FreeTDS Development Group

[Scott Morken <scott.morken AT phoenixcollege.edu>]

I think you guys are correct.  I looked at the updated cipher list and it
looks like the one that is getting picked is in the removed list.  Since
I'm sure our server admins won't want to install freetds from source on
multiple servers, is there a way to pass an allowed cipher list/suite to
freetds? Either through the config or environment?  If I could find a
workable one, I could probably limp along until we get to a new version...
Although 16.04LTS is still 0.91-6.1build1.  Not very up to date :(

On Fri, Sep 16, 2016 at 8:23 AM, Frediano Ziglio <freddy77 AT gmail.com> wrote:

> 2016-09-16 16:02 GMT+01:00 Ramiro Morales <cramm0 AT gmail.com>:
> > On Fri, Sep 16, 2016 at 11:54 AM, Scott Morken <
> > scott.morken AT phoenixcollege.edu> wrote:
> >
> >> I've recently (around the first part of August) starting getting random
> "
> >> SQLSTATE[01002] Adaptive Server connection failed" errors from
> FreeTDS.  It
> >> seems to be related to the TLS handshake.  It doesn't happen every
> time...
> >> it took me about 45 minutes of clicking around to get the attached
> failure
> >> log but the next time only took a couple of minutes to get another.  It
> >> happens from multiple Ubuntu 14.04.5 LTS servers connecting to the same
> MS
> >> SQL Server.  These are mostly PHP web apps but Python also has the same
> >> issue - naturally since it's the same backend library :)
> >>
> >> MS SQL Server 2012 (11.0.6020) on Windows Server 2008 R2 SP1
> >>
> >> The error on SQL Server isn't super helpful but it gave me a starting
> point
> >> to look into the TLS connection:
> >> <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event";>
> >> <System>
> >> <Provider Name="Schannel" Guid="{1F678132-5938-4686-9FDC-C8FF68F15C85}"
> />
> >> <EventID>36888</EventID>
> >> <Version>0</Version>
> >> <Level>2</Level>
> >> <Task>0</Task>
> >> <Opcode>0</Opcode>
> >> <Keywords>0x8000000000000000</Keywords>
> >> <TimeCreated SystemTime="2016-09-16T13:20:01.639041100Z" />
> >> <EventRecordID>81739</EventRecordID>
> >> <Correlation />
> >> <Execution ProcessID="524" ThreadID="2464" />
> >> <Channel>System</Channel>
> >> <Computer>xxxx</Computer>
> >> <Security UserID="xxxx" />
> >> </System>
> >> <EventData>
> >> <Data Name="AlertDesc">20</Data>
> >> <Data Name="ErrorState">960</Data>
> >> </EventData>
> >> </Event>
> >>
> >> I'm connecting from multiple Ubuntu 14.04.5 LTS servers.
> >> gnutls26 is installed (2.12.23-12ubuntu2.5)
> >> freetds 0.91-5
> >>
> >> I'm at a loss as to what would cause these errors.  I've spent a lot of
> >> time searching for an answer but haven't found anything that really
> fits.
> >> Our server admins tried uninstalling the Microsoft TLS 1.2 patch that
> >> apparently broke a few things but that didn't help:
> >> http://www.infoworld.com/article/2848574/operating-
> >> systems/microsoft-botches-kb-2992611-schannel-patch-tls-
> >> alert-code-40-slow-sql-server-block-iis-sites.html
> >>
> >> I've tried encryption = off but it seems it still tries to negotiate it
> and
> >> fails.
> >>
> >> I've attached a log of the debug output from freeTDS for a failure and a
> >> success.  Any thoughts or obvious things I've missed would be greatly
> >> appreciated.  I've run out of ideas.
> >>
> >> Scott,
> >
> > Take a look at the FreeTDS GitHub repo commit history for the master
> branch
> > and for the 1.0.x  maintenance branch for the last month or so and verify
> > if it could be related.
> >
> > It might be your copy of FreeTDS is too old.
> >
> > Regards,
> >
> > --
> > Ramiro Morales
> > @ramiromorales
>
> I confirmed what Ramiro said.
> Unfortunately we seem we should try to push some new version to Debian.
> We don't release very often but 0.91 is 2 main release ago that is years
> ago,
> many changes were introduced since.
> We try very hard to maintain ABI so you should have not much issues
> updating from sources.
> We are a really small group nowadays and we cannot effort to maintain much
> old releases (actually we maintain the last). A very recent patch was
> introduced
> to fix a problem with OpenSSL but probably 0.91 contains some old setting
> even
> using GnuTLS (from https://packages.debian.org/jessie/freetds-bin or
> Ubuntu
> package you can see GnuTLS is used).
>
> Frediano
>



-- 
*Scott Morken*
Programmer
Phoenix College <http://www.phoenixcollege.edu> - Information Technology
602.285.7554
scott.morken AT phoenixcollege.edu