TLSMC: MozNSS compatibility interception begins message
Hello, We upgraded our test RADIUS server to use CentOS Linux release 7.5.1804 (Core) this morning and noticed the following messages in the /var/log/message file: May 23 09:04:05 XXXXXX systemd: Starting FreeRADIUS high performance RADIUS server.... May 23 09:04:05 XXXXXX radiusd: TLSMC: MozNSS compatibility interception begins. May 23 09:04:05 XXXXXX radiusd: tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. May 23 09:04:05 XXXXXX radiusd: tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. May 23 09:04:05 XXXXXX radiusd: TLSMC: MozNSS compatibility interception ends. We're using FR 3.0.15. The current version of OpenSSL package is 1.0.2k-12. (previous version 1.0.2k-8). Please, could someone provide an explanation of these messages. Thanks, Chris Howley
On May 23, 2018, at 7:00 AM, Chris Howley <C.P.Howley@leeds.ac.uk> wrote:
We upgraded our test RADIUS server to use CentOS Linux release 7.5.1804 (Core) this morning and noticed the following messages in the /var/log/message file:
May 23 09:04:05 XXXXXX systemd: Starting FreeRADIUS high performance RADIUS server.... May 23 09:04:05 XXXXXX radiusd: TLSMC: MozNSS compatibility interception begins. May 23 09:04:05 XXXXXX radiusd: tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. May 23 09:04:05 XXXXXX radiusd: tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. May 23 09:04:05 XXXXXX radiusd: TLSMC: MozNSS compatibility interception ends.
We're using FR 3.0.15. The current version of OpenSSL package is 1.0.2k-12. (previous version 1.0.2k-8). Please, could someone provide an explanation of these messages.
RedHat (in their infinite wisdom) decided to switch to using NSS instead of OpenSSL. So... they converted many system libraries to use NSS. Without converting all of the applications, like FreeRADIUS. The result is a horrible mishmash of conflicting libraries which causes messages like this, or even outright crashes. They've switched back to OpenSSL in newer releases. There is literally *nothing* you can do to FreeRADIUS to fix this. You *must* use better libraries. Alan DeKok.
On 23 May 2018, at 12:36, Alan DeKok <aland@deployingradius.com> wrote:
They've switched back to OpenSSL in newer releases.
7.5 is the release that's supposed to have that in - so that error message is utterly bizarre. I wonder if OP has somehow ended up with the CentOS 7.5 release installed, but has freeradius bits that were compiled for <7.4 Adam Bishop gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.
On 23 May 2018, at 21:46, Adam Bishop <adam.bishop@jisc.ac.uk> wrote:
I wonder if OP has somehow ended up with the CentOS 7.5 release installed, but has freeradius bits that were compiled for <7.4
Redhat are still shipping 3.0.13, so 3.0.15 must have been installed from source, so I'd try backing up the system and /etc/raddb, make sure your build host is running 7.5 too, then make clean && make && make install. Adam Bishop gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.
participants (3)
-
Adam Bishop -
Alan DeKok -
Chris Howley