Several clients get the same IP address from the server

nicolas.cardoso

Hi all,

The context
I've got a dedicated server and many clients on a VPN. All machines are running GNU/Linux (Debian).
The server is configured to:
- allow client-to-client connections,
- use static IP for clients having a conf file in the "ccd" folder,
- allow password authentification (using pam module and username as common name),
- allow the same user to connect to the server several times concurrently.

There are human clients (having each they own username) and machine clients (all using a single generic account on the server). This generic account has no static IP conf file and several machines are using it to connect to the VPN at the same time.

My problem
While the server is correctly giving different IP addresses to the machine clients (using the same username/password), it may happens that 2 machine clients end up with the same address on the VPN despite the fact that the server think they have different addresses.

Example
This may happen under the following scenario:
- client 1 has IP X
- client 2 has IP Y
- client 1 losts connection (due to network issues), when network is back, the server correctly handshakes with client 1 (whose virtual interface never came down and is still using IP X) and gives a new address to client 1: IP Z. For a reason I ignore (no trace in the log), client 1 does not get this IP change and keeps using IP X
- then client 1 has IP X (but server thinks it has IP Z) and client 2 has IP Y
- client 2 needs to restart, when back online, server gives to client 2 the IP X (the first from the IP range which is free from the server point of view), for another reason I ignore, server changes its mind 20seconds later and gives to client 2 the IP W, but the client 2 is stuck with IP X up without being able to see the VPN.

Time goes on, the two clients have IP X, server does not seem to bother (auth is successful), but I can only log to client 1 with that IP, tun0 interface of client 2 is up with IP X but all stats are to 0, and the log of the server shows that address X is NOT is use, that client 1 is supposed to have IP Z and client 2 IP W.
I've got the logs from the server and the two clients depicting the situation I just described, I can provide them upon request.

What I would like to know
I would like to force the server to check that the IP set by the client is actually the one the server has requested. Is that possible ? Or can the client check for the IP to be free before using it ?

Cheers,
Nicolas

nicolas.cardoso

OK, so here are the configs

Client (same for both client)

client
dev tun
proto udp
remote my_server.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/keys/ca.crt
ns-cert-type server
comp-lzo
verb 3
auth-user-pass /etc/openvpn/keys/client.crd
script-security 2
up /opt/my_script.sh

server

port 1194
proto udp
dev tun
ca ca.crt
cert my_cert.crt
key my_key.key  # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
client-to-client
duplicate-cn
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
client-cert-not-required
username-as-common-name
plugin /usr/lib/openvpn/openvpn-auth-pam.so common-auth

Then the logs
client 1 real IP is 111.111.111.111
client 2 real IP is 222.222.222.222
Both clients start at 1:07 AM but client 2 needed to restart at 9:29 AM (losing any previous log)
Client 1 lost connection at 5:08 AM

client 1 log:

