blackandyellow
I always get this error
The User is already authenticated. He could not insert in user map. The client connect will fail. In case of rekeying this note is ok.
so heres my finding, the auth in radius is fine , so the problem is in the openvpn list of connected users. openvpn thinks the user is connected but in reality it doesnt, i think openvpn has no good way of clearing the old records.
heres the full log
Tue Apr 3 14:45:45 2012 98.*.*.*:52 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Tue Apr 3 14:45:45 2012 98.*.*.*:52 [blackandyellow] Peer Connection Initiated with 98.*.*.*:52
Tue Apr 3 14:45:45 2012 Error: The User is already authenticated. He could not insert in user map. The client connect will fail. In case of rekeying this note is ok.
Tue Apr 3 14:45:45 2012 blackandyellow/98.*.*.*:52 PLUGIN_CALL: POST /etc/openvpn/radiusplugin.so/PLUGIN_CLIENT_CONNECT status=1
Tue Apr 3 14:45:45 2012 blackandyellow/98.*.*.*:52 PLUGIN_CALL: plugin function PLUGIN_CLIENT_CONNECT failed with status 1: /etc/openvpn/radiusplugin.so
Tue Apr 3 14:45:45 2012 blackandyellow/98.*.*.*:52 WARNING: client-connect plugin call failed
Tue Apr 3 14:45:47 2012 blackandyellow/98.*.*.*:52 PUSH: Received control message: 'PUSH_REQUEST'
Tue Apr 3 14:45:47 2012 blackandyellow/98.*.*.*:52 Delayed exit in 5 seconds
Tue Apr 3 14:45:47 2012 blackandyellow/98.*.*.*:52 SENT CONTROL [blackandyellow]: 'AUTH_FAILED' (status=1)
Tue Apr 3 14:45:50 2012 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Apr 3 14:45:53 2012 blackandyellow/98.*.*.*:52 SIGTERM[soft,delayed-exit] received, client-instance exiting
as you can see, auth is fine, but this is the real killer : The User is already authenticated. He could not insert in user map. The client connect will fail. In case of rekeying this note is ok.
Any ideas? thanks
mode server
port 443
proto udp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh1024.pem
server 10.9.2.0 255.255.255.0
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 8.8.8.8"
push "redirect-gateway def1"
duplicate-cn
ping-restart 60
comp-lzo
verb 3
cipher none
plugin /etc/openvpn/radiusplugin.so /etc/openvpn/radiusplugin.cnf
client-cert-not-required
username-as-common-name
auth SHA1
reneg-sec 0
persist-key
persist-tun
status openvpn-status.log
log log.log
xauen
Hi,
Let me help you with some idea.
The auth seems fine as you've said but did you take a look at accounting table?
"radacct" table is where openvpn also checks for simultaneous connection.
There is probably some problem with your radius server accounting configuration as
Acct-Interim-Interval : = # may not be included?
Or Simultaneous-Use := ? is not configured properly?
Or Accounting port is wrong?
Or Accounting in Rad Server is not working?
Additionally, your accounting table may not be updated after all.
Here is some flow so you can understand well. This should be the proper flow of data:
client A on openvpn w/rad ->accting (on connect) -> radserver/radacct table update (acctstoptime = NULL)
client A on openvpn w/rad ->accting (every "n" second) -> radserver/radacct table update (acctstoptime = NULL)
client A on openvpn w/rad ->accting (on drop) -> radserver/radacct table update (acctstoptime = time stopped)
Heres what your accnt config is doing (probably?)
client A on openvpn w/rad ->accting (on connect) -> radserver/radacct table update (acctstoptime = NULL)
client A on openvpn w/rad ->accting (every "n" second) -> radserver/radacct table update (acctstoptime = ????)
client A on openvpn w/rad ->accting (on drop) -> radserver/radacct table update (acctstoptime = NULL)
???? = unable to update
hence after drop of connection NULL is not updated.
And unfortunately for you "NULL" is what radius looks for any simultaneous use.
Also rad client looks for your status.log, i think it should be:
status /path/openvpn/sample.log 1
Also add:
client-config-dir /path/openvpn/ccd
Yuo can remove: (as radius will already handle auth)
duplicate cn
