openvpn ubuntu network manager - shared secret error

qwertyjjj

I copied my certs and keys to /etc/openvpn.
I setup the network manager but when I connect it say failed due to invalid secrets error.
I imported settings from the .ovpn file and certs are definitely valid with correct keys and ca settings:

Uploaded with ImageShack.us

Any ideas, why?

from syslog:

Aug 16 08:14:01 usb-Inspiron-9300 NetworkManager[1233]: <info> Starting VPN service 'openvpn'...
Aug 16 08:14:05 usb-Inspiron-9300 NetworkManager[1233]: <info> VPN service 'openvpn' started (org.freedesktop.NetworkManager.openvpn), PID 2617
Aug 16 08:14:05 usb-Inspiron-9300 NetworkManager[1233]: <info> VPN service 'openvpn' appeared; activating connections
Aug 16 08:14:07 usb-Inspiron-9300 NetworkManager[1233]: <info> VPN plugin state changed: starting (3)
Aug 16 08:14:07 usb-Inspiron-9300 NetworkManager[1233]: <info> VPN connection 'clientFR' (Connect) reply received.
Aug 16 08:14:07 usb-Inspiron-9300 nm-openvpn[2622]: OpenVPN 2.2.1 i686-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Mar 30 2012
Aug 16 08:14:07 usb-Inspiron-9300 nm-openvpn[2622]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Aug 16 08:14:07 usb-Inspiron-9300 nm-openvpn[2622]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Aug 16 08:14:07 usb-Inspiron-9300 nm-openvpn[2622]: LZO compression initialized
Aug 16 08:14:07 usb-Inspiron-9300 nm-openvpn[2622]: UDPv4 link local: [undef]
Aug 16 08:14:07 usb-Inspiron-9300 nm-openvpn[2622]: UDPv4 link remote: [AF_INET]84.xxx.xxx.xx:1194
Aug 16 08:14:08 usb-Inspiron-9300 nm-openvpn[2622]: WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1542', remote='link-mtu 1546'
Aug 16 08:14:08 usb-Inspiron-9300 nm-openvpn[2622]: WARNING: 'mtu-dynamic' is present in remote config but missing in local config, remote='mtu-dynamic'
Aug 16 08:14:08 usb-Inspiron-9300 nm-openvpn[2622]: [ProxyPlayer.eu] Peer Connection Initiated with [AF_INET]84.xxx.xxx.xx:1194
Aug 16 08:14:10 usb-Inspiron-9300 nm-openvpn[2622]: AUTH: Received AUTH_FAILED control message
Aug 16 08:14:10 usb-Inspiron-9300 nm-openvpn[2622]: SIGTERM[soft,auth-failure] received, process exiting
Aug 16 08:14:10 usb-Inspiron-9300 NetworkManager[1233]: <warn> VPN plugin failed: 0
Aug 16 08:14:10 usb-Inspiron-9300 NetworkManager[1233]: <info> VPN plugin state changed: stopped (6)
Aug 16 08:14:10 usb-Inspiron-9300 NetworkManager[1233]: <info> VPN plugin state change reason: 10
Aug 16 08:14:10 usb-Inspiron-9300 NetworkManager[1233]: <warn> error disconnecting VPN: Could not process the request because no VPN connection was active.
Aug 16 08:14:10 usb-Inspiron-9300 NetworkManager[1233]: <info> Policy set 'virginmedia7554601 1' (wlan0) as default for IPv4 routing and DNS.
Aug 16 08:14:15 usb-Inspiron-9300 NetworkManager[1233]: <info> VPN service 'openvpn' disappeared

maikcat

your logs show

Aug 16 08:14:10 usb-Inspiron-9300 nm-openvpn[2622]: AUTH: Received AUTH_FAILED control message

the server rejects you..

server logs?

configs?

