icon
08/10/2019 10:09:27: prof: DBG: Resizing UI
08/10/2019 10:09:27: prof: DBG: Input received: /connect [email protected]
08/10/2019 10:09:27: prof: INF: Connecting using account: [email protected]
08/10/2019 10:09:27: prof: INF: Connecting as [email protected]/profanity
08/10/2019 10:09:28: xmpp: DBG: SRV lookup failed, connecting via domain.
08/10/2019 10:09:28: xmpp: DBG: sock_connect() to example.org:5222 returned 12
08/10/2019 10:09:28: xmpp: DBG: Attempting to connect to example.org
08/10/2019 10:09:28: prof: INF: Starting main event loop
08/10/2019 10:09:28: xmpp: DBG: connection successful
08/10/2019 10:09:28: conn: DBG: SENT: <?xml version="1.0"?><stream:stream to="example.org" xml:lang="en" version="1.0" xmlns="jabber:client" xmlns:stream="http://etherx.jabber.org/streams">
08/10/2019 10:09:28: xmpp: DBG: RECV: <stream:stream from="example.org" id="9b1q9nnked" lang="en" version="1.0">
08/10/2019 10:09:28: xmpp: DBG: RECV: <features xmlns="http://etherx.jabber.org/streams"><starttls xmlns="urn:ietf:params:xml:ns:xmpp-tls"><required/></starttls><mechanisms xmlns="urn:ietf:params:xml:ns:xmpp-sasl"><mechanism>PLAIN</mechanism></mechanisms></features>
08/10/2019 10:09:28: TLS: DBG: OpenSSL version: OpenSSL 1.1.1d  10 Sep 2019
08/10/2019 10:09:28: conn: DBG: SENT: <starttls xmlns="urn:ietf:params:xml:ns:xmpp-tls"/>
08/10/2019 10:09:28: xmpp: DBG: RECV: <proceed xmlns="urn:ietf:params:xml:ns:xmpp-tls"/>
08/10/2019 10:09:28: xmpp: DBG: handle proceedtls called for proceed
08/10/2019 10:09:28: xmpp: DBG: proceeding with TLS
08/10/2019 10:09:28: TLS: DBG: OpenSSL version: OpenSSL 1.1.1d  10 Sep 2019
08/10/2019 10:09:28: tls: DBG: Certificate verification passed
08/10/2019 10:09:28: tls: DBG: error=1 errno=0
08/10/2019 10:09:28: tls: DBG: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure
08/10/2019 10:09:28: conn: DBG: Couldn't start TLS! error -3 tls_error 1
08/10/2019 10:09:28: conn: DBG: SENT: </stream:stream>
08/10/2019 10:09:28: xmpp: DBG: Send error occurred, disconnecting.
08/10/2019 10:09:28: xmpp: DBG: Closing socket.
08/10/2019 10:09:28: prof: DBG: Connection handler: XMPP_CONN_DISCONNECT
08/10/2019 10:09:28: prof: DBG: Connection handler: Login failed
08/10/2019 10:09:28: prof: DBG: Connection handler: No reconnect timer
08/10/2019 10:09:28: prof: INF: Login failed

[SteveGZr]

@SteveGZr can you find out which version of Openfire?

Openfire, Version: 4.2.3

Is it possible your server is using a certificate signed by a CA that's not recognized?

I am not sure, it could be possible.

[mdosch]

A lot of people got problems after upgrading from stretch to buster due to some change with the SSL config: https://www.debian.org/releases/buster/amd64/release-notes/ch-information.html#openssl-defaults

Does it work when you try this?

Changing the system wide defaults in /etc/ssl/openssl.cnf back to their previous values can be done by setting:

   MinProtocol = None
  CipherString = DEFAULT

[SteveGZr]

A lot of people got problems after upgrading from stretch to buster due to some change with the SSL config: https://www.debian.org/releases/buster/amd64/release-notes/ch-information.html#openssl-defaults

Does it work when you try this?

Changing the system wide defaults in /etc/ssl/openssl.cnf back to their previous values can be done by setting:

   MinProtocol = None
  CipherString = DEFAULT

This solved the problem, thank you very much!

[mdosch]

@SteveGZr you're welcome. Maybe you want to point your service operator to the release notes and kindly ask if they might update their setup.

[jubalh]

In the meantime I got access to an Openfire 4.2.2 with Let's Encrypt certs

12:01:38 - Connecting as [email protected]
12:01:40 - [email protected]/profanity.x2RS logged in successfully, online (priority 0).

So it works for me on openSUSE without problems.