[SOLVED] Client CommonNames all show up as UNDEF

eesperan

I have a pretty standard OpenVPN setup, on Debian using a tun interface. Clients are all authenticated with certificates, and authorized with LDAP.

I'm having a problem applying ccd settings to these clients, and I'm pretty sure it's because of this:

:/etc/openvpn# cat openvpn-status.log 
OpenVPN CLIENT LIST
Updated,Thu May  2 21:48:10 2013
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
UNDEF,54.246.150.93:55198,5902,7793,Thu May  2 21:39:07 2013
UNDEF,184.172.40.20:38646,5138,7013,Thu May  2 21:40:57 2013
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
10.8.0.2,UNDEF,54.246.150.93:55198,Thu May  2 21:40:01 2013
10.8.0.3,UNDEF,184.172.40.20:38646,Thu May  2 21:40:57 2013
GLOBAL STATS
Max bcast/mcast queue length,0
END

As you can see, the clients' CommonName shows up as UNDEF. This happens for every client cert I use, even newly created ones.

Googling shows that this can be an artifact of an incomplete or aborted TLS session, but all these clients are happily connected and passing traffic, and I see the same results whether I have tls-auth enabled or not. Without OpenVPN being aware of a unique CommonName, it (I am guessing) won't be able to apply cn-specific directives (which would explain my inability to set a static ip, iroute, etc). Any ideas?

----------------LOGFILES--------------------
server.conf

port 1194
proto udp
dev tun
topology subnet
ca ca.crt
cert server.crt
key server.key  
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.10.10.0 255.255.255.0"
client-config-dir ccd
route 10.0.254.0 255.255.255.0
push "dhcp-option DNS 10.10.10.11"
push "dhcp-option DNS 8.8.8.8" 
push "dhcp-option DOMAIN <mydomain>.com"
client-to-client
duplicate-cn
keepalive 10 120
comp-lzo
max-clients 200
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log-append   /var/log/openvpn.log
verb 4
mute 20
push "explicit-exit-notify 3"
plugin /usr/lib/openvpn/openvpn-auth-ldap.so /etc/openvpn/auth/auth-ldap.conf
client-cert-not-required
tls-auth ta.key 0

client.conf

client
dev tun
proto udp
remote <my vpn server> 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert fotagw.dev.crt
key fotagw.dev.key
ns-cert-type server
tls-auth ta.key 1
comp-lzo
verb 4
auth-user-pass creds.txt
log-append   /var/log/openvpn.log
topology subnet

mwandelaar

I'm familiar with (part of) this behaviour.
When my clients connect and i'm watching the status-file, clients first show-up as UNDEF and after a few seconds the common-name shows up in the status file.
Please try to modify the status file to have a time-value and a full path, like:

status /var/log/openvpn-status.log 60

And can you post some of the server-logfile when a client connects?
I would remove the line

client-cert-not-required

for testing this, because if the validation of the cert for some kind of reason failes, it's still allowed to connect and therefor the client will not have a common-name, as it does not have a cert.

janjust

you're using

duplicate-cn
client-cert-not-required

in that case OpenVPN cannot determine the client name (which is normally based on the client-side certificate) and it puts 'UNDEF' in there. You might able to work around this using

username-as-common-name

eesperan

That was it! Thanks very much!