Michael.

qwertyjjj

client conf:
client
dev tun
proto udp
remote 84.xxx.xxx.xx 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/clientname.crt
key /etc/openvpn/clientname.key
comp-lzo
verb 1
tun-mtu 1500
fragment 1300
mssfix

server-conf:
local 84.xxx.xxx.xx
port 1194 #- port
proto udp
dev tun
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
client-config-dir /etc/openvpn/ccd
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 5 30
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
log /var/log/openvpn.log
tun-mtu 1500
fragment 1300
mssfix

qwertyjjj

client log:

Aug 17 08:37:13 usb-Inspiron-9300 nm-openvpn[3090]: TUN/TAP device tun0 opened
Aug 17 08:37:13 usb-Inspiron-9300 nm-openvpn[3090]: /usr/lib/NetworkManager/nm-openvpn-service-openvpn-helper tun0 1500 1542 10.8.0.14 10.8.0.13 init
Aug 17 08:37:13 usb-Inspiron-9300 NetworkManager[984]: <info> VPN connection 'clientFR' (IP Config Get) reply received.
Aug 17 08:37:13 usb-Inspiron-9300 NetworkManager[984]: <info> VPN Gateway: 84.xxx.xxx.xx
Aug 17 08:37:13 usb-Inspiron-9300 NetworkManager[984]: <info> Internal Gateway: 10.8.0.13
Aug 17 08:37:13 usb-Inspiron-9300 NetworkManager[984]: <info> Tunnel Device: tun0
Aug 17 08:37:13 usb-Inspiron-9300 NetworkManager[984]: <info> Internal IP4 Address: 10.8.0.14
Aug 17 08:37:13 usb-Inspiron-9300 NetworkManager[984]: <info> Internal IP4 Prefix: 32
Aug 17 08:37:13 usb-Inspiron-9300 NetworkManager[984]: <info> Internal IP4 Point-to-Point Address: 10.8.0.13
Aug 17 08:37:13 usb-Inspiron-9300 NetworkManager[984]: <info> Maximum Segment Size (MSS): 0
Aug 17 08:37:13 usb-Inspiron-9300 NetworkManager[984]: <info> Static Route: 10.8.0.1/32   Next Hop: 10.8.0.1
Aug 17 08:37:13 usb-Inspiron-9300 nm-openvpn[3090]: Initialization Sequence Completed
Aug 17 08:37:13 usb-Inspiron-9300 NetworkManager[984]: <info> Forbid Default Route: no
Aug 17 08:37:13 usb-Inspiron-9300 NetworkManager[984]: <info> Internal IP4 DNS: 208.67.222.222
Aug 17 08:37:13 usb-Inspiron-9300 NetworkManager[984]: <info> Internal IP4 DNS: 208.67.220.220
Aug 17 08:37:13 usb-Inspiron-9300 NetworkManager[984]: <info> DNS Domain: '(none)'
Aug 17 08:37:14 usb-Inspiron-9300 NetworkManager[984]: <info> DNS: starting dnsmasq...
Aug 17 08:37:14 usb-Inspiron-9300 dnsmasq[2986]: exiting on receipt of SIGTERM
Aug 17 08:37:14 usb-Inspiron-9300 NetworkManager[984]: <info> (tun0): writing resolv.conf to /sbin/resolvconf
Aug 17 08:37:14 usb-Inspiron-9300 dnsmasq[3096]: started, version 2.59 cache disabled