Nov 27 01:07:51 004DD4RP38 ovpn-client[982]: OpenVPN 2.1.3 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Jun  6 2013
Nov 27 01:07:51 004DD4RP38 ovpn-client[982]: WARNING: file '/etc/openvpn/keys/kbox.crd' is group or others accessible
Nov 27 01:07:51 004DD4RP38 ovpn-client[982]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Nov 27 01:07:51 004DD4RP38 ovpn-client[982]: LZO compression initialized
Nov 27 01:07:51 004DD4RP38 ovpn-client[982]: Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Nov 27 01:07:51 004DD4RP38 ovpn-client[982]: Socket Buffers: R=[112640->131072] S=[112640->131072]
Nov 27 01:07:52 004DD4RP38 ovpn-client[982]: Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Nov 27 01:07:52 004DD4RP38 ovpn-client[982]: Local Options hash (VER=V4): '41690919'
Nov 27 01:07:52 004DD4RP38 ovpn-client[982]: Expected Remote Options hash (VER=V4): '530fdded'
Nov 27 01:07:52 004DD4RP38 ovpn-client[986]: UDPv4 link local: [undef]
Nov 27 01:07:52 004DD4RP38 ovpn-client[986]: UDPv4 link remote: [AF_INET]95.142.161.163:1194
Nov 27 01:07:52 004DD4RP38 ovpn-client[986]: TLS: Initial packet from [AF_INET]95.142.161.163:1194, sid=9f35009d f3d08e89
Nov 27 01:07:52 004DD4RP38 ovpn-client[986]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Nov 27 01:07:58 004DD4RP38 ovpn-client[986]: VERIFY OK: depth=1, /C=FR/ST=isere/L=grenoble/O=my_name/OU=changeme/CN=cn/name=my_name/emailAddress=contact@my_server.com
Nov 27 01:07:58 004DD4RP38 ovpn-client[986]: VERIFY OK: nsCertType=SERVER
Nov 27 01:07:58 004DD4RP38 ovpn-client[986]: VERIFY OK: depth=0, /C=FR/ST=isere/L=grenoble/O=my_name/OU=changeme/CN=cn/name=my_name/emailAddress=contact@my_server.com
Nov 27 01:08:03 004DD4RP38 ovpn-client[986]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 01:08:03 004DD4RP38 ovpn-client[986]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 01:08:03 004DD4RP38 ovpn-client[986]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 01:08:03 004DD4RP38 ovpn-client[986]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 01:08:03 004DD4RP38 ovpn-client[986]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Nov 27 01:08:03 004DD4RP38 ovpn-client[986]: [cn] Peer Connection Initiated with [AF_INET]95.142.161.163:1194
Nov 27 01:08:06 004DD4RP38 ovpn-client[986]: SENT CONTROL [cn]: 'PUSH_REQUEST' (status=1)
Nov 27 01:08:07 004DD4RP38 ovpn-client[986]: PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.14 10.8.0.13'
Nov 27 01:08:07 004DD4RP38 ovpn-client[986]: OPTIONS IMPORT: timers and/or timeouts modified
Nov 27 01:08:07 004DD4RP38 ovpn-client[986]: OPTIONS IMPORT: --ifconfig/up options modified
Nov 27 01:08:07 004DD4RP38 ovpn-client[986]: OPTIONS IMPORT: route options modified
Nov 27 01:08:07 004DD4RP38 ovpn-client[986]: ROUTE default_gateway=192.168.1.55
Nov 27 01:08:07 004DD4RP38 ovpn-client[986]: TUN/TAP device tun0 opened
Nov 27 01:08:07 004DD4RP38 ovpn-client[986]: TUN/TAP TX queue length set to 100
Nov 27 01:08:07 004DD4RP38 ovpn-client[986]: /sbin/ifconfig tun0 10.8.0.14 pointopoint 10.8.0.13 mtu 1500
Nov 27 01:08:07 004DD4RP38 ovpn-client[986]: /opt/my_script.sh tun0 1500 1542 10.8.0.14 10.8.0.13 init
Nov 27 01:08:20 004DD4RP38 ovpn-client[986]: /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.13
Nov 27 01:08:20 004DD4RP38 ovpn-client[986]: Initialization Sequence Completed
Nov 27 02:08:03 004DD4RP38 ovpn-client[986]: TLS: soft reset sec=0 bytes=37221/0 pkts=709/0
Nov 27 02:08:04 004DD4RP38 ovpn-client[986]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Nov 27 02:08:07 004DD4RP38 ovpn-client[986]: VERIFY OK: depth=1, /C=FR/ST=isere/L=grenoble/O=my_name/OU=changeme/CN=cn/name=my_name/emailAddress=contact@my_server.com
Nov 27 02:08:07 004DD4RP38 ovpn-client[986]: VERIFY OK: nsCertType=SERVER
Nov 27 02:08:07 004DD4RP38 ovpn-client[986]: VERIFY OK: depth=0, /C=FR/ST=isere/L=grenoble/O=my_name/OU=changeme/CN=cn/name=my_name/emailAddress=contact@my_server.com
Nov 27 02:08:12 004DD4RP38 ovpn-client[986]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 02:08:12 004DD4RP38 ovpn-client[986]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 02:08:12 004DD4RP38 ovpn-client[986]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 02:08:12 004DD4RP38 ovpn-client[986]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 02:08:12 004DD4RP38 ovpn-client[986]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Nov 27 03:08:03 004DD4RP38 ovpn-client[986]: TLS: tls_process: killed expiring key
Nov 27 03:08:12 004DD4RP38 ovpn-client[986]: TLS: soft reset sec=0 bytes=37012/0 pkts=705/0
Nov 27 03:08:12 004DD4RP38 ovpn-client[986]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Nov 27 03:08:16 004DD4RP38 ovpn-client[986]: VERIFY OK: depth=1, /C=FR/ST=isere/L=grenoble/O=my_name/OU=changeme/CN=cn/name=my_name/emailAddress=contact@my_server.com
Nov 27 03:08:16 004DD4RP38 ovpn-client[986]: VERIFY OK: nsCertType=SERVER
Nov 27 03:08:16 004DD4RP38 ovpn-client[986]: VERIFY OK: depth=0, /C=FR/ST=isere/L=grenoble/O=my_name/OU=changeme/CN=cn/name=my_name/emailAddress=contact@my_server.com
Nov 27 03:08:21 004DD4RP38 ovpn-client[986]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 03:08:21 004DD4RP38 ovpn-client[986]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 03:08:21 004DD4RP38 ovpn-client[986]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 03:08:21 004DD4RP38 ovpn-client[986]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 03:08:21 004DD4RP38 ovpn-client[986]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Nov 27 04:08:12 004DD4RP38 ovpn-client[986]: TLS: tls_process: killed expiring key
Nov 27 04:08:22 004DD4RP38 ovpn-client[986]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Nov 27 04:08:25 004DD4RP38 ovpn-client[986]: VERIFY OK: depth=1, /C=FR/ST=isere/L=grenoble/O=my_name/OU=changeme/CN=cn/name=my_name/emailAddress=contact@my_server.com
Nov 27 04:08:25 004DD4RP38 ovpn-client[986]: VERIFY OK: nsCertType=SERVER
Nov 27 04:08:25 004DD4RP38 ovpn-client[986]: VERIFY OK: depth=0, /C=FR/ST=isere/L=grenoble/O=my_name/OU=changeme/CN=cn/name=my_name/emailAddress=contact@my_server.com
Nov 27 04:08:29 004DD4RP38 ovpn-client[986]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 04:08:29 004DD4RP38 ovpn-client[986]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 04:08:29 004DD4RP38 ovpn-client[986]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 04:08:29 004DD4RP38 ovpn-client[986]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 04:08:29 004DD4RP38 ovpn-client[986]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Nov 27 05:08:07 004DD4RP38 ovpn-client[986]: read UDPv4 [ENETUNREACH]: Network is unreachable (code=101)
Nov 27 05:08:17 004DD4RP38 ovpn-client[986]: read UDPv4 [ENETUNREACH]: Network is unreachable (code=101)
Nov 27 05:08:22 004DD4RP38 ovpn-client[986]: TLS: tls_process: killed expiring key
Nov 27 05:08:27 004DD4RP38 ovpn-client[986]: read UDPv4 [ENETUNREACH]: Network is unreachable (code=101)
Nov 27 05:08:29 004DD4RP38 ovpn-client[986]: TLS: soft reset sec=0 bytes=36803/0 pkts=701/0
Nov 27 05:08:29 004DD4RP38 ovpn-client[986]: read UDPv4 [ENETUNREACH]: Network is unreachable (code=101)
Nov 27 05:08:31 004DD4RP38 ovpn-client[986]: read UDPv4 [ENETUNREACH]: Network is unreachable (code=101)
Nov 27 05:08:35 004DD4RP38 ovpn-client[986]: read UDPv4 [ENETUNREACH]: Network is unreachable (code=101)
Nov 27 05:08:43 004DD4RP38 ovpn-client[986]: read UDPv4 [ENETUNREACH]: Network is unreachable (code=101)
Nov 27 05:09:29 004DD4RP38 ovpn-client[986]: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Nov 27 05:09:29 004DD4RP38 ovpn-client[986]: TLS Error: TLS handshake failed
Nov 27 05:09:29 004DD4RP38 ovpn-client[986]: TLS: move_session: dest=TM_LAME_DUCK src=TM_ACTIVE reinit_src=1
Nov 27 05:09:44 004DD4RP38 ovpn-client[986]: TLS: Initial packet from [AF_INET]95.142.161.163:1194, sid=89b50e2f 51e926b7
Nov 27 05:09:44 004DD4RP38 ovpn-client[986]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Nov 27 05:09:48 004DD4RP38 ovpn-client[986]: VERIFY OK: depth=1, /C=FR/ST=isere/L=grenoble/O=my_name/OU=changeme/CN=cn/name=my_name/emailAddress=contact@my_server.com
Nov 27 05:09:48 004DD4RP38 ovpn-client[986]: VERIFY OK: nsCertType=SERVER
Nov 27 05:09:48 004DD4RP38 ovpn-client[986]: VERIFY OK: depth=0, /C=FR/ST=isere/L=grenoble/O=my_name/OU=changeme/CN=cn/name=my_name/emailAddress=contact@my_server.com
Nov 27 05:09:53 004DD4RP38 ovpn-client[986]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 05:09:53 004DD4RP38 ovpn-client[986]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 05:09:53 004DD4RP38 ovpn-client[986]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 05:09:53 004DD4RP38 ovpn-client[986]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 05:09:53 004DD4RP38 ovpn-client[986]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Nov 27 06:08:29 004DD4RP38 ovpn-client[986]: TLS: tls_multi_process: killed expiring key
Nov 27 06:09:53 004DD4RP38 ovpn-client[986]: TLS: soft reset sec=0 bytes=37169/0 pkts=708/0
Nov 27 06:09:53 004DD4RP38 ovpn-client[986]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Nov 27 06:09:57 004DD4RP38 ovpn-client[986]: VERIFY OK: depth=1, /C=FR/ST=isere/L=grenoble/O=my_name/OU=changeme/CN=cn/name=my_name/emailAddress=contact@my_server.com
Nov 27 06:09:57 004DD4RP38 ovpn-client[986]: VERIFY OK: nsCertType=SERVER
Nov 27 06:09:57 004DD4RP38 ovpn-client[986]: VERIFY OK: depth=0, /C=FR/ST=isere/L=grenoble/O=my_name/OU=changeme/CN=cn/name=my_name/emailAddress=contact@my_server.com
Nov 27 06:10:02 004DD4RP38 ovpn-client[986]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 06:10:02 004DD4RP38 ovpn-client[986]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 06:10:02 004DD4RP38 ovpn-client[986]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 06:10:02 004DD4RP38 ovpn-client[986]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 06:10:02 004DD4RP38 ovpn-client[986]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Nov 27 07:09:53 004DD4RP38 ovpn-client[986]: TLS: tls_process: killed expiring key
Nov 27 07:10:02 004DD4RP38 ovpn-client[986]: TLS: soft reset sec=0 bytes=37065/0 pkts=706/0
Nov 27 07:10:02 004DD4RP38 ovpn-client[986]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Nov 27 07:10:07 004DD4RP38 ovpn-client[986]: VERIFY OK: depth=1, /C=FR/ST=isere/L=grenoble/O=my_name/OU=changeme/CN=cn/name=my_name/emailAddress=contact@my_server.com
Nov 27 07:10:07 004DD4RP38 ovpn-client[986]: VERIFY OK: nsCertType=SERVER
Nov 27 07:10:07 004DD4RP38 ovpn-client[986]: VERIFY OK: depth=0, /C=FR/ST=isere/L=grenoble/O=my_name/OU=changeme/CN=cn/name=my_name/emailAddress=contact@my_server.com
Nov 27 07:10:12 004DD4RP38 ovpn-client[986]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 07:10:12 004DD4RP38 ovpn-client[986]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 07:10:12 004DD4RP38 ovpn-client[986]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 07:10:12 004DD4RP38 ovpn-client[986]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 07:10:12 004DD4RP38 ovpn-client[986]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Nov 27 08:10:02 004DD4RP38 ovpn-client[986]: TLS: tls_process: killed expiring key
Nov 27 08:10:12 004DD4RP38 ovpn-client[986]: TLS: soft reset sec=0 bytes=36907/0 pkts=703/0
Nov 27 08:10:12 004DD4RP38 ovpn-client[986]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Nov 27 08:10:17 004DD4RP38 ovpn-client[986]: VERIFY OK: depth=1, /C=FR/ST=isere/L=grenoble/O=my_name/OU=changeme/CN=cn/name=my_name/emailAddress=contact@my_server.com
Nov 27 08:10:17 004DD4RP38 ovpn-client[986]: VERIFY OK: nsCertType=SERVER
Nov 27 08:10:17 004DD4RP38 ovpn-client[986]: VERIFY OK: depth=0, /C=FR/ST=isere/L=grenoble/O=my_name/OU=changeme/CN=cn/name=my_name/emailAddress=contact@my_server.com
Nov 27 08:10:22 004DD4RP38 ovpn-client[986]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 08:10:22 004DD4RP38 ovpn-client[986]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 08:10:22 004DD4RP38 ovpn-client[986]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 08:10:22 004DD4RP38 ovpn-client[986]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 08:10:22 004DD4RP38 ovpn-client[986]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Nov 27 09:10:12 004DD4RP38 ovpn-client[986]: TLS: tls_process: killed expiring key
Nov 27 09:10:22 004DD4RP38 ovpn-client[986]: TLS: soft reset sec=0 bytes=37013/0 pkts=705/0
Nov 27 09:10:23 004DD4RP38 ovpn-client[986]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Nov 27 09:10:26 004DD4RP38 ovpn-client[986]: VERIFY OK: depth=1, /C=FR/ST=isere/L=grenoble/O=my_name/OU=changeme/CN=cn/name=my_name/emailAddress=contact@my_server.com
Nov 27 09:10:26 004DD4RP38 ovpn-client[986]: VERIFY OK: nsCertType=SERVER
Nov 27 09:10:26 004DD4RP38 ovpn-client[986]: VERIFY OK: depth=0, /C=FR/ST=isere/L=grenoble/O=my_name/OU=changeme/CN=cn/name=my_name/emailAddress=contact@my_server.com
Nov 27 09:10:30 004DD4RP38 ovpn-client[986]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 09:10:30 004DD4RP38 ovpn-client[986]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 09:10:30 004DD4RP38 ovpn-client[986]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 09:10:30 004DD4RP38 ovpn-client[986]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 09:10:30 004DD4RP38 ovpn-client[986]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Nov 27 10:10:22 004DD4RP38 ovpn-client[986]: TLS: tls_process: killed expiring key
Nov 27 10:10:30 004DD4RP38 ovpn-client[986]: TLS: soft reset sec=0 bytes=36802/0 pkts=701/0
Nov 27 10:10:30 004DD4RP38 ovpn-client[986]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Nov 27 10:10:34 004DD4RP38 ovpn-client[986]: VERIFY OK: depth=1, /C=FR/ST=isere/L=grenoble/O=my_name/OU=changeme/CN=cn/name=my_name/emailAddress=contact@my_server.com
Nov 27 10:10:34 004DD4RP38 ovpn-client[986]: VERIFY OK: nsCertType=SERVER
Nov 27 10:10:34 004DD4RP38 ovpn-client[986]: VERIFY OK: depth=0, /C=FR/ST=isere/L=grenoble/O=my_name/OU=changeme/CN=cn/name=my_name/emailAddress=contact@my_server.com
Nov 27 10:10:38 004DD4RP38 ovpn-client[986]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 10:10:38 004DD4RP38 ovpn-client[986]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 10:10:38 004DD4RP38 ovpn-client[986]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 10:10:38 004DD4RP38 ovpn-client[986]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 10:10:38 004DD4RP38 ovpn-client[986]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Nov 27 11:10:30 004DD4RP38 ovpn-client[986]: TLS: tls_process: killed expiring key
Nov 27 11:10:39 004DD4RP38 ovpn-client[986]: TLS: soft reset sec=-1 bytes=36908/0 pkts=703/0
Nov 27 11:10:39 004DD4RP38 ovpn-client[986]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Nov 27 11:10:43 004DD4RP38 ovpn-client[986]: VERIFY OK: depth=1, /C=FR/ST=isere/L=grenoble/O=my_name/OU=changeme/CN=cn/name=my_name/emailAddress=contact@my_server.com
Nov 27 11:10:43 004DD4RP38 ovpn-client[986]: VERIFY OK: nsCertType=SERVER
Nov 27 11:10:43 004DD4RP38 ovpn-client[986]: VERIFY OK: depth=0, /C=FR/ST=isere/L=grenoble/O=my_name/OU=changeme/CN=cn/name=my_name/emailAddress=contact@my_server.com
Nov 27 11:10:48 004DD4RP38 ovpn-client[986]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 11:10:48 004DD4RP38 ovpn-client[986]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 11:10:48 004DD4RP38 ovpn-client[986]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 11:10:48 004DD4RP38 ovpn-client[986]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 11:10:48 004DD4RP38 ovpn-client[986]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA

client 2 log:

Nov 27 09:29:27 004DD4RPX0 ovpn-client[985]: OpenVPN 2.1.3 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Jun  6 2013
Nov 27 09:29:27 004DD4RPX0 ovpn-client[985]: WARNING: file '/etc/openvpn/keys/kbox.crd' is group or others accessible
Nov 27 09:29:27 004DD4RPX0 ovpn-client[985]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Nov 27 09:29:27 004DD4RPX0 ovpn-client[985]: LZO compression initialized
Nov 27 09:29:27 004DD4RPX0 ovpn-client[985]: Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Nov 27 09:29:27 004DD4RPX0 ovpn-client[985]: Socket Buffers: R=[112640->131072] S=[112640->131072]
Nov 27 09:29:27 004DD4RPX0 ovpn-client[985]: Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Nov 27 09:29:27 004DD4RPX0 ovpn-client[985]: Local Options hash (VER=V4): '41690919'
Nov 27 09:29:27 004DD4RPX0 ovpn-client[985]: Expected Remote Options hash (VER=V4): '530fdded'
Nov 27 09:29:27 004DD4RPX0 ovpn-client[986]: UDPv4 link local: [undef]
Nov 27 09:29:27 004DD4RPX0 ovpn-client[986]: UDPv4 link remote: [AF_INET]95.142.161.163:1194
Nov 27 09:29:27 004DD4RPX0 ovpn-client[986]: TLS: Initial packet from [AF_INET]95.142.161.163:1194, sid=9ff42d21 e6be16b0
Nov 27 09:29:27 004DD4RPX0 ovpn-client[986]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Nov 27 09:29:27 004DD4RPX0 ovpn-client[986]: VERIFY OK: depth=1, /C=FR/ST=isere/L=grenoble/O=my_name/OU=changeme/CN=cn/name=my_name/emailAddress=contact@my_server.com
Nov 27 09:29:27 004DD4RPX0 ovpn-client[986]: VERIFY OK: nsCertType=SERVER
Nov 27 09:29:27 004DD4RPX0 ovpn-client[986]: VERIFY OK: depth=0, /C=FR/ST=isere/L=grenoble/O=my_name/OU=changeme/CN=cn/name=my_name/emailAddress=contact@my_server.com
Nov 27 09:29:30 004DD4RPX0 ovpn-client[986]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 09:29:30 004DD4RPX0 ovpn-client[986]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 09:29:30 004DD4RPX0 ovpn-client[986]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 09:29:30 004DD4RPX0 ovpn-client[986]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 09:29:30 004DD4RPX0 ovpn-client[986]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Nov 27 09:29:30 004DD4RPX0 ovpn-client[986]: [cn] Peer Connection Initiated with [AF_INET]95.142.161.163:1194
Nov 27 09:29:32 004DD4RPX0 ovpn-client[986]: SENT CONTROL [cn]: 'PUSH_REQUEST' (status=1)
Nov 27 09:29:32 004DD4RPX0 ovpn-client[986]: PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.14 10.8.0.13'
Nov 27 09:29:32 004DD4RPX0 ovpn-client[986]: OPTIONS IMPORT: timers and/or timeouts modified
Nov 27 09:29:32 004DD4RPX0 ovpn-client[986]: OPTIONS IMPORT: --ifconfig/up options modified
Nov 27 09:29:32 004DD4RPX0 ovpn-client[986]: OPTIONS IMPORT: route options modified
Nov 27 09:29:32 004DD4RPX0 ovpn-client[986]: ROUTE default_gateway=192.168.1.1
Nov 27 09:29:32 004DD4RPX0 ovpn-client[986]: TUN/TAP device tun0 opened
Nov 27 09:29:32 004DD4RPX0 ovpn-client[986]: TUN/TAP TX queue length set to 100
Nov 27 09:29:32 004DD4RPX0 ovpn-client[986]: /sbin/ifconfig tun0 10.8.0.14 pointopoint 10.8.0.13 mtu 1500
Nov 27 09:29:32 004DD4RPX0 ovpn-client[986]: /opt/my_script.sh tun0 1500 1542 10.8.0.14 10.8.0.13 init
Nov 27 09:29:37 004DD4RPX0 ovpn-client[986]: /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.13
Nov 27 09:29:37 004DD4RPX0 ovpn-client[986]: Initialization Sequence Completed
Nov 27 10:29:30 004DD4RPX0 ovpn-client[986]: TLS: soft reset sec=0 bytes=74492/0 pkts=924/0
Nov 27 10:29:30 004DD4RPX0 ovpn-client[986]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Nov 27 10:29:30 004DD4RPX0 ovpn-client[986]: VERIFY OK: depth=1, /C=FR/ST=isere/L=grenoble/O=my_name/OU=changeme/CN=cn/name=my_name/emailAddress=contact@my_server.com
Nov 27 10:29:30 004DD4RPX0 ovpn-client[986]: VERIFY OK: nsCertType=SERVER
Nov 27 10:29:30 004DD4RPX0 ovpn-client[986]: VERIFY OK: depth=0, /C=FR/ST=isere/L=grenoble/O=my_name/OU=changeme/CN=cn/name=my_name/emailAddress=contact@my_server.com
Nov 27 10:29:32 004DD4RPX0 ovpn-client[986]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 10:29:32 004DD4RPX0 ovpn-client[986]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 10:29:32 004DD4RPX0 ovpn-client[986]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 10:29:32 004DD4RPX0 ovpn-client[986]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 10:29:32 004DD4RPX0 ovpn-client[986]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Nov 27 11:29:30 004DD4RPX0 ovpn-client[986]: TLS: tls_process: killed expiring key
Nov 27 11:29:32 004DD4RPX0 ovpn-client[986]: TLS: soft reset sec=0 bytes=36907/0 pkts=703/0
Nov 27 11:29:32 004DD4RPX0 ovpn-client[986]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Nov 27 11:29:33 004DD4RPX0 ovpn-client[986]: VERIFY OK: depth=1, /C=FR/ST=isere/L=grenoble/O=my_name/OU=changeme/CN=cn/name=my_name/emailAddress=contact@my_server.com
Nov 27 11:29:33 004DD4RPX0 ovpn-client[986]: VERIFY OK: nsCertType=SERVER
Nov 27 11:29:33 004DD4RPX0 ovpn-client[986]: VERIFY OK: depth=0, /C=FR/ST=isere/L=grenoble/O=my_name/OU=changeme/CN=cn/name=my_name/emailAddress=contact@my_server.com
Nov 27 11:29:35 004DD4RPX0 ovpn-client[986]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 11:29:35 004DD4RPX0 ovpn-client[986]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 11:29:35 004DD4RPX0 ovpn-client[986]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 11:29:35 004DD4RPX0 ovpn-client[986]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 11:29:35 004DD4RPX0 ovpn-client[986]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA

server log:

Nov 27 01:07:54 my_server ovpn-server[12431]: 222.222.222.222:54439 TLS: Username/Password authentication succeeded for username 'client' [CN SET]
Nov 27 01:07:54 my_server ovpn-server[12431]: 222.222.222.222:54439 [client] Peer Connection Initiated with [AF_INET]222.222.222.222:54439
Nov 27 01:07:54 my_server ovpn-server[12431]: client/222.222.222.222:54439 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=d8a1:729a:a77f::
Nov 27 01:07:54 my_server ovpn-server[12431]: client/222.222.222.222:54439 MULTI: Learn: 10.8.0.6 -> client/222.222.222.222:54439
Nov 27 01:07:54 my_server ovpn-server[12431]: client/222.222.222.222:54439 MULTI: primary virtual IP for client/222.222.222.222:54439: 10.8.0.6
Nov 27 01:07:57 my_server ovpn-server[12431]: client/222.222.222.222:54439 PUSH: Received control message: 'PUSH_REQUEST'
Nov 27 01:07:57 my_server ovpn-server[12431]: client/222.222.222.222:54439 send_push_reply(): safe_cap=960
Nov 27 01:07:57 my_server ovpn-server[12431]: client/222.222.222.222:54439 SENT CONTROL [client]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Nov 27 01:08:04 my_server ovpn-server[12431]: 111.111.111.111:11375 TLS: Username/Password authentication succeeded for username 'client' [CN SET]
Nov 27 01:08:05 my_server ovpn-server[12431]: 111.111.111.111:11375 [client] Peer Connection Initiated with [AF_INET]111.111.111.111:11375
Nov 27 01:08:05 my_server ovpn-server[12431]: client/111.111.111.111:11375 MULTI_sva: pool returned IPv4=10.8.0.14, IPv6=98fb:469a:a77f::
Nov 27 01:08:05 my_server ovpn-server[12431]: client/111.111.111.111:11375 MULTI: Learn: 10.8.0.14 -> client/111.111.111.111:11375
Nov 27 01:08:05 my_server ovpn-server[12431]: client/111.111.111.111:11375 MULTI: primary virtual IP for client/111.111.111.111:11375: 10.8.0.14
Nov 27 01:08:07 my_server ovpn-server[12431]: client/111.111.111.111:11375 PUSH: Received control message: 'PUSH_REQUEST'
Nov 27 01:08:07 my_server ovpn-server[12431]: client/111.111.111.111:11375 send_push_reply(): safe_cap=960
Nov 27 01:08:07 my_server ovpn-server[12431]: client/111.111.111.111:11375 SENT CONTROL [client]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.14 10.8.0.13' (status=1)
Nov 27 01:09:32 my_server ovpn-server[12431]: client/222.222.222.222:37752 TLS: tls_process: killed expiring key
Nov 27 01:09:36 my_server ovpn-server[12431]: client/222.222.222.222:37752 TLS: soft reset sec=0 bytes=36233/0 pkts=690/0
Nov 27 01:10:36 my_server ovpn-server[12431]: client/222.222.222.222:37752 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Nov 27 01:10:36 my_server ovpn-server[12431]: client/222.222.222.222:37752 TLS Error: TLS handshake failed
Nov 27 01:10:36 my_server ovpn-server[12431]: client/222.222.222.222:37752 TLS: move_session: dest=TM_LAME_DUCK src=TM_ACTIVE reinit_src=1
Nov 27 01:10:55 my_server ovpn-server[12431]: client/222.222.222.222:37752 [UNDEF] Inactivity timeout (--ping-restart), restarting
Nov 27 01:10:55 my_server ovpn-server[12431]: client/222.222.222.222:37752 SIGUSR1[soft,ping-restart] received, client-instance restarting
Nov 27 01:11:00 my_server ovpn-server[12431]: client/111.111.111.111:28813 [client] Inactivity timeout (--ping-restart), restarting
Nov 27 01:11:00 my_server ovpn-server[12431]: client/111.111.111.111:28813 SIGUSR1[soft,ping-restart] received, client-instance restarting
Nov 27 02:07:54 my_server ovpn-server[12431]: client/222.222.222.222:54439 TLS: soft reset sec=0 bytes=37643/0 pkts=717/0
Nov 27 02:07:56 my_server ovpn-server[12431]: client/222.222.222.222:54439 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Nov 27 02:07:56 my_server ovpn-server[12431]: client/222.222.222.222:54439 TLS: Username/Password authentication succeeded for username 'client' [CN SET]
Nov 27 02:07:56 my_server ovpn-server[12431]: client/222.222.222.222:54439 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 02:07:56 my_server ovpn-server[12431]: client/222.222.222.222:54439 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 02:07:56 my_server ovpn-server[12431]: client/222.222.222.222:54439 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 02:07:56 my_server ovpn-server[12431]: client/222.222.222.222:54439 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 02:07:56 my_server ovpn-server[12431]: client/222.222.222.222:54439 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Nov 27 02:08:12 my_server ovpn-server[12431]: client/111.111.111.111:11375 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Nov 27 02:08:12 my_server ovpn-server[12431]: client/111.111.111.111:11375 TLS: Username/Password authentication succeeded for username 'client' [CN SET]
Nov 27 02:08:12 my_server ovpn-server[12431]: client/111.111.111.111:11375 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 02:08:12 my_server ovpn-server[12431]: client/111.111.111.111:11375 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 02:08:12 my_server ovpn-server[12431]: client/111.111.111.111:11375 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 02:08:12 my_server ovpn-server[12431]: client/111.111.111.111:11375 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 02:08:12 my_server ovpn-server[12431]: client/111.111.111.111:11375 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Nov 27 03:07:55 my_server ovpn-server[12431]: client/222.222.222.222:54439 TLS: tls_process: killed expiring key
Nov 27 03:07:56 my_server ovpn-server[12431]: client/222.222.222.222:54439 TLS: soft reset sec=0 bytes=37118/0 pkts=707/0
Nov 27 03:07:58 my_server ovpn-server[12431]: client/222.222.222.222:54439 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Nov 27 03:07:58 my_server ovpn-server[12431]: client/222.222.222.222:54439 TLS: Username/Password authentication succeeded for username 'client' [CN SET]
Nov 27 03:07:58 my_server ovpn-server[12431]: client/222.222.222.222:54439 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 03:07:58 my_server ovpn-server[12431]: client/222.222.222.222:54439 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 03:07:58 my_server ovpn-server[12431]: client/222.222.222.222:54439 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 03:07:58 my_server ovpn-server[12431]: client/222.222.222.222:54439 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 03:07:58 my_server ovpn-server[12431]: client/222.222.222.222:54439 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Nov 27 03:08:04 my_server ovpn-server[12431]: client/111.111.111.111:11375 TLS: tls_process: killed expiring key
Nov 27 03:08:12 my_server ovpn-server[12431]: client/111.111.111.111:11375 TLS: soft reset sec=0 bytes=36961/0 pkts=704/0
Nov 27 03:08:20 my_server ovpn-server[12431]: client/111.111.111.111:11375 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Nov 27 03:08:20 my_server ovpn-server[12431]: client/111.111.111.111:11375 TLS: Username/Password authentication succeeded for username 'client' [CN SET]
Nov 27 03:08:20 my_server ovpn-server[12431]: client/111.111.111.111:11375 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 03:08:20 my_server ovpn-server[12431]: client/111.111.111.111:11375 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 03:08:20 my_server ovpn-server[12431]: client/111.111.111.111:11375 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 03:08:20 my_server ovpn-server[12431]: client/111.111.111.111:11375 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 03:08:21 my_server ovpn-server[12431]: client/111.111.111.111:11375 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Nov 27 03:31:53 my_server ovpn-server[12431]: client/222.222.222.222:54439 [client] Inactivity timeout (--ping-restart), restarting
Nov 27 03:31:53 my_server ovpn-server[12431]: client/222.222.222.222:54439 SIGUSR1[soft,ping-restart] received, client-instance restarting
Nov 27 03:33:48 my_server ovpn-server[12431]: 222.222.222.222:46945 TLS: Username/Password authentication succeeded for username 'client' [CN SET]
Nov 27 03:33:48 my_server ovpn-server[12431]: 222.222.222.222:46945 [client] Peer Connection Initiated with [AF_INET]222.222.222.222:46945
Nov 27 03:33:48 my_server ovpn-server[12431]: client/222.222.222.222:46945 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=58a8:39a:a77f::
Nov 27 03:33:48 my_server ovpn-server[12431]: client/222.222.222.222:46945 MULTI: Learn: 10.8.0.6 -> client/222.222.222.222:46945
Nov 27 03:33:48 my_server ovpn-server[12431]: client/222.222.222.222:46945 MULTI: primary virtual IP for client/222.222.222.222:46945: 10.8.0.6
Nov 27 03:33:51 my_server ovpn-server[12431]: client/222.222.222.222:46945 PUSH: Received control message: 'PUSH_REQUEST'
Nov 27 03:33:51 my_server ovpn-server[12431]: client/222.222.222.222:46945 send_push_reply(): safe_cap=960
Nov 27 03:33:51 my_server ovpn-server[12431]: client/222.222.222.222:46945 SENT CONTROL [client]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Nov 27 04:08:12 my_server ovpn-server[12431]: client/111.111.111.111:11375 TLS: tls_process: killed expiring key
Nov 27 04:08:21 my_server ovpn-server[12431]: client/111.111.111.111:11375 TLS: soft reset sec=0 bytes=36804/0 pkts=701/0
Nov 27 04:08:29 my_server ovpn-server[12431]: client/111.111.111.111:11375 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Nov 27 04:08:29 my_server ovpn-server[12431]: client/111.111.111.111:11375 TLS: Username/Password authentication succeeded for username 'client' [CN SET]
Nov 27 04:08:29 my_server ovpn-server[12431]: client/111.111.111.111:11375 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 04:08:29 my_server ovpn-server[12431]: client/111.111.111.111:11375 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 04:08:29 my_server ovpn-server[12431]: client/111.111.111.111:11375 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 04:08:29 my_server ovpn-server[12431]: client/111.111.111.111:11375 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 04:08:30 my_server ovpn-server[12431]: client/111.111.111.111:11375 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Nov 27 04:33:48 my_server ovpn-server[12431]: client/222.222.222.222:46945 TLS: soft reset sec=0 bytes=37695/0 pkts=718/0
Nov 27 04:33:50 my_server ovpn-server[12431]: client/222.222.222.222:46945 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Nov 27 04:33:50 my_server ovpn-server[12431]: client/222.222.222.222:46945 TLS: Username/Password authentication succeeded for username 'client' [CN SET]
Nov 27 04:33:50 my_server ovpn-server[12431]: client/222.222.222.222:46945 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 04:33:50 my_server ovpn-server[12431]: client/222.222.222.222:46945 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 04:33:50 my_server ovpn-server[12431]: client/222.222.222.222:46945 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 04:33:50 my_server ovpn-server[12431]: client/222.222.222.222:46945 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 04:33:50 my_server ovpn-server[12431]: client/222.222.222.222:46945 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Nov 27 05:08:21 my_server ovpn-server[12431]: client/111.111.111.111:11375 TLS: tls_process: killed expiring key
Nov 27 05:08:30 my_server ovpn-server[12431]: client/111.111.111.111:11375 TLS: soft reset sec=0 bytes=36805/0 pkts=701/0
Nov 27 05:09:30 my_server ovpn-server[12431]: client/111.111.111.111:11375 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Nov 27 05:09:30 my_server ovpn-server[12431]: client/111.111.111.111:11375 TLS Error: TLS handshake failed
Nov 27 05:09:30 my_server ovpn-server[12431]: client/111.111.111.111:11375 TLS: move_session: dest=TM_LAME_DUCK src=TM_ACTIVE reinit_src=1
Nov 27 05:09:53 my_server ovpn-server[12431]: 90.84.144.206:29340 TLS: Username/Password authentication succeeded for username 'client' [CN SET]
Nov 27 05:09:54 my_server ovpn-server[12431]: 90.84.144.206:29340 [client] Peer Connection Initiated with [AF_INET]90.84.144.206:29340
Nov 27 05:09:54 my_server ovpn-server[12431]: client/90.84.144.206:29340 MULTI_sva: pool returned IPv4=10.8.0.10, IPv6=d824:5e9a:a77f::
Nov 27 05:09:54 my_server ovpn-server[12431]: client/90.84.144.206:29340 MULTI: Learn: 10.8.0.10 -> client/90.84.144.206:29340
Nov 27 05:09:54 my_server ovpn-server[12431]: client/90.84.144.206:29340 MULTI: primary virtual IP for client/90.84.144.206:29340: 10.8.0.10
Nov 27 05:10:03 my_server ovpn-server[12431]: client/90.84.144.206:29340 TLS Error: local/remote TLS keys are out of sync: [AF_INET]90.84.144.206:29340 [3]
Nov 27 05:10:13 my_server ovpn-server[12431]: client/90.84.144.206:29340 TLS Error: local/remote TLS keys are out of sync: [AF_INET]90.84.144.206:29340 [3]
Nov 27 05:10:23 my_server ovpn-server[12431]: client/90.84.144.206:29340 TLS Error: local/remote TLS keys are out of sync: [AF_INET]90.84.144.206:29340 [3]
Nov 27 05:10:33 my_server ovpn-server[12431]: client/90.84.144.206:29340 TLS Error: local/remote TLS keys are out of sync: [AF_INET]90.84.144.206:29340 [3]
Nov 27 05:10:43 my_server ovpn-server[12431]: client/90.84.144.206:29340 TLS Error: local/remote TLS keys are out of sync: [AF_INET]90.84.144.206:29340 [3]
Nov 27 05:10:45 my_server ovpn-server[12431]: client/111.111.111.111:11375 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Nov 27 05:10:45 my_server ovpn-server[12431]: client/111.111.111.111:11375 TLS Error: TLS handshake failed
Nov 27 05:11:57 my_server ovpn-server[12431]: client/111.111.111.111:11375 [UNDEF] Inactivity timeout (--ping-restart), restarting
Nov 27 05:11:57 my_server ovpn-server[12431]: client/111.111.111.111:11375 SIGUSR1[soft,ping-restart] received, client-instance restarting
Nov 27 05:33:48 my_server ovpn-server[12431]: client/222.222.222.222:46945 TLS: tls_process: killed expiring key
Nov 27 05:33:51 my_server ovpn-server[12431]: client/222.222.222.222:46945 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Nov 27 05:33:51 my_server ovpn-server[12431]: client/222.222.222.222:46945 TLS: Username/Password authentication succeeded for username 'client' [CN SET]
Nov 27 05:33:51 my_server ovpn-server[12431]: client/222.222.222.222:46945 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 05:33:51 my_server ovpn-server[12431]: client/222.222.222.222:46945 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 05:33:51 my_server ovpn-server[12431]: client/222.222.222.222:46945 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 05:33:51 my_server ovpn-server[12431]: client/222.222.222.222:46945 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 05:33:52 my_server ovpn-server[12431]: client/222.222.222.222:46945 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Nov 27 06:10:02 my_server ovpn-server[12431]: client/90.84.144.206:29340 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Nov 27 06:10:02 my_server ovpn-server[12431]: client/90.84.144.206:29340 TLS: Username/Password authentication succeeded for username 'client' [CN SET]
Nov 27 06:10:02 my_server ovpn-server[12431]: client/90.84.144.206:29340 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 06:10:02 my_server ovpn-server[12431]: client/90.84.144.206:29340 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 06:10:02 my_server ovpn-server[12431]: client/90.84.144.206:29340 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 06:10:02 my_server ovpn-server[12431]: client/90.84.144.206:29340 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 06:10:03 my_server ovpn-server[12431]: client/90.84.144.206:29340 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Nov 27 06:33:50 my_server ovpn-server[12431]: client/222.222.222.222:46945 TLS: tls_process: killed expiring key
Nov 27 06:33:53 my_server ovpn-server[12431]: client/222.222.222.222:46945 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Nov 27 06:33:53 my_server ovpn-server[12431]: client/222.222.222.222:46945 TLS: Username/Password authentication succeeded for username 'client' [CN SET]
Nov 27 06:33:53 my_server ovpn-server[12431]: client/222.222.222.222:46945 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 06:33:53 my_server ovpn-server[12431]: client/222.222.222.222:46945 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 06:33:53 my_server ovpn-server[12431]: client/222.222.222.222:46945 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 06:33:53 my_server ovpn-server[12431]: client/222.222.222.222:46945 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 06:33:53 my_server ovpn-server[12431]: client/222.222.222.222:46945 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Nov 27 07:09:53 my_server ovpn-server[12431]: client/90.84.144.206:29340 TLS: tls_process: killed expiring key
Nov 27 07:10:12 my_server ovpn-server[12431]: client/90.84.144.206:29340 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Nov 27 07:10:12 my_server ovpn-server[12431]: client/90.84.144.206:29340 TLS: Username/Password authentication succeeded for username 'client' [CN SET]
Nov 27 07:10:12 my_server ovpn-server[12431]: client/90.84.144.206:29340 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 07:10:12 my_server ovpn-server[12431]: client/90.84.144.206:29340 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 07:10:12 my_server ovpn-server[12431]: client/90.84.144.206:29340 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 07:10:12 my_server ovpn-server[12431]: client/90.84.144.206:29340 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 07:10:13 my_server ovpn-server[12431]: client/90.84.144.206:29340 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Nov 27 07:33:51 my_server ovpn-server[12431]: client/222.222.222.222:46945 TLS: tls_process: killed expiring key
Nov 27 07:33:53 my_server ovpn-server[12431]: client/222.222.222.222:46945 TLS: soft reset sec=0 bytes=37170/0 pkts=708/0
Nov 27 07:33:55 my_server ovpn-server[12431]: client/222.222.222.222:46945 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Nov 27 07:33:55 my_server ovpn-server[12431]: client/222.222.222.222:46945 TLS: Username/Password authentication succeeded for username 'client' [CN SET]
Nov 27 07:33:55 my_server ovpn-server[12431]: client/222.222.222.222:46945 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 07:33:55 my_server ovpn-server[12431]: client/222.222.222.222:46945 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 07:33:55 my_server ovpn-server[12431]: client/222.222.222.222:46945 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 07:33:55 my_server ovpn-server[12431]: client/222.222.222.222:46945 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 07:33:55 my_server ovpn-server[12431]: client/222.222.222.222:46945 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Nov 27 08:10:03 my_server ovpn-server[12431]: client/90.84.144.206:29340 TLS: tls_process: killed expiring key
Nov 27 08:10:22 my_server ovpn-server[12431]: client/90.84.144.206:29340 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Nov 27 08:10:22 my_server ovpn-server[12431]: client/90.84.144.206:29340 TLS: Username/Password authentication succeeded for username 'client' [CN SET]
Nov 27 08:10:22 my_server ovpn-server[12431]: client/90.84.144.206:29340 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 08:10:22 my_server ovpn-server[12431]: client/90.84.144.206:29340 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 08:10:22 my_server ovpn-server[12431]: client/90.84.144.206:29340 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 08:10:22 my_server ovpn-server[12431]: client/90.84.144.206:29340 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 08:10:22 my_server ovpn-server[12431]: client/90.84.144.206:29340 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Nov 27 08:33:53 my_server ovpn-server[12431]: client/222.222.222.222:46945 TLS: tls_process: killed expiring key
Nov 27 08:33:56 my_server ovpn-server[12431]: client/222.222.222.222:46945 TLS: soft reset sec=-1 bytes=37014/0 pkts=705/0
Nov 27 08:33:57 my_server ovpn-server[12431]: client/222.222.222.222:46945 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Nov 27 08:33:57 my_server ovpn-server[12431]: client/222.222.222.222:46945 TLS: Username/Password authentication succeeded for username 'client' [CN SET]
Nov 27 08:33:57 my_server ovpn-server[12431]: client/222.222.222.222:46945 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 08:33:57 my_server ovpn-server[12431]: client/222.222.222.222:46945 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 08:33:57 my_server ovpn-server[12431]: client/222.222.222.222:46945 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 08:33:57 my_server ovpn-server[12431]: client/222.222.222.222:46945 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 08:33:57 my_server ovpn-server[12431]: client/222.222.222.222:46945 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Nov 27 09:10:12 my_server ovpn-server[12431]: client/90.84.144.206:29340 TLS: tls_process: killed expiring key
Nov 27 09:10:22 my_server ovpn-server[12431]: client/90.84.144.206:29340 TLS: soft reset sec=0 bytes=36962/0 pkts=704/0
Nov 27 09:10:30 my_server ovpn-server[12431]: client/90.84.144.206:29340 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Nov 27 09:10:30 my_server ovpn-server[12431]: client/90.84.144.206:29340 TLS: Username/Password authentication succeeded for username 'client' [CN SET]
Nov 27 09:10:30 my_server ovpn-server[12431]: client/90.84.144.206:29340 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 09:10:30 my_server ovpn-server[12431]: client/90.84.144.206:29340 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 09:10:30 my_server ovpn-server[12431]: client/90.84.144.206:29340 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 09:10:30 my_server ovpn-server[12431]: client/90.84.144.206:29340 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 09:10:31 my_server ovpn-server[12431]: client/90.84.144.206:29340 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Nov 27 09:29:30 my_server ovpn-server[12431]: 222.222.222.222:57752 TLS: Username/Password authentication succeeded for username 'client' [CN SET]
Nov 27 09:29:30 my_server ovpn-server[12431]: 222.222.222.222:57752 [client] Peer Connection Initiated with [AF_INET]222.222.222.222:57752
Nov 27 09:29:30 my_server ovpn-server[12431]: client/222.222.222.222:57752 MULTI_sva: pool returned IPv4=10.8.0.14, IPv6=a882:3a9a:a77f::
Nov 27 09:29:30 my_server ovpn-server[12431]: client/222.222.222.222:57752 MULTI: Learn: 10.8.0.14 -> client/222.222.222.222:57752
Nov 27 09:29:30 my_server ovpn-server[12431]: client/222.222.222.222:57752 MULTI: primary virtual IP for client/222.222.222.222:57752: 10.8.0.14
Nov 27 09:29:32 my_server ovpn-server[12431]: client/222.222.222.222:57752 PUSH: Received control message: 'PUSH_REQUEST'
Nov 27 09:29:32 my_server ovpn-server[12431]: client/222.222.222.222:57752 send_push_reply(): safe_cap=960
Nov 27 09:29:32 my_server ovpn-server[12431]: client/222.222.222.222:57752 SENT CONTROL [client]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.14 10.8.0.13' (status=1)
Nov 27 09:29:49 my_server ovpn-server[12431]: 222.222.222.222:58325 TLS: Username/Password authentication succeeded for username 'client' [CN SET]
Nov 27 09:29:49 my_server ovpn-server[12431]: 222.222.222.222:58325 [client] Peer Connection Initiated with [AF_INET]222.222.222.222:58325
Nov 27 09:29:49 my_server ovpn-server[12431]: client/222.222.222.222:58325 MULTI_sva: pool returned IPv4=10.8.0.18, IPv6=1858:5e9a:a77f::
Nov 27 09:29:49 my_server ovpn-server[12431]: client/222.222.222.222:58325 MULTI: Learn: 10.8.0.18 -> client/222.222.222.222:58325
Nov 27 09:29:49 my_server ovpn-server[12431]: client/222.222.222.222:58325 MULTI: primary virtual IP for client/222.222.222.222:58325: 10.8.0.18
Nov 27 09:29:51 my_server ovpn-server[12431]: client/222.222.222.222:58325 PUSH: Received control message: 'PUSH_REQUEST'
Nov 27 09:29:51 my_server ovpn-server[12431]: client/222.222.222.222:58325 send_push_reply(): safe_cap=960
Nov 27 09:29:51 my_server ovpn-server[12431]: client/222.222.222.222:58325 SENT CONTROL [client]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.18 10.8.0.17' (status=1)
Nov 27 09:32:38 my_server ovpn-server[12431]: client/222.222.222.222:46945 [client] Inactivity timeout (--ping-restart), restarting
Nov 27 09:32:38 my_server ovpn-server[12431]: client/222.222.222.222:46945 SIGUSR1[soft,ping-restart] received, client-instance restarting
Nov 27 10:10:22 my_server ovpn-server[12431]: client/90.84.144.206:29340 TLS: tls_process: killed expiring key
Nov 27 10:10:38 my_server ovpn-server[12431]: client/90.84.144.206:29340 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Nov 27 10:10:38 my_server ovpn-server[12431]: client/90.84.144.206:29340 TLS: Username/Password authentication succeeded for username 'client' [CN SET]
Nov 27 10:10:38 my_server ovpn-server[12431]: client/90.84.144.206:29340 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 10:10:38 my_server ovpn-server[12431]: client/90.84.144.206:29340 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 10:10:38 my_server ovpn-server[12431]: client/90.84.144.206:29340 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 10:10:38 my_server ovpn-server[12431]: client/90.84.144.206:29340 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 10:10:39 my_server ovpn-server[12431]: client/90.84.144.206:29340 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Nov 27 10:29:32 my_server ovpn-server[12431]: client/222.222.222.222:57752 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Nov 27 10:29:32 my_server ovpn-server[12431]: client/222.222.222.222:57752 TLS: Username/Password authentication succeeded for username 'client' [CN SET]
Nov 27 10:29:32 my_server ovpn-server[12431]: client/222.222.222.222:57752 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 10:29:32 my_server ovpn-server[12431]: client/222.222.222.222:57752 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 10:29:32 my_server ovpn-server[12431]: client/222.222.222.222:57752 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 10:29:32 my_server ovpn-server[12431]: client/222.222.222.222:57752 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 10:29:32 my_server ovpn-server[12431]: client/222.222.222.222:57752 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Nov 27 10:29:49 my_server ovpn-server[12431]: client/222.222.222.222:58325 TLS: soft reset sec=0 bytes=74926/0 pkts=926/0
Nov 27 10:29:49 my_server ovpn-server[12431]: client/222.222.222.222:58325 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Nov 27 10:29:49 my_server ovpn-server[12431]: client/222.222.222.222:58325 TLS: Username/Password authentication succeeded for username 'client' [CN SET]
Nov 27 10:29:49 my_server ovpn-server[12431]: client/222.222.222.222:58325 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 10:29:49 my_server ovpn-server[12431]: client/222.222.222.222:58325 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 10:29:49 my_server ovpn-server[12431]: client/222.222.222.222:58325 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 10:29:49 my_server ovpn-server[12431]: client/222.222.222.222:58325 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 10:29:49 my_server ovpn-server[12431]: client/222.222.222.222:58325 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Nov 27 11:10:30 my_server ovpn-server[12431]: client/90.84.144.206:29340 TLS: tls_process: killed expiring key
Nov 27 11:10:48 my_server ovpn-server[12431]: client/90.84.144.206:29340 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Nov 27 11:10:48 my_server ovpn-server[12431]: client/90.84.144.206:29340 TLS: Username/Password authentication succeeded for username 'client' [CN SET]
Nov 27 11:10:48 my_server ovpn-server[12431]: client/90.84.144.206:29340 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 11:10:48 my_server ovpn-server[12431]: client/90.84.144.206:29340 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 11:10:48 my_server ovpn-server[12431]: client/90.84.144.206:29340 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 11:10:48 my_server ovpn-server[12431]: client/90.84.144.206:29340 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 11:10:48 my_server ovpn-server[12431]: client/90.84.144.206:29340 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Nov 27 11:29:30 my_server ovpn-server[12431]: client/222.222.222.222:57752 TLS: tls_process: killed expiring key
Nov 27 11:29:35 my_server ovpn-server[12431]: client/222.222.222.222:57752 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Nov 27 11:29:35 my_server ovpn-server[12431]: client/222.222.222.222:57752 TLS: Username/Password authentication succeeded for username 'client' [CN SET]
Nov 27 11:29:35 my_server ovpn-server[12431]: client/222.222.222.222:57752 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 11:29:35 my_server ovpn-server[12431]: client/222.222.222.222:57752 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 11:29:35 my_server ovpn-server[12431]: client/222.222.222.222:57752 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 11:29:35 my_server ovpn-server[12431]: client/222.222.222.222:57752 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 11:29:35 my_server ovpn-server[12431]: client/222.222.222.222:57752 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Nov 27 11:29:50 my_server ovpn-server[12431]: client/222.222.222.222:58325 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Nov 27 11:29:50 my_server ovpn-server[12431]: client/222.222.222.222:58325 TLS: Username/Password authentication succeeded for username 'client' [CN SET]
Nov 27 11:29:50 my_server ovpn-server[12431]: client/222.222.222.222:58325 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 11:29:50 my_server ovpn-server[12431]: client/222.222.222.222:58325 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 11:29:50 my_server ovpn-server[12431]: client/222.222.222.222:58325 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 27 11:29:50 my_server ovpn-server[12431]: client/222.222.222.222:58325 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 27 11:29:50 my_server ovpn-server[12431]: client/222.222.222.222:58325 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA

nicolas.cardoso

The content of a typical file in the '/etc/openvpn/ccd' folder (using the username as the filename):

ifconfig-push 10.8.0.xxx 10.8.0.yyy

where yyy=xxx+1

There are 4 of these files. The addresses set in these files are:
10.8.0.50
10.8.0.100
10.8.0.102
10.8.0.104
and their +1.

nicolas.cardoso

So your yyy=xxx+1 should be xxx=yyy+1

I don't get it, you're telling me that the static IPs should be odd and not even ? What difference does it make ?

However, you say that the server generally sets unique IPs for clients.

Yes, because there is not config file in the ccd folder related to the machine clients. I'm only interested in having static IPs for human clients.

However, it seems to me that making your cert/keys unique to each machine would solve
the issue once and for all.

Yes, I am aware of that fact, but the reason why I'm am using deprecated OpenVPN server option (duplicate-cn) is to meet some constraints. My question was to know if there is a way to force the server to check the clients real IPs, but I am open to a different server configuration that would meet my constraints:
- let human clients connect to the VPN using their username/password from the server machine (pam option), getting static IPs
- let several machine clients connect to the VPN with a single username/password OR a single private key, getting each an IP not already in use (I don't need it to be static)
- all the machine clients must hold the same auth files, there will be dozens of them in a near future, and their code is identically copied to each machine, to speed up deployment, and I can't afford to create a user on the server side each time I add a machine client to the network, or to generate myself a specific key for each machine (if one thinks of an automatic procedure between the server and the client run once at the first client connection that would produce specific key files and for future connections, that might be a solution).

nicolas.cardoso

what do you think will happen when a user logs in more than once ?

Example:

user 1 logs into computer A and gets IP x.x.x.101
user 2 logs into computer B and gets IP x.x.x.102
user 3 logs into computer C and gets IP x.x.x.103
user 1 logs into computer D and gets IP x.x.x.101 <-Oh dear

Well, I haven't tested that, but human clients are not supposed to log more than once (this is reserved for machine clients, which do not have static IPs in the ccd folder), I assume that the connection with computer A is shut down, but even if there is a problem in that case, I don't really care, human clients are told to log only once.

I think I'm going to set up a script in the server side that received from the machine clients the IPs that are really set, and compare them to the IPs that the server last assign them, if they are different, I could for instance request an IP renewal at the server for a particular client. How can I do such IP renewal request ?