Hi guys! I've tried to use
tls-auth but couldn't make it work. Server and client have the same file which was generated by:
openvpn --genkey --secret ta.key
Eveytime I get the following error:
---openvpn.log---
Tue Nov 20 19:40:19 2012 OpenVPN 2.2.2 x86_64-unknown-linux-gnu [SSL] [LZO2] [EPOLL] [eurephia] built on Nov 17 2012
Tue Nov 20 19:40:19 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Nov 20 19:40:19 2012 Diffie-Hellman initialized with 4096 bit key
Tue Nov 20 19:40:19 2012 Control Channel Authentication: using '/etc/openvpn/keys/ta.key' as a OpenVPN static key file
Tue Nov 20 19:40:19 2012 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Nov 20 19:40:19 2012 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Nov 20 19:40:19 2012 TLS-Auth MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Tue Nov 20 19:40:19 2012 Socket Buffers: R=[129024->131072] S=[129024->131072]
Tue Nov 20 19:40:19 2012 ROUTE default_gateway=10.255.255.1
Tue Nov 20 19:40:19 2012 TUN/TAP device tun0 opened
Tue Nov 20 19:40:19 2012 TUN/TAP TX queue length set to 100
Tue Nov 20 19:40:19 2012 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Tue Nov 20 19:40:20 2012 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Tue Nov 20 19:40:20 2012 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Nov 20 19:40:20 2012 GID set to nobody
Tue Nov 20 19:40:20 2012 UID set to nobody
Tue Nov 20 19:40:20 2012 UDPv4 link local (bound): 9.9.9.9:1194
Tue Nov 20 19:40:20 2012 UDPv4 link remote: [undef]
Tue Nov 20 19:40:20 2012 MULTI: multi_init called, r=256 v=256
Tue Nov 20 19:40:20 2012 IFCONFIG POOL: base=10.8.0.4 size=62
Tue Nov 20 19:40:20 2012 IFCONFIG POOL LIST
Tue Nov 20 19:40:20 2012 client,10.8.0.4
Tue Nov 20 19:40:20 2012 Initialization Sequence Completed
Tue Nov 20 19:40:21 2012 Authenticate/Decrypt packet error: packet HMAC authentication failed
Tue Nov 20 19:40:21 2012 TLS Error: incoming packet authentication failed from 9.9.9.9:61457
Tue Nov 20 19:40:38 2012 Authenticate/Decrypt packet error: packet HMAC authentication failed
Tue Nov 20 19:40:38 2012 TLS Error: incoming packet authentication failed from 9.9.9.9:61457
Tue Nov 20 19:40:54 2012 Authenticate/Decrypt packet error: packet HMAC authentication failed
Tue Nov 20 19:40:54 2012 TLS Error: incoming packet authentication failed from 9.9.9.9:57044
Tue Nov 20 19:40:56 2012 Authenticate/Decrypt packet error: packet HMAC authentication failed
Tue Nov 20 19:40:56 2012 TLS Error: incoming packet authentication failed from 9.9.9.9:57044
Tue Nov 20 19:41:00 2012 Authenticate/Decrypt packet error: packet HMAC authentication failed
When I disable
tls-auth I still get the following:
---openvpn.log---
Wed Nov 21 10:46:23 2012 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Nov 21 10:46:23 2012 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Nov 21 10:46:23 2012 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Nov 21 10:46:23 2012 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Nov 21 10:46:23 2012 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA
Is HMAC already been enforced even when
tls-auth is not used?
[1]
---server.conf---
local 9.9.9.9
port 1194
proto udp
dev tun
ifconfig 10.8.0.1 10.8.0.2
route 10.8.0.0 255.255.255.0
push "route 10.8.0.1"
push "route 9.9.9.9 255.255.255.0 10.8.0.1"
tls-server
ca ca-client.crt
dh dh4096.pem
cert server.crt
key server.key
tls-auth ta.key 0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log-append openvpn.log
verb 3
[2]
---client.ovpn---
client
dev tun
proto udp
remote 9.9.9.9 1194
ifconfig 10.8.0.2 10.8.0.1
resolv-retry infinite
nobind
user nobody
group nobody
persist-tun
persist-key
ca ca-server.crt
cert client.crt
key client.key
tls-auth ta.key 1
remote-cert-tls server
comp-lzo
ping 15
verb 3
