Hi,
I trying to follow manual:
http://www.vpsdash.com/?p=163 to configure OpenVPN with freeradius server, but seems something doesn't works. This freeradius servers is already used for: pptp, l2tp and ipsec auth.
I use Debian 6.0.7 amd64, openvpn from debian repository and compiled radius plugin as from howto.
Can you please give advice, where is my mistake in configuration?
Server side log:
tail -f /var/log/openvpn
Sat Mar 16 05:42:59 2013 /sbin/ifcotail -f /var/log/openvpn
Sat Mar 16 05:42:59 2013 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Sat Mar 16 05:42:59 2013 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Sat Mar 16 05:42:59 2013 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Sat Mar 16 05:42:59 2013 GID set to nogroup
Sat Mar 16 05:42:59 2013 UID set to nobody
Sat Mar 16 05:42:59 2013 UDPv4 link local (bound): [undef]
Sat Mar 16 05:42:59 2013 UDPv4 link remote: [undef]
Sat Mar 16 05:42:59 2013 MULTI: multi_init called, r=256 v=256
Sat Mar 16 05:42:59 2013 IFCONFIG POOL: base=10.8.0.4 size=62
Sat Mar 16 05:42:59 2013 Initialization Sequence Completed
Sat Mar 16 05:43:18 2013 MULTI: multi_create_instance called
Sat Mar 16 05:43:18 2013 195.39.196.250:36825 Re-using SSL/TLS context
Sat Mar 16 05:43:18 2013 195.39.196.250:36825 Control Channel MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sat Mar 16 05:43:18 2013 195.39.196.250:36825 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Sat Mar 16 05:43:18 2013 195.39.196.250:36825 Local Options hash (VER=V4): '239669a8'
Sat Mar 16 05:43:18 2013 195.39.196.250:36825 Expected Remote Options hash (VER=V4): '3514370b'
Sat Mar 16 05:43:18 2013 195.39.196.250:36825 TLS: Initial packet from [AF_INET]195.39.196.250:36825, sid=831bcaac d9549fe6
Sat Mar 16 05:43:21 2013 RADIUS-PLUGIN: FOREGROUND THREAD: Auth_user_pass_verify thread started.
Sat Mar 16 05:43:21 2013 RADIUS-PLUGIN: FOREGROUND THREAD: New user.
Sat Mar 16 05:43:22 2013 RADIUS-PLUGIN: No attributes Acct Interim Interval or bad length.
Sat Mar 16 05:43:22 2013 RADIUS-PLUGIN: Client config file was not written, overwriteccfiles is false
.Sat Mar 16 05:43:22 2013 RADIUS-PLUGIN: FOREGROUND THREAD: Add user to map.
Sat Mar 16 05:43:22 2013 195.39.196.250:36825 PLUGIN_CALL: POST /etc/openvpn/radiusplugin.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
AUTH-PAM: BACKGROUND: user 'user' failed to authenticate: Error in service module
Sat Mar 16 05:43:25 2013 195.39.196.250:36825 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
Sat Mar 16 05:43:25 2013 195.39.196.250:36825 PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/lib/openvpn/openvpn-auth-pam.so
Sat Mar 16 05:43:25 2013 RADIUS-PLUGIN: FOREGROUND THREAD: Auth_user_pass_verify thread started.
Sat Mar 16 05:43:25 2013 RADIUS-PLUGIN: FOREGROUND THREAD: New user.
Sat Mar 16 05:43:25 2013 RADIUS-PLUGIN: No attributes Acct Interim Interval or bad length.
Sat Mar 16 05:43:25 2013 RADIUS-PLUGIN: Client config file was not written, overwriteccfiles is false
.Sat Mar 16 05:43:25 2013 RADIUS-PLUGIN: FOREGROUND THREAD: Add user to map.
