paul_rogers6
Hi All
I have openvpn-2.2.2-1.el6.x86_64 installed on a Centos6.3 server via the epel, all as per the instructions in the HOWTO.
I have openvpn-2.1.4-1.fc15.x86_64 installed on the client.
I have configured the server and a test client (running on Linux) to connect using the client certificate method set out in the HOWTO and this all works fine.
I now wish to do away with the certificates (on the client) and use pam + username + login to authenticate.
I have:
1. added the following config to the server:
plugin /usr/lib64/openvpn/plugin/lib/openvpn-auth-pam.so common-auth
client-cert-not-required
username-as-common-name
2. commented out the cert and key lines and added auth-user-pass.
When I run up the openvpn client the output on the client is:
Thu May 23 14:52:39 2013 OpenVPN 2.1.4 x86_64-redhat-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] built on Mar 17 2011
Enter Auth Username:paul
Enter Auth Password:
Thu May 23 14:52:46 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu May 23 14:52:46 2013 LZO compression initialized
Thu May 23 14:52:46 2013 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu May 23 14:52:46 2013 Socket Buffers: R=[212992->131072] S=[212992->131072]
Thu May 23 14:52:46 2013 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu May 23 14:52:46 2013 Local Options hash (VER=V4): '41690919'
Thu May 23 14:52:46 2013 Expected Remote Options hash (VER=V4): '530fdded'
Thu May 23 14:52:46 2013 UDPv4 link local: [undef]
Thu May 23 14:52:46 2013 UDPv4 link remote: 62.249.231.98:1194
Thu May 23 14:52:46 2013 TLS: Initial packet from 62.249.231.98:1194, sid=e6c3031c 423ca941
Thu May 23 14:52:46 2013 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu May 23 14:52:47 2013 VERIFY OK: depth=1,
<removed cert info>
Thu May 23 14:52:47 2013 VERIFY OK: nsCertType=SERVER
Thu May 23 14:52:47 2013 VERIFY OK: depth=0,
<removed cert info>
Thu May 23 14:53:46 2013 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Thu May 23 14:53:46 2013 TLS Error: TLS handshake failed
Thu May 23 14:53:46 2013 TCP/UDP: Closing socket
Thu May 23 14:53:46 2013 SIGUSR1[soft,tls-error] received, process restarting
Thu May 23 14:53:46 2013 Restart pause, 2 second(s)
Thu May 23 14:53:48 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu May 23 14:53:48 2013 Re-using SSL/TLS context
Thu May 23 14:53:48 2013 LZO compression initialized
Thu May 23 14:53:48 2013 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu May 23 14:53:48 2013 Socket Buffers: R=[212992->131072] S=[212992->131072]
Thu May 23 14:53:48 2013 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu May 23 14:53:48 2013 Local Options hash (VER=V4): '41690919'
Thu May 23 14:53:48 2013 Expected Remote Options hash (VER=V4): '530fdded'
Thu May 23 14:53:48 2013 UDPv4 link local: [undef]
Thu May 23 14:53:48 2013 UDPv4 link remote: 62.249.231.98:1194
Thu May 23 14:53:48 2013 TLS: Initial packet from 62.249.231.98:1194, sid=7320426a 31252ead
Thu May 23 14:53:48 2013 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu May 23 14:53:48 2013 VERIFY OK: depth=1,
<removed cert info>
Thu May 23 14:53:48 2013 VERIFY OK: nsCertType=SERVER
Thu May 23 14:53:48 2013 VERIFY OK: depth=0,
<removed cert info>
Thu May 23 14:54:48 2013 [server] Inactivity timeout (--ping-restart), restarting
Thu May 23 14:54:48 2013 TCP/UDP: Closing socket
Thu May 23 14:54:48 2013 SIGUSR1[soft,ping-restart] received, process restarting
Thu May 23 14:54:48 2013 Restart pause, 2 second(s)
Thu May 23 14:54:50 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu May 23 14:54:50 2013 Re-using SSL/TLS context
Thu May 23 14:54:50 2013 LZO compression initialized
Thu May 23 14:54:50 2013 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu May 23 14:54:50 2013 Socket Buffers: R=[212992->131072] S=[212992->131072]
Thu May 23 14:54:50 2013 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu May 23 14:54:50 2013 Local Options hash (VER=V4): '41690919'
Thu May 23 14:54:50 2013 Expected Remote Options hash (VER=V4): '530fdded'
Thu May 23 14:54:50 2013 UDPv4 link local: [undef]
Thu May 23 14:54:50 2013 UDPv4 link remote: 62.249.231.98:1194
Thu May 23 14:54:50 2013 TLS: Initial packet from 62.249.231.98:1194, sid=8154a191 14c8fb5f
Thu May 23 14:54:50 2013 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu May 23 14:54:50 2013 VERIFY OK: depth=1,
<removed cert info>
Thu May 23 14:54:50 2013 VERIFY OK: nsCertType=SERVER
Thu May 23 14:54:50 2013 VERIFY OK: depth=0,
<removed cert info>
and the output on the server is as follows:
May 23 14:56:55 vpn001 openvpn[1533]: MULTI: multi_create_instance called
May 23 14:56:55 vpn001 openvpn[1533]: 81.137.187.30:42243 Re-using SSL/TLS context
May 23 14:56:55 vpn001 openvpn[1533]: 81.137.187.30:42243 LZO compression initialized
May 23 14:56:55 vpn001 openvpn[1533]: 81.137.187.30:42243 Control Channel MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
May 23 14:56:55 vpn001 openvpn[1533]: 81.137.187.30:42243 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
May 23 14:56:55 vpn001 openvpn[1533]: 81.137.187.30:42243 Local Options String: 'V4,dev-type tun,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
May 23 14:56:55 vpn001 openvpn[1533]: 81.137.187.30:42243 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
May 23 14:56:55 vpn001 openvpn[1533]: 81.137.187.30:42243 Local Options hash (VER=V4): '5b1533a2'
May 23 14:56:55 vpn001 openvpn[1533]: 81.137.187.30:42243 Expected Remote Options hash (VER=V4): 'd3a7571a'
May 23 14:56:55 vpn001 openvpn[1533]: 81.137.187.30:42243 TLS: Initial packet from 81.137.187.30:42243, sid=fcee6233 682aeef1
May 23 14:56:56 vpn001 openvpn[1533]: 81.137.187.30:42243 TLS_ERROR: BIO read tls_read_plaintext error: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate
May 23 14:56:56 vpn001 openvpn[1533]: 81.137.187.30:42243 TLS Error: TLS object -> incoming plaintext read error
May 23 14:56:56 vpn001 openvpn[1533]: 81.137.187.30:42243 TLS Error: TLS handshake failed
May 23 14:56:56 vpn001 openvpn[1533]: 81.137.187.30:42243 SIGUSR1[soft,tls-error] received, client-instance restarting
If I uncomment the cert and key lines in the client it then connects again with no issues. However I notice that even then I can enter any old rubbish into the user name and password fields and the client still connects.
It seems that the client-cert-not-required is being ignored. Any idea how to get round this?
Many thanks
Paul
paul_rogers6
Hi Guys
Fixed this issue. The problem was with the entry in server.conf:
plugin /usr/lib64/openvpn/plugin/lib/openvpn-auth-pam.so common-auth
This should be:
plugin /usr/lib64/openvpn/plugin/lib/openvpn-auth-pam.so system-auth
or (not sure about this as no way of testing):
plugin /usr/lib64/openvpn/plugin/lib/openvpn-auth-pam.so common-account
on Ubuntu systems.
Many thanks for all the help in resolving this problem.
Regards
Paul