Aug 17 08:37:14 usb-Inspiron-9300 dnsmasq[3096]: compile time options: IPv6 GNU-getopt DBus i18n DHCP TFTP conntrack IDN
Aug 17 08:37:14 usb-Inspiron-9300 dnsmasq[3096]: using nameserver 208.67.220.220#53
Aug 17 08:37:14 usb-Inspiron-9300 dnsmasq[3096]: using nameserver 208.67.222.222#53
Aug 17 08:37:14 usb-Inspiron-9300 NetworkManager[984]: <info> VPN connection 'clientFR' (IP Config Get) complete.
Aug 17 08:37:14 usb-Inspiron-9300 NetworkManager[984]: <info> Policy set 'clientFR' (tun0) as default for IPv4 routing and DNS.
Aug 17 08:37:14 usb-Inspiron-9300 dbus[804]: [system] Activating service name='org.freedesktop.nm_dispatcher' (using servicehelper)
Aug 17 08:37:14 usb-Inspiron-9300 NetworkManager[984]: <info> VPN plugin state changed: started (4)
Aug 17 08:37:14 usb-Inspiron-9300 dbus[804]: [system] Successfully activated service 'org.freedesktop.nm_dispatcher'
Aug 17 08:37:18 usb-Inspiron-9300 nm-openvpn[3090]: Bad LZO decompression header byte: 0
Aug 17 08:37:43  nm-openvpn[3090]: last message repeated 5 times
Aug 17 08:37:43 usb-Inspiron-9300 nm-openvpn[3090]: [DomainName.eu] Inactivity timeout (--ping-restart), restarting
Aug 17 08:37:43 usb-Inspiron-9300 nm-openvpn[3090]: SIGUSR1[soft,ping-restart] received, process restarting
Aug 17 08:37:45 usb-Inspiron-9300 nm-openvpn[3090]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Aug 17 08:37:45 usb-Inspiron-9300 nm-openvpn[3090]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Aug 17 08:37:45 usb-Inspiron-9300 nm-openvpn[3090]: Re-using SSL/TLS context
Aug 17 08:37:45 usb-Inspiron-9300 nm-openvpn[3090]: LZO compression initialized
Aug 17 08:37:45 usb-Inspiron-9300 nm-openvpn[3090]: UDPv4 link local: [undef]
Aug 17 08:37:45 usb-Inspiron-9300 nm-openvpn[3090]: UDPv4 link remote: [AF_INET]84.xxx.xxx.xx:1194
Aug 17 08:37:46 usb-Inspiron-9300 nm-openvpn[3090]: WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1542', remote='link-mtu 1546'
Aug 17 08:37:46 usb-Inspiron-9300 nm-openvpn[3090]: WARNING: 'mtu-dynamic' is present in remote config but missing in local config, remote='mtu-dynamic'
Aug 17 08:37:46 usb-Inspiron-9300 nm-openvpn[3090]: [DomainName.eu] Peer Connection Initiated with [AF_INET]84.xxx.xxx.xx:1194
Aug 17 08:37:48 usb-Inspiron-9300 nm-openvpn[3090]: Preserving previous TUN/TAP instance: tun0
Aug 17 08:37:48 usb-Inspiron-9300 nm-openvpn[3090]: /usr/lib/NetworkManager/nm-openvpn-service-openvpn-helper tun0 1500 1542 10.8.0.14 10.8.0.13 restart
Aug 17 08:37:48 usb-Inspiron-9300 NetworkManager[984]: <warn> VPN plugin failed: 2
