Can't connect to Master.

[FlightControl]

If backward to 1.2.7 its works sure but I`ll fly alone cause all community are flying1.2.8

 

the purpose is not to see if you can fly.

 

the purpose is to see if you can connect to the master.

 

type in the start button menu: CMD

 

cd to the program files\eagle dynamics\DCS world\bin

 

type there:

 

DCS_updater update 1.2.7

[ECV56_FOXONE]

I repeat that I did used both.version 1.2.7 and 1.2.8 openbata 1.2.7 no problem 1.2.8 cant connect I`ll revert version and see the same thing

[Rhinox]

I went back with restore-point to 1.2.7: everything works as expected.

Then I updated again to 1.2.8 and the same problem again: Cant' connect to Master.

 

Seriously: someone still thinking it is on my side? I think it's time ED spits out the truth and says what is different between 1.2.7 and 1.2.8! Apparently, there is something more than what's in changelog...

[ENO]

I would like to see if you can connect to master with no modules loaded- or is that what you've been doing?

[Rhinox]

I would like to see if you can connect to master with no modules loaded- or is that what you've been doing?

I have most of DCS-modules active (iirc, all except P51), but I just tested my server (pure DCS-World, nothing more) with the same result: with 1.2.7 all normal, after update to 1.2.8 "Cant' connect to Master"...

[ENO]

Okay- was worth a try. A part of me wants to suggest uninstalling modules (or running the clean server as you did) and maybe even try logging in with another user name (DCSW only again obviously).

 

 

What was that adapter that was causing all those people server issues again? (question out to the general community)... I helped a guy resolve an issue with one recently but for the life of me I can't remember what that specific adapter was called.

 

Only reason I say this Rhinox- I know how frustrated you are with it and I would be too... but for the couple of people having these issues it makes me think you guys have something in common- but I'm not entirely certain it's something on the ED side.

 

Stay cool- we'll try to help you out as much as we can... there are a bunch of guys in here who have helped a ton of people out and each person has their own experiences and resources.

Edited May 4, 2014 by ENO

[Rhinox]

...you guys have something in common- but I'm not entirely certain it's something on the ED side...

What we have common is that 1.2.7 worked, and 1.2.8 does not. So I'm pretty sure it is something on ED-side because nothing has been changed on my PC, just DCS was updated...

[Flagrum]

What about the username and/or the password itself? Perhaps this is the common thing you are looking for ...

 

What I mean is, is there anything special with the username you are using? Or perhaps even more important, your password?

- How long is it?

- Do you use any special characters in it, perhaps national specific characters (i.e. äöüß)?

 

And/or have you already tried to change your password (via the dcs website)?

[joey45]

Do what Eno says and try with a clean DCS with no modules.

 

If it works then install each module one by one with testing after each.

[ECV56_FOXONE]

Men why still thinking that the problem is in our computers if we could before flying on the same server with version 1.2.8? The problem is in the code of the MP version 1.2.8 or database handles ED users to upgrade from 1.2.8. NOT A PROBLEM OF CONNECTION FIREWALL OR VIRUS. If we have connected to 1.2.7 we would connect to 1.2.8 if we didn´t any changes on our internet connection configurations. Maybe in the first upgrade for 1.2.8 for art of magic we can connect and all your teories fall down.

[Flagrum]

Men why still thinking that the problem is in our computers if we could before flying on the same server with version 1.2.8? The problem is in the code of the MP version 1.2.8 or database handles ED users to upgrade from 1.2.8. NOT A PROBLEM OF CONNECTION FIREWALL OR VIRUS. If we have connected to 1.2.7 we would connect to 1.2.8 if we didn´t any changes on our internet connection configurations. Maybe in the first upgrade for 1.2.8 for art of magic we can connect and all your teories fall down.

We are just trying to narrow it down. If it is an error solely on EDs side, if we can narrow it down a bit more, it will certainly speed up the fixing.

 

Also even if nothing changed on your side, it still can be a problem caused by something on your side. Just because it only manifests with 1.2.8 does not necessarily mean that it is an actual bug or error on EDs side. It can also be that some things now function differently and interact with (software) components on your computer that it had not before. And those components could still be the cause for the problems.

[ECV56_FOXONE]

OK I finished to revert version 1.2.8 to 1.2.7 and how I did said to you, all works fine, can connect to module manager and master server but only a few crazy guys are mounting servers for 1.2.7 version, all community have migrated to 1.2.8 version, I can´t understand why on 1.2.7 I haven´t any problem and with 1.2.8 appears all, ah ok surely is a problem with my connection and firewalls and antivirus like you said sorry.

[FlightControl]

Ok. So your user and passwords are okay.

Upgrade back to 1.2.8 by dcs_updater update 1.2.8

 

Uninstall the modules of dcs and retry to login as eno suggests.

 

It can still be the virus scanner. Version 1.2.8 <> 1.2.7.

[FlightControl]

Go to yr saved games folder. You'll find it under yr user directory. Cd dcs. Cd config. Delete network.cfg. delete network.vault or something.

 

Start dcs.exe. Go to module manager. Try to login by Retyping your password and user id.

[Rhinox]

Just FYI, I *think* I know where the problem is (at least in "my" case). Let's see how ED's support works, and give them a few working days to react. If nothing comes from ED, I will open the pandora-box...

[c0ff]

Technically, there's a difference between 1.2.7 and 1.2.8 in handling SSL connections.

1.2.7 used OpenSSL, 1.2.8 - native Microsoft SChannel API from the OS.

 

We can NOT reproduce the issue yet. And this is the reason the problem got into the release.