Sat Mar 16 05:43:25 2013 195.39.196.250:36825 PLUGIN_CALL: POST /etc/openvpn/radiusplugin.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Sat Mar 16 05:43:25 2013 195.39.196.250:36825 TLS Auth Error: Auth Username/Password verification failed for peer
Sat Mar 16 05:43:25 2013 195.39.196.250:36825 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Sat Mar 16 05:43:25 2013 195.39.196.250:36825 [] Peer Connection Initiated with [AF_INET]195.39.196.250:36825
Sat Mar 16 05:43:28 2013 195.39.196.250:36825 PUSH: Received control message: 'PUSH_REQUEST'
Sat Mar 16 05:43:28 2013 195.39.196.250:36825 Delayed exit in 5 seconds
Sat Mar 16 05:43:28 2013 195.39.196.250:36825 SENT CONTROL [UNDEF]: 'AUTH_FAILED' (status=1)
Sat Mar 16 05:43:30 2013 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Sat Mar 16 05:43:33 2013 195.39.196.250:36825 SIGTERM[soft,delayed-exit] received, client-instance exitingnfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Sat Mar 16 05:42:59 2013 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Sat Mar 16 05:42:59 2013 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Sat Mar 16 05:42:59 2013 GID set to nogroup
Sat Mar 16 05:42:59 2013 UID set to nobody
Sat Mar 16 05:42:59 2013 UDPv4 link local (bound): [undef]
Sat Mar 16 05:42:59 2013 UDPv4 link remote: [undef]
Sat Mar 16 05:42:59 2013 MULTI: multi_init called, r=256 v=256
Sat Mar 16 05:42:59 2013 IFCONFIG POOL: base=10.8.0.4 size=62
Sat Mar 16 05:42:59 2013 Initialization Sequence Completed
Sat Mar 16 05:43:18 2013 MULTI: multi_create_instance called
Sat Mar 16 05:43:18 2013 195.39.196.250:36825 Re-using SSL/TLS context
Sat Mar 16 05:43:18 2013 195.39.196.250:36825 Control Channel MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sat Mar 16 05:43:18 2013 195.39.196.250:36825 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Sat Mar 16 05:43:18 2013 195.39.196.250:36825 Local Options hash (VER=V4): '239669a8'
Sat Mar 16 05:43:18 2013 195.39.196.250:36825 Expected Remote Options hash (VER=V4): '3514370b'
Sat Mar 16 05:43:18 2013 195.39.196.250:36825 TLS: Initial packet from [AF_INET]195.39.196.250:36825, sid=831bcaac d9549fe6
Sat Mar 16 05:43:21 2013 RADIUS-PLUGIN: FOREGROUND THREAD: Auth_user_pass_verify thread started.
Sat Mar 16 05:43:21 2013 RADIUS-PLUGIN: FOREGROUND THREAD: New user.
Sat Mar 16 05:43:22 2013 RADIUS-PLUGIN: No attributes Acct Interim Interval or bad length.
Sat Mar 16 05:43:22 2013 RADIUS-PLUGIN: Client config file was not written, overwriteccfiles is false
.Sat Mar 16 05:43:22 2013 RADIUS-PLUGIN: FOREGROUND THREAD: Add user to map.
Sat Mar 16 05:43:22 2013 195.39.196.250:36825 PLUGIN_CALL: POST /etc/openvpn/radiusplugin.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
AUTH-PAM: BACKGROUND: user 'user' failed to authenticate: Error in service module
Sat Mar 16 05:43:25 2013 195.39.196.250:36825 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
Sat Mar 16 05:43:25 2013 195.39.196.250:36825 PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/lib/openvpn/openvpn-auth-pam.so
Sat Mar 16 05:43:25 2013 RADIUS-PLUGIN: FOREGROUND THREAD: Auth_user_pass_verify thread started.
Sat Mar 16 05:43:25 2013 RADIUS-PLUGIN: FOREGROUND THREAD: New user.
Sat Mar 16 05:43:25 2013 RADIUS-PLUGIN: No attributes Acct Interim Interval or bad length.
Sat Mar 16 05:43:25 2013 RADIUS-PLUGIN: Client config file was not written, overwriteccfiles is false
.Sat Mar 16 05:43:25 2013 RADIUS-PLUGIN: FOREGROUND THREAD: Add user to map.