Aug 17 08:37:48 usb-Inspiron-9300 nm-openvpn[3090]: WARNING: Failed running command (--up/--down): external program exited with error status: 1
Aug 17 08:37:48 usb-Inspiron-9300 nm-openvpn[3090]: Exiting
Aug 17 08:37:48 usb-Inspiron-9300 avahi-daemon[1057]: Withdrawing workstation service for tun0.
Aug 17 08:37:48 usb-Inspiron-9300 NetworkManager[984]:    SCPlugin-Ifupdown: devices removed (path: /sys/devices/virtual/net/tun0, iface: tun0)
Aug 17 08:37:49 usb-Inspiron-9300 NetworkManager[984]: <warn> VPN plugin failed: 1
Aug 17 08:37:49 usb-Inspiron-9300 NetworkManager[984]: <info> VPN plugin state changed: stopped (6)
Aug 17 08:37:49 usb-Inspiron-9300 NetworkManager[984]: <info> VPN plugin state change reason: 0
Aug 17 08:37:49 usb-Inspiron-9300 NetworkManager[984]: <warn> error disconnecting VPN: Could not process the request because no VPN connection was active.
Aug 17 08:37:49 usb-Inspiron-9300 NetworkManager[984]: <warn> (5) failed to find interface name for index
Aug 17 08:37:49 usb-Inspiron-9300 NetworkManager[984]: nm_system_iface_flush_routes: assertion `iface != NULL' failed
Aug 17 08:37:49 usb-Inspiron-9300 NetworkManager[984]: <warn> (5) failed to find interface name for index
Aug 17 08:37:49 usb-Inspiron-9300 dnsmasq[3096]: exiting on receipt of SIGTERM
Aug 17 08:37:49 usb-Inspiron-9300 NetworkManager[984]: <info> DNS: starting dnsmasq...
Aug 17 08:37:49 usb-Inspiron-9300 NetworkManager[984]: <info> (tun0): writing resolv.conf to /sbin/resolvconf
Aug 17 08:37:49 usb-Inspiron-9300 dnsmasq[3144]: started, version 2.59 cache disabled
Aug 17 08:37:49 usb-Inspiron-9300 dnsmasq[3144]: compile time options: IPv6 GNU-getopt DBus i18n DHCP TFTP conntrack IDN
Aug 17 08:37:49 usb-Inspiron-9300 dnsmasq[3144]: using nameserver 194.168.8.100#53
Aug 17 08:37:49 usb-Inspiron-9300 dnsmasq[3144]: using nameserver 194.168.4.100#53
Aug 17 08:37:49 usb-Inspiron-9300 ntpdate[3130]: Can't find host ntp.ubuntu.com: Name or service not known (-2)
Aug 17 08:37:49 usb-Inspiron-9300 ntpdate[3130]: no servers can be used, exiting
Aug 17 08:37:50 usb-Inspiron-9300 NetworkManager[984]: <info> Policy set 'virginmedia7554601 1' (wlan0) as default for IPv4 routing and DNS.
Aug 17 08:37:50 usb-Inspiron-9300 dbus[804]: [system] Activating service name='org.freedesktop.nm_dispatcher' (using servicehelper)
Aug 17 08:37:50 usb-Inspiron-9300 dbus[804]: [system] Successfully activated service 'org.freedesktop.nm_dispatcher'
Aug 17 08:37:56 usb-Inspiron-9300 NetworkManager[984]: <info> VPN service 'openvpn' disappeared

