1

I'm trying to get Bareos working with TLS encryption using a self-signed certificate.

I have used the name of the server for the self-signed certificate CN. The server does NOT have a domain set.

But I'm getting an error...

# bconsole
Connecting to Director Server-Name:9xxx
Authorization problem with Director at "Server-Name:9xxx"
Most likely the passwords do not agree.
If you are using TLS, there may have been a certificate validation error during the TLS handshake.
Please see http://doc.bareos.org/master/html/bareos-manual-main-reference.html#AuthorizationErrors for help.

Also from the log...

05-Oct 10:23 bareos-dir JobId 0: Fatal error: Authorization problem: Remote server did not advertize required TLS support.
05-Oct 10:23 bareos-dir: ERROR in authenticate.c:283 Unable to authenticate console "*UserAgent*" at client:17.x.x.x5:9xxx.

I'm curious if this has to do with how TLS resolves the hostname to match it to the certificate. The CN/Name-of-the-server is in /etc/hosts, but is not resolvable via DNS.

I.e.

root@Server-Name ~ # hostname
Server-Name
root@Server-Name ~ # domainname
(none)
root@Server-Name ~ # ping Server-Name
PING Server-Name (17x.x.x.x5) 56(84) bytes of data.
64 bytes from Server-Name (17x.x.x.x5): icmp_seq=1 ttl=64 time=0.042 ms
64 bytes from Server-Name (17x.x.x.x5): icmp_seq=2 ttl=64 time=0.034 ms
64 bytes from Server-Name (17x.x.x.x5): icmp_seq=3 ttl=64 time=0.040 ms
^C
--- Server-Name ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 1998ms
rtt min/avg/max/mdev = 0.034/0.038/0.042/0.007 ms
root@Server-Name ~ # nslookup Server-Name
Server:     2x.x.x.x0
Address:    2x.x.x.x0#53

** server can't find Server-Name: NXDOMAIN
  • Why are you using TLS to connect to another service on the same machine? This looks like a very unusual setup? – Lie Ryan Oct 5 '18 at 12:23
  • @LieRyan Mostly because when I set up JUST the Bareos director (without setting up the fie daemon service, the bconsole service, or the storage daemon service to ALSO use TLS) Bareos refused to start. But from what I read the file daemon service on the same box uses networking for communication, not internal communications, so it shouldn't matter if the fie daemon is local or remote. And I wanted to get it working before I broke my clients. Am I wrong about this? – RightmireM Oct 10 '18 at 10:09
2

No DNS is involved in comparing the subject of the certificate (CN or Subject Alternative Names) against the given hostname. It will only check if the expected name matches the subject, i.e. either exact match or wildcard match.

DNS is only used for getting the IP address to the hostname. This IP address is needed to make a TCP connection to the destination and then run TLS on top of this TCP connection.

In your specific case DNS is not used to get the IP address for a hostname but a fixed entry in /etc/hosts is used. How exactly the resolving of a hostname to an IP is done is usually transparent to the application and also depends on the system and system settings. ping in your example will transparently use the entry from /etc/hosts since it is using the resolving functions of the libc. nslookup instead will fail to resolve the name since by design it will query a name server (hence the name of the program) and not look into /etc/hosts.

As for your specific problem .. I don't know about Bareos but the error message suggests that the client is configured to use TLS while the server is not (properly?) configured to provide TLS. This has nothing to do with certificate validation since the client can only validate a certificate if the server supports TLS in the first place, which does not seem to be the case here:

... Authorization problem: Remote server did not advertize required TLS support.

  • The procedure is detailed in RFC6125 section 6.4 specially. And "Resolution of DNS domain names." in 1.7.2: "Although the process whereby a client resolves the DNS domain name of an application service can involve several steps ... for our purposes we care only about the fact that the client needs to verify the identity of the entity with which it communicates as a result of the resolution process. Thus the resolution process itself is out of scope for this specification." – Patrick Mevzek Oct 5 '18 at 15:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.