Minio not working with Veeam Cloud Tier

[brumma]

Hello!

At the moment i am testing with Minio - not working out of the box.
The problem seems to be TLS1.1 vs TLS1.2 - i have not investigated that in detail - https://www.veeam.com/kb2853 did not solve the issue.

I have now a working setup with a nginx in front of minio - which is doing the TLS stuff now. First tests looking good.
Had some contact with developers of minio - they say: Basically, this means that the S3 client (veeam in this case ?) is little old.

[Andreas Neufert]

Hi Martin,

please contact our support and upload logs. We can look at the logs then. Please share the ticket number here.

[Gostev]

Minio certainly works, because we use it in our own labs so perhaps the issue is that you also have a nginx in the picture.

[Dmitry K.]

Dear Martin,
Can you give some additional info in the support case: minio verion you use, certificate alghoritm, logs with connection failure details.
Its greatly help us to investigate this issue.
Thank you!

[brumma]

Hi! Version of Minio is 2019-01-31T00:31:19Z official docker image, the error on minio side is:
Time: 14:29:58 UTC 02/05/2019
Error: tls: client offered an unsupported, maximum protocol version of 301
localAddr=172.17.*.*:443, remoteAddr=*.*.*.*:49737
1: cmd/http/listener.go:259:http.(*httpListener).start.func2()

Which veeam logs do you want to see, and, where can i find them?

M.

[brumma]

one thing - it is working with nginx in front, and not working without!

[Andreas Neufert]

Can you please open a support case to allow us to investigate logs?
We did not saw this issue with Minio before.

[Dmitry K.]

Dear Martin,
Thank you for a quick response.
We try to reproduce issue, but it doesn’t up, and we need more details.
Log files usually can be found at the path: c$\ProgramData\Veeam\Backup\ (on the pc where VBR installed).
If you got this error on creating Object storage repository step, we interested in logs from \Util subfolder.
What version of Windows you use?

About nginx: its up on a same host as minio?

Please open a support case, upload all logs and let me know the case ID.

Thanks!

[tsightler]

Can I ask what version of WIndows you are on? And what version of .NET you have deployed?

The error you posted from minio indicates that the client only offered TLS1.0, and minio has rejected this. I could see this if you have older Windows version (2012 R2 or older) without the latest .NET 4.5.2 updates and the registry keys you posted earlier.

[brumma]

Helllo!
The client i am working for has no active support license anymore, so it is ok if you do not actively investigate on this issue.
The Machine is a Windows 7 VM, on small budgets i always told the clients to save on that and not on veeam because it was running perfectly in alot of Win 7 installations
The registry keys are in place, the windows machine is on the last updates, but seems to be just .NET 4.0? I have no idea about .NET

The questions about nginx: Very easy to put it in front of minio and let nginx do the TLS stuff , yes on that LAB Install it is on the same machine, but minio is running as docker container.

Martin

[Dmitry K.]

is a Windows 7

Dear Martin,
Now i use Windows7 and reproduce your case:

Code: Select all

Feb 08 13:00:46 ubuntu-47 minio[16688]: API: SYSTEM()
Feb 08 13:00:46 ubuntu-47 minio[16688]: Time: 13:00:46 MSK 02/08/2019
Feb 08 13:00:46 ubuntu-47 minio[16688]: Error: tls: client offered an unsupported, maximum protocol version of 300
...
Feb 08 13:00:46 ubuntu-47 minio[16688]:        1: cmd/http/listener.go:259:http.(*httpListener).start.func2()
Feb 08 13:00:46 ubuntu-47 minio[16688]: API: SYSTEM()
Feb 08 13:00:46 ubuntu-47 minio[16688]: Time: 13:00:46 MSK 02/08/2019
Feb 08 13:00:46 ubuntu-47 minio[16688]: Error: tls: client offered an unsupported, maximum protocol version of 301
...
Feb 08 13:00:46 ubuntu-47 minio[16688]:        1: cmd/http/listener.go:259:http.(*httpListener).start.func2()

For Windows 7 you need to perform two steps:
1. Install this update if it hasn't been installed yet:
2. Apply it:

Registry information
To apply this update, the DefaultSecureProtocols registry subkey must be added.
To do this, you can add the registry subkey manually or install the "Easy fix" to populate the registry subkey.

After I have performed these actions, there are no issues in adding s3 repository directly without nginx layer.

Give it a try and see whether it helps or not.

Thank you.

[brumma]

Hi!
Thank you for this information. i checkt KB3140245 is installed. i installed the easyfix, i checkt the keys in registry. i rebooted.
The error changed from 301 to 302 - but still not working. maybe it is not worth finding the problem with Windows 7.....

API: SYSTEM()
Time: 12:44:46 UTC 02/08/2019
Error: tls: client offered an unsupported, maximum protocol version of 302
remoteAddr=-----:49382, localAddr=172.17.0.2:443
1: cmd/http/listener.go:259:http.(*httpListener).start.func2()

API: SYSTEM()
Time: 12:44:46 UTC 02/08/2019
Error: tls: no cipher suite supported by both client and server
remoteAddr=------:49383, localAddr=172.17.0.2:443
1: cmd/http/listener.go:259:http.(*httpListener).start.func2()

[Andreas Neufert]

Can you try to use the following to bind Windows to TLS1.2 usage?
https://support.microsoft.com/en-us/hel ... cols-in-wi

[brumma]

hello, you mean setting 0x00000800 instead of 0x00000A00? tried that - sorry forgot to mention that.
but maybe i did not reboot - i will try again after the running replication job is ready.

m.

[prubner]

Hello Dmitry,

I' got the same errors like brumma, but I've no nginx.
My minio runs on Windows, at the same VM as the Veeam server.
In my case I use Win 2012 R2. The easyfix does not run in this version.
I add manually the registry keys, but it does not work.
There are four errors: 300, 301 and 302 and
Error: tls: no cipher suite supported by both client and server

Peter

[Andreas Neufert]

So I am guessing here, but the here described solution looks reasonable , can you test please?
https://forum.duplicati.com/t/windows-s ... -error/527

[veremin]

Hi, Peter, may I ask you to open a support ticket and provide us with its number?

It's rather hard to investigate technical issues via forum correspondence.

Thanks!

[prubner]

Hello Andreas,

very good job. With the new certificate it works.
Thanks
Peter