server:

Fri Aug 17 09:35:34 2012 mycert/86.15.42.109:37638 [mycert] Inactivity timeout (--ping-restart), restarting
Fri Aug 17 09:35:34 2012 mycert/86.15.42.109:37638 SIGUSR1[soft,ping-restart] received, client-instance restarting
Fri Aug 17 09:35:47 2012 MULTI: multi_create_instance called
Fri Aug 17 09:35:47 2012 86.15.42.109:44444 Re-using SSL/TLS context
Fri Aug 17 09:35:47 2012 86.15.42.109:44444 LZO compression initialized
Fri Aug 17 09:35:47 2012 86.15.42.109:44444 Control Channel MTU parms [ L:1546 D:138 EF:38 EB:0 ET:0 EL:0 ]
Fri Aug 17 09:35:47 2012 86.15.42.109:44444 Data Channel MTU parms [ L:1546 D:1450 EF:46 EB:135 ET:0 EL:0 AF:3/1 ]
Fri Aug 17 09:35:47 2012 86.15.42.109:44444 Fragmentation MTU parms [ L:1546 D:1300 EF:45 EB:135 ET:1 EL:0 AF:3/1 ]
Fri Aug 17 09:35:47 2012 86.15.42.109:44444 Local Options hash (VER=V4): '8e7959c7'
Fri Aug 17 09:35:47 2012 86.15.42.109:44444 Expected Remote Options hash (VER=V4): 'c086e1aa'
Fri Aug 17 09:35:47 2012 86.15.42.109:44444 TLS: Initial packet from 86.15.42.109:44444, sid=f61fbaee a237cfdb
Fri Aug 17 09:35:47 2012 86.15.42.109:44444 VERIFY OK: depth=1, /C=FR/ST=FR/L=Paris/O=DomainNameFR/CN=DomainNameFR_CA/emailAddress=aide@DomainName.eu
Fri Aug 17 09:35:47 2012 86.15.42.109:44444 VERIFY OK: depth=0, /C=FR/ST=FR/L=Paris/O=DomainNameFR/CN=mycert/emailAddress=aide@DomainName.eu
Fri Aug 17 09:35:48 2012 86.15.42.109:44444 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1546', remote='link-mtu 1542'
Fri Aug 17 09:35:48 2012 86.15.42.109:44444 WARNING: 'mtu-dynamic' is present in local config but missing in remote config, local='mtu-dynamic'
Fri Aug 17 09:35:48 2012 86.15.42.109:44444 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Aug 17 09:35:48 2012 86.15.42.109:44444 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Aug 17 09:35:48 2012 86.15.42.109:44444 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Aug 17 09:35:48 2012 86.15.42.109:44444 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Aug 17 09:35:48 2012 86.15.42.109:44444 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Fri Aug 17 09:35:48 2012 86.15.42.109:44444 [mycert] Peer Connection Initiated with 86.15.42.109:44444
Fri Aug 17 09:35:48 2012 mycert/86.15.42.109:44444 MULTI: Learn: 10.8.0.14 -> mycert/86.15.42.109:44444
Fri Aug 17 09:35:48 2012 mycert/86.15.42.109:44444 MULTI: primary virtual IP for mycert/86.15.42.109:44444: 10.8.0.14
Fri Aug 17 09:35:50 2012 mycert/86.15.42.109:44444 PUSH: Received control message: 'PUSH_REQUEST'
Fri Aug 17 09:35:50 2012 mycert/86.15.42.109:44444 SENT CONTROL [mycert]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 5,ping-restart 30,ifconfig 10.8.0.14 10.8.0.13' (status=1)
Fri Aug 17 09:35:51 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 51
Fri Aug 17 09:35:51 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 51
Fri Aug 17 09:35:56 2012 mycert/86.15.42.109:44444 FRAG_IN error flags=0xfa2a187b: FRAG_TEST not implemented
Fri Aug 17 09:35:56 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 62
Fri Aug 17 09:35:56 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 62
Fri Aug 17 09:35:56 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 51
Fri Aug 17 09:35:56 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 51
Fri Aug 17 09:36:01 2012 mycert/86.15.42.109:44444 FRAG_IN error flags=0xfa2a187b: FRAG_TEST not implemented
Fri Aug 17 09:36:01 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 62
Fri Aug 17 09:36:01 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 62
Fri Aug 17 09:36:01 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 60
Fri Aug 17 09:36:01 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 60
Fri Aug 17 09:36:01 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 60
Fri Aug 17 09:36:01 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 60
Fri Aug 17 09:36:01 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 165
Fri Aug 17 09:36:02 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 165
Fri Aug 17 09:36:02 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 165
Fri Aug 17 09:36:03 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 165
Fri Aug 17 09:36:05 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 165
Fri Aug 17 09:36:06 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 62
Fri Aug 17 09:36:06 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 62
Fri Aug 17 09:36:06 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 60
Fri Aug 17 09:36:06 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 60
Fri Aug 17 09:36:06 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 60
Fri Aug 17 09:36:06 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 60
Fri Aug 17 09:36:08 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 53
Fri Aug 17 09:36:09 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 53
Fri Aug 17 09:36:09 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 165
Fri Aug 17 09:36:09 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 53
Fri Aug 17 09:36:11 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 53
Fri Aug 17 09:36:11 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 62
Fri Aug 17 09:36:11 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 62
Fri Aug 17 09:36:11 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 60
Fri Aug 17 09:36:11 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 60
Fri Aug 17 09:36:11 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 60
Fri Aug 17 09:36:11 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 60
Fri Aug 17 09:36:13 2012 mycert/86.15.42.109:44444 Bad LZO decompression header byte: 53

maikcat

the auth_failed error has nothing to do with lzo errors...

lzo errors seems you have fragmentation issues...

can you post the contents of your ccd file?

did you used ccd-exclusive on your server config?

Michael.