Sat Mar 16 05:43:25 2013 195.39.196.250:36825 PLUGIN_CALL: POST /etc/openvpn/radiusplugin.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Sat Mar 16 05:43:25 2013 195.39.196.250:36825 TLS Auth Error: Auth Username/Password verification failed for peer
Sat Mar 16 05:43:25 2013 195.39.196.250:36825 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Sat Mar 16 05:43:25 2013 195.39.196.250:36825 [] Peer Connection Initiated with [AF_INET]195.39.196.250:36825
Sat Mar 16 05:43:28 2013 195.39.196.250:36825 PUSH: Received control message: 'PUSH_REQUEST'
Sat Mar 16 05:43:28 2013 195.39.196.250:36825 Delayed exit in 5 seconds
Sat Mar 16 05:43:28 2013 195.39.196.250:36825 SENT CONTROL [UNDEF]: 'AUTH_FAILED' (status=1)
Sat Mar 16 05:43:30 2013 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Sat Mar 16 05:43:33 2013 195.39.196.250:36825 SIGTERM[soft,delayed-exit] received, client-instance exiting
Client side:
openvpn client.conf
Sat Mar 16 00:00:38 2013 OpenVPN 2.3.0 x86_64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [eurephia] [MH] [IPv6] built on Feb 9 2013
Enter Auth Username: ****
Enter Auth Password: ***
Sat Mar 16 00:00:42 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sat Mar 16 00:00:42 2013 Socket Buffers: R=[212992->131072] S=[212992->131072]
Sat Mar 16 00:00:42 2013 UDPv4 link local: [undef]
Sat Mar 16 00:00:42 2013 UDPv4 link remote: [AF_INET]124.248.205.51:1194
Sat Mar 16 00:00:42 2013 TLS: Initial packet from [AF_INET]124.248.205.51:1194, sid=e782664e dfb0a0c3
Sat Mar 16 00:00:44 2013 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=STIDIA, CN=a.hk.vpnshield.stidia.com, name=server, emailAddress=me@myhost.mydomain
Sat Mar 16 00:00:44 2013 VERIFY OK: nsCertType=SERVER
Sat Mar 16 00:00:44 2013 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, CN=server, emailAddress=me@myhost.mydomain
Sat Mar 16 00:00:49 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Mar 16 00:00:49 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Mar 16 00:00:49 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Mar 16 00:00:49 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Mar 16 00:00:49 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sat Mar 16 00:00:49 2013 [server] Peer Connection Initiated with [AF_INET]124.248.205.51:1194
Sat Mar 16 00:00:51 2013 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Mar 16 00:00:51 2013 AUTH: Received control message: AUTH_FAILED
Sat Mar 16 00:00:51 2013 SIGTERM[soft,auth-failure] received, process exiting
Server side config:
dev tun
## udp is recommended, avoid TCP over TCP
proto udp
## any port will do, this is the standard
port 1194
## certs we created earlier
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
user nobody
group nogroup
## You can make this any private subnet you like
server 10.8.0.0 255.255.255.0
persist-key
persist-tun
#status openvpn-status.log
#verb 3
client-to-client
## make this connection the default gateway for network traffic
push "redirect-gateway def1"
## I am running dns_masq, you may want to put your server's DNS here
## or even google: 8.8.8.8
push "dhcp-option DNS 8.8.8.8"
log-append /var/log/openvpn
## User authentication settings. Usernames must be able to authenticate with PAM
## To use radius or another auth mechanism create /etc/pam.d/openvpn
## by default it is doing common-auth (a user must have a local accout and pasword)
plugin /usr/lib/openvpn/openvpn-auth-pam.so login
client-cert-not-required
username-as-common-name
## A management interface allows you to telnet from local host to use
## telnet localhost 7505
management localhost 7505
status /var/log/openvpn-status.log
log-append /var/log/openvpn-status.log
verb 3
#plugin /etc/openvpn/radiusplugin.so
plugin /etc/openvpn/radiusplugin.so /etc/openvpn/radiusplugin.cnf
Client conf:
##############################################
# Sample client-side OpenVPN 2.0 config file.
# for connecting to multi-client server.
##############################################
# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client
dev tun
proto udp
# The hostname/IP and port of the server.
remote 124.248.205.51 1194
# host name of the OpenVPN server. Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite
# Most clients don't need to bind to
# a specific local port number.
nobind
# Try to preserve some state across restarts.
persist-key
persist-tun
# Certificate Authority
ca ca.crt
# Username/Password authentication is used on the server
auth-user-pass
# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server". This is an
# important precaution to protect against
# a potential attack discussed here:
# http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server". The build-key-server
# script in the easy-rsa folder will do this.
ns-cert-type server
# Set log file verbosity.
verb 3
auth-nocache
