Re: job dies with ERR=error:0A000119:SSL routines::decryption failed or bad record mac

On Sun, Mar 2, 2025, at 2:56 PM, Dan Langille wrote:
> Hello,
>
> I have several clients which have recently start failing with:
>
> SD says - Error: openssl.c:108 TLS read/write failure.: 
> ERR=error:0A000119:SSL routines::decryption failed or bad record mac
> FD says - Error: bsock.c:397 Wrote 43011 bytes to Storage 
> daemon:bacula-sd-04.int.unixathome.org:9103, but only 0 accepted.
> SD says - Fatal error: append.c:327 Network error reading from FD. 
> ERR=Unknown error: 9919
>
> My search for these errors isn't finding anything to try.
>
> Full job output appears below.
>
> Relevant background:
>
> * Bacula 15.0.2 installed on clients and servers
> * FreeBSD 14.x
> * the failing clients have been around for years, with successful 
> backups
> * the gateway in my basement was recently replaced, new firewall rules 
> and OpenVPN configuration
> * the OpenVPN topology went from net40 to subnet
> * this affects all the VPN hosts; local hosts are unaffected
>
> Given the Bacula configuration hasn't changed and these jobs had been 
> running successfully for years, the problem must be with OpenVPN and/or 
> the firewall rules.  However, I cannot find the cause.

The cause is still unknown. A workaround: upgrade the client from FreeBSD 14.1 to FreeBSD 14.2

I will continue to investigate.

-- 
  Dan Langille
  [email protected]