 

 

EDIT: can you please, clearly answer a question:

 

If you have 1.2.8 and can't login to master, CAN you login into the module manager?

 

 

EDIT 2: This is only about SSL/TLS errors.

Edited May 5, 2014 by c0ff
fixed facts

[Rhinox]

...If you have 1.2.8 and can't login to master, CAN you login into the module manager?...

 

Neither-nor. And I described it quite clearly in my previous bug-report for 1.2.8-beta...

 

BTW, you started to show colors, so there is no need to wait: yes, I found it myself. You changed the way users log in to "your" server. What I do not know is: are you aware of security implications you caused by this modification? Let me explain it in more details:

 

Yes, you are now using standard OS-service called "Local Security Authentication Server" (Local Security Authority Process). But because of this, one more than generous firewall-rule must be active: For the process "lsass.exe" (which itself is frequently targeted by malware) free communication with any system on the internet must be granted (in addition to that granted to DCS.exe)! Or at least for those destination IP-addresses belonging to Akamai Content Delivery Network which you use (that's one or more B-class networks, if someone knows all them). And to make things even worse, this single particular process handles multiple sensitive services, i.e.:

 

CNG Key Isolation

Creditential Manager

Encrypting File System

Netlogon

Protected Storage

Security Accounts Manager

 

Maybe I forgot something, but it does not matter, because what I found is more than enough to make me worry. Exposing any service having something to do with system-security and encryption/protection for free access to/from internet? And all of this becaues of DCS? With all do respect, the one in ED who came with this "idea" must be (hard self-censorship follows) complete madman! Any local process (even malware running in user-space!) can now communicate with internet using this service and what's even worse, any node on the internet can communicate with this local process (thus easily bypasing any firewall)! Hey, all you brute-force wanna-be hackers: welcome to my system, and play with it as much as you want! No, do not thank me. Thanks should go to Eagle Dynamics who forced us to open this door for you...

 

Only one question remains: ED, did you force us to open this security-leak purposely?

 

FYI: as soon as I opened firewall for lsass.exe, DCS works. But I'm not going to keep it that way!

[Flagrum]

because of this, one more than generous firewall-rule must be active

I can't remember having allowed such a rule nor did I manually create one and when I browse through my windows firewall settings, nothing jumps at me that would look suspicious in this regard.

 

But, as I am far from being an expert in these things ... how would that look like in the windows firewall, for what would I have to look?

[Rhinox]

... how would that look like in the windows firewall, for what would I have to look?

Windows "firewall" does not filter system apps at all. For all system services everything is allowed. Thats what Microsoft calls "firewall"...

[txmtb]

I can't remember having allowed such a rule nor did I manually create one and when I browse through my windows firewall settings, nothing jumps at me that would look suspicious in this regard.

 

But, as I am far from being an expert in these things ... how would that look like in the windows firewall, for what would I have to look?

 

 

Look for Core Networking - Group Policy (LSASS-Out) in the Outbound Rules, it should not be listed in the Inbound Rules. This prevents it from accepting random inbound connections that were not requested from the PC.

[Flagrum]

Look for Core Networking - Group Policy (LSASS-Out) in the Outbound Rules, it should not be listed in the Inbound Rules. This prevents it from accepting random inbound connections that were not requested from the PC.

Thanks!

 

So ... I have one entry mentioning LSASS under outbound (something about Group Policy), profile "domain" and somewhere under details it mentions it were a default rule.

 

I found nothing regarding LSASS for inbound.

 

So, I assume, I am safe in this regard? But how does that fit to Rhinox findings? And also, why does my login at the module manager and for multiplayer work under 1.2.8?

[Flagrum]

Windows "firewall" does not filter system apps at all. For all system services everything is allowed. Thats what Microsoft calls "firewall"...

So you are using an additional (hardware?) FW that you had to open for LSASS?

[txmtb]

Thanks!

So, I assume, I am safe in this regard? But how does that fit to Rhinox findings? And also, why does my login at the module manager and for multiplayer work under 1.2.8?

 

 

As safe as everyone else in the world using Windows default firewall.

If you use an alternate software or hardware firewall it will probably be blocked by default and your login would not work.

You are usually safe with outbound only rules, the firewall should only allow connections on that service that are originated from your computer. If an unsolicited connection attempts to come in and there is no inbound rule, it is denied. (As long as your firewall is set to block inbound connections that do not match an inbound rule). Which it is in windows by default.

Malware that takes advantage of this outbound rule could be installed in a different way and then use your outbound rule against you to do further damage.

[seikdel]

Hey Folks, I'm also having issues connecting to master. The only firewall I'm running is Windows Firewall. Disabling this does not fix the problem. I've tried deleting my network.cfg and network.vault files. I have no mods installed.

 

What should I try next?

[c0ff]

As safe as everyone else in the world using Windows default firewall.

If you use an alternate software or hardware firewall it will probably be blocked by default and your login would not work.

 

This is not true. If we are to continue our technical discussion, SChannel API does NOT do anything network related by itself. It just provides encryption services required for the TLS channel. That is, all networking is done inside DCS (actually, by the CURL library). None of the systems which are available for us for testing had any problem connecting to DCS servers. Moreover, we hadn't changed the way users log in our servers. It is still good old SSL. It is the client implementation which changed.

It may be possible that LSASS needs network access to do certificate validation, ask Microsoft about it.

Most probably, when LSASS is blocked on your system, Event Log does contain a useful error info about why exactly DCS fails to establish SSL connection. It would be of a great help if you post such info. We have no systems which reproduce this behaviour yet.