Good afternoon everybody. I am new to openvpn and so far so good :mrgreen:
Today I wanted to try client-config-dir, but i am having some issues: :cry:
Connecting with ccd disabled and plugin pam enabled works fine.
Connecting with ccd enabled and plugin pam disabled works fine.
Connecting with ccd enabled and plugin pam enabled doesn't work.... There seem to be a conflict but i don't see where.
When i uncomment
;username-as-common-name and
;plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so openvpn in my server.conf, i can't login i get failed password from the client.
My working configuration when using client-config-dir:
My server conf:
# Server
proto udp
port 443
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh2048.pem
tls-auth /etc/openvpn/keys/ta.key 0
cipher AES-256-CBC
auth SHA512
tls-cipher DHE-RSA-AES256-SHA
server 10.8.0.0 255.255.255.0
push "explicit-exit-notify 3"
keepalive 10 120
fast-io
persist-key
persist-tun
user nobody
group nobody
verb 3
status openvpn-status.log
log-append /var/log/openvpn.log
comp-lzo
;username-as-common-name
;plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so openvpn
reneg-sec 0
ccd-exclusive
client-config-dir /etc/openvpn/ccd
My ccd file:
ifconfig-push 10.8.0.8 10.8.0.7
push "route 188.165.252.201 255.255.255.255 net_gateway"
push "route 10.10.0.0 255.255.255.0 net_gateway"
push "redirect-gateway def1" ## redirect all traffic
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
Owner and permission for the ccd directory:
/etc/openvpn/ccd
drwxr-xr-x root root ccd
Owner and permission for the ccd file:
/etc/openvpn/ccd/udp
-rw-r--r-- root root udp
My Client config:
client
dev tun
proto udp
remote xxx.xxx.xx.xx 443
resolv-retry infinite
nobind
ca ca.crt
cert udp.crt
key udp.key
tls-auth ta.key 1
cipher AES-256-CBC
tls-cipher DHE-RSA-AES256-SHA
auth SHA512
ns-cert-type server
remote-cert-tls server
comp-lzo
verb 3
persist-key
persist-tun
;auth-user-pass
reneg-sec 0
/var/log/openvpn.log:
Tue Jul 3 12:57:13 2012 99.988.240.42:58002 VERIFY OK: depth=0, C=NH, ST=kMhvsYDO, L=hTPTYxbbBHdpJCze, O=lSxVJUAPsusVRRjfeuCJ, CN=udp, emailAddress=LstQth@gIIPWHBwXi.org
Tue Jul 3 12:57:14 2012 99.988.240.42:58002 PLUGIN_CALL: POST /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Tue Jul 3 12:57:14 2012 99.988.240.42:58002 TLS: Username/Password authentication succeeded for username 'yubikey' [CN SET]
Tue Jul 3 12:57:14 2012 99.988.240.42:58002 TLS Auth Error: --client-config-dir authentication failed for common name 'yubikey' file='/etc/openvpn/ccd/yubikey'
In the logs: yubikey corresponds to the user i created on the server to login. In the logs I am confused as why 'yubikey' is in the same line as client-config-dir. Common name is udp, and that's the name of the file in ccd.
I would appreciate any help to get ccd and plugin working together :mrgreen:
