I am setting up a VPN to allow some of our staff to access a subset of our network services while off site. To guard against malicious software, only devices which are members of our Active Directory domain should be able to access the VPN, therefore I require authentication to be performed using the computer's certificate, which is stored in the computer's certificate store. I will also require secondary authentication using username/password (or preferably user certificate/password), but my priority now is to get the computer authentication working.
I also require end users to have control (connect/disconnect) of the VPN as they will be using their provided laptop both on site and off, and I'd rather they not have to VPN in while on site. For security reasons, none of the users have admin rights.
I have set the OpenVPN "service_only" registry key and given service control (Start, stop and pause) to the Faculty AD group (of which my test user is a member). My test user is using the OpenVPN GUI (v5) to start the service, however when they do the connection fails with the error below, suggesting the private key cannot be read.
Cannot load certificate "SUBJ:S-LT-028.domain.tld" from Microsoft Certificate Store: error:C5066064:microsoft cryptoapi:CryptAcquireCertificatePrivateKey:Keyset does not exist
Yet the service is configured to run as SYSTEM, which does have access to the certificate's private key (confirmed by the fact that the connection is successful when the service is configured to start automatically), and so my understanding is that this should work as the security context of the restricted user is only being used to start the service, not to run it. If I grant the user access to the computer's private key, the connection is made successfully, however giving the user access to the computer's private key seems like a bad idea, and I'm also not certain this can be done via Group Policy.
Why is OpenVPN using the access rights/security context of the controlling user to access the private key rather than the service user (SYSTEM), and how can I configure this so it works as described above?
Thanks in advance for any help you can provide.
Configuration
Server: Debian Wheezy: OpenVPN 2.2.1 amd64
Client: Windows 7 Enterprise SP1: OpenVPN 2.3.4 i686
Most security options have been disabled while testing
Server
port 1194
proto tcp
dev tun0
ca /etc/openvpn/ca.pem
cert /etc/openvpn/vpn.crt
key /etc/openvpn/vpn.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
route 10.8.1.0 255.255.255.252
push "dhcp-option DNS 10.8.0.1"
keepalive 10 120
max-clients 10
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 4
Client
client
dev tun
proto tcp
remote vpn.domain.tld 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cryptoapicert "SUBJ:S-LT-028.domain.tld"
verb 4
Logs
Server
May 15 15:31:32 packdeploy ovpn-server[24892]: Current Parameter Settings:
May 15 15:31:32 packdeploy ovpn-server[24892]: config = '/etc/openvpn/server.conf'
May 15 15:31:32 packdeploy ovpn-server[24892]: mode = 1
May 15 15:31:32 packdeploy ovpn-server[24892]: persist_config = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: persist_mode = 1
May 15 15:31:32 packdeploy ovpn-server[24892]: show_ciphers = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: show_digests = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: show_engines = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: genkey = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: key_pass_file = '[UNDEF]'
May 15 15:31:32 packdeploy ovpn-server[24892]: show_tls_ciphers = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: Connection profiles [default]:
May 15 15:31:32 packdeploy ovpn-server[24892]: proto = tcp-server
May 15 15:31:32 packdeploy ovpn-server[24892]: local = '[UNDEF]'
May 15 15:31:32 packdeploy ovpn-server[24892]: local_port = 1194
May 15 15:31:32 packdeploy ovpn-server[24892]: remote = '[UNDEF]'
May 15 15:31:32 packdeploy ovpn-server[24892]: remote_port = 1194
May 15 15:31:32 packdeploy ovpn-server[24892]: remote_float = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: bind_defined = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: bind_local = ENABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: connect_retry_seconds = 5
May 15 15:31:32 packdeploy ovpn-server[24892]: connect_timeout = 10
May 15 15:31:32 packdeploy ovpn-server[24892]: connect_retry_max = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: socks_proxy_server = '[UNDEF]'
May 15 15:31:32 packdeploy ovpn-server[24892]: socks_proxy_port = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: socks_proxy_retry = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: Connection profiles END
May 15 15:31:32 packdeploy ovpn-server[24892]: remote_random = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: ipchange = '[UNDEF]'
May 15 15:31:32 packdeploy ovpn-server[24892]: dev = 'tun0'
May 15 15:31:32 packdeploy ovpn-server[24892]: dev_type = '[UNDEF]'
May 15 15:31:32 packdeploy ovpn-server[24892]: dev_node = '[UNDEF]'
May 15 15:31:32 packdeploy ovpn-server[24892]: lladdr = '[UNDEF]'
May 15 15:31:32 packdeploy ovpn-server[24892]: topology = 1
May 15 15:31:32 packdeploy ovpn-server[24892]: tun_ipv6 = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: ifconfig_local = '10.8.0.1'
May 15 15:31:32 packdeploy ovpn-server[24892]: ifconfig_remote_netmask = '10.8.0.2'
May 15 15:31:32 packdeploy ovpn-server[24892]: ifconfig_noexec = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: ifconfig_nowarn = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: ifconfig_ipv6_local = '[UNDEF]'
May 15 15:31:32 packdeploy ovpn-server[24892]: ifconfig_ipv6_netbits = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: ifconfig_ipv6_remote = '[UNDEF]'
May 15 15:31:32 packdeploy ovpn-server[24892]: shaper = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: tun_mtu = 1500
May 15 15:31:32 packdeploy ovpn-server[24892]: tun_mtu_defined = ENABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: link_mtu = 1500
May 15 15:31:32 packdeploy ovpn-server[24892]: link_mtu_defined = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: tun_mtu_extra = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: tun_mtu_extra_defined = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: fragment = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: mtu_discover_type = -1
May 15 15:31:32 packdeploy ovpn-server[24892]: mtu_test = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: mlock = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: keepalive_ping = 10
May 15 15:31:32 packdeploy ovpn-server[24892]: keepalive_timeout = 120
May 15 15:31:32 packdeploy ovpn-server[24892]: inactivity_timeout = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: ping_send_timeout = 10
May 15 15:31:32 packdeploy ovpn-server[24892]: ping_rec_timeout = 240
May 15 15:31:32 packdeploy ovpn-server[24892]: ping_rec_timeout_action = 2
May 15 15:31:32 packdeploy ovpn-server[24892]: ping_timer_remote = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: remap_sigusr1 = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: explicit_exit_notification = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: persist_tun = ENABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: persist_local_ip = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: persist_remote_ip = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: persist_key = ENABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: mssfix = 1450
May 15 15:31:32 packdeploy ovpn-server[24892]: passtos = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: resolve_retry_seconds = 1000000000
May 15 15:31:32 packdeploy ovpn-server[24892]: username = 'nobody'
May 15 15:31:32 packdeploy ovpn-server[24892]: groupname = 'nogroup'
May 15 15:31:32 packdeploy ovpn-server[24892]: chroot_dir = '[UNDEF]'
May 15 15:31:32 packdeploy ovpn-server[24892]: cd_dir = '/etc/openvpn'
May 15 15:31:32 packdeploy ovpn-server[24892]: writepid = '/var/run/openvpn.server.pid'
May 15 15:31:32 packdeploy ovpn-server[24892]: up_script = '[UNDEF]'
May 15 15:31:32 packdeploy ovpn-server[24892]: down_script = '[UNDEF]'
May 15 15:31:32 packdeploy ovpn-server[24892]: down_pre = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: up_restart = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: up_delay = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: daemon = ENABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: inetd = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: log = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: suppress_timestamps = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: nice = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: verbosity = 4
May 15 15:31:32 packdeploy ovpn-server[24892]: mute = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: gremlin = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: status_file = 'openvpn-status.log'
May 15 15:31:32 packdeploy ovpn-server[24892]: status_file_version = 1
May 15 15:31:32 packdeploy ovpn-server[24892]: status_file_update_freq = 60
May 15 15:31:32 packdeploy ovpn-server[24892]: occ = ENABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: rcvbuf = 65536
May 15 15:31:32 packdeploy ovpn-server[24892]: sndbuf = 65536
May 15 15:31:32 packdeploy ovpn-server[24892]: sockflags = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: fast_io = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: lzo = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: route_script = '[UNDEF]'
May 15 15:31:32 packdeploy ovpn-server[24892]: route_default_gateway = '[UNDEF]'
May 15 15:31:32 packdeploy ovpn-server[24892]: route_default_metric = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: route_noexec = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: route_delay = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: route_delay_window = 30
May 15 15:31:32 packdeploy ovpn-server[24892]: route_delay_defined = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: route_nopull = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: route_gateway_via_dhcp = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: max_routes = 100
May 15 15:31:32 packdeploy ovpn-server[24892]: allow_pull_fqdn = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: route 10.8.1.0/255.255.255.252/nil/nil
May 15 15:31:32 packdeploy ovpn-server[24892]: route 10.8.0.0/255.255.255.0/nil/nil
May 15 15:31:32 packdeploy ovpn-server[24892]: management_addr = '[UNDEF]'
May 15 15:31:32 packdeploy ovpn-server[24892]: management_port = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: management_user_pass = '[UNDEF]'
May 15 15:31:32 packdeploy ovpn-server[24892]: management_log_history_cache = 250
May 15 15:31:32 packdeploy ovpn-server[24892]: management_echo_buffer_size = 100
May 15 15:31:32 packdeploy ovpn-server[24892]: management_write_peer_info_file = '[UNDEF]'
May 15 15:31:32 packdeploy ovpn-server[24892]: management_client_user = '[UNDEF]'
May 15 15:31:32 packdeploy ovpn-server[24892]: management_client_group = '[UNDEF]'
May 15 15:31:32 packdeploy ovpn-server[24892]: management_flags = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: shared_secret_file = '[UNDEF]'
May 15 15:31:32 packdeploy ovpn-server[24892]: key_direction = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: ciphername_defined = ENABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: ciphername = 'BF-CBC'
May 15 15:31:32 packdeploy ovpn-server[24892]: authname_defined = ENABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: authname = 'SHA1'
May 15 15:31:32 packdeploy ovpn-server[24892]: prng_hash = 'SHA1'
May 15 15:31:32 packdeploy ovpn-server[24892]: prng_nonce_secret_len = 16
May 15 15:31:32 packdeploy ovpn-server[24892]: keysize = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: engine = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: replay = ENABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: mute_replay_warnings = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: replay_window = 64
May 15 15:31:32 packdeploy ovpn-server[24892]: replay_time = 15
May 15 15:31:32 packdeploy ovpn-server[24892]: packet_id_file = '[UNDEF]'
May 15 15:31:32 packdeploy ovpn-server[24892]: use_iv = ENABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: test_crypto = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: tls_server = ENABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: tls_client = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: key_method = 2
May 15 15:31:32 packdeploy ovpn-server[24892]: ca_file = '/etc/openvpn/domain.tld.ca.pem'
May 15 15:31:32 packdeploy ovpn-server[24892]: ca_path = '[UNDEF]'
May 15 15:31:32 packdeploy ovpn-server[24892]: dh_file = 'dh2048.pem'
May 15 15:31:32 packdeploy ovpn-server[24892]: cert_file = '/etc/openvpn/vpn.domain.tld.crt'
May 15 15:31:32 packdeploy ovpn-server[24892]: priv_key_file = '/etc/openvpn/vpn.domain.tld.key'
May 15 15:31:32 packdeploy ovpn-server[24892]: pkcs12_file = '[UNDEF]'
May 15 15:31:32 packdeploy ovpn-server[24892]: cipher_list = '[UNDEF]'
May 15 15:31:32 packdeploy ovpn-server[24892]: tls_verify = '[UNDEF]'
May 15 15:31:32 packdeploy ovpn-server[24892]: tls_export_cert = '[UNDEF]'
May 15 15:31:32 packdeploy ovpn-server[24892]: tls_remote = '[UNDEF]'
May 15 15:31:32 packdeploy ovpn-server[24892]: crl_file = '[UNDEF]'
May 15 15:31:32 packdeploy ovpn-server[24892]: ns_cert_type = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: remote_cert_ku[i] = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: remote_cert_ku[i] = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: remote_cert_ku[i] = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: remote_cert_ku[i] = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: remote_cert_ku[i] = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: remote_cert_ku[i] = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: remote_cert_ku[i] = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: remote_cert_ku[i] = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: remote_cert_ku[i] = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: remote_cert_ku[i] = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: remote_cert_ku[i] = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: remote_cert_ku[i] = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: remote_cert_ku[i] = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: remote_cert_ku[i] = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: remote_cert_ku[i] = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: remote_cert_ku[i] = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: remote_cert_eku = '[UNDEF]'
May 15 15:31:32 packdeploy ovpn-server[24892]: tls_timeout = 2
May 15 15:31:32 packdeploy ovpn-server[24892]: renegotiate_bytes = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: renegotiate_packets = 0
May 15 15:31:32 packdeploy ovpn-server[24892]: renegotiate_seconds = 3600
May 15 15:31:32 packdeploy ovpn-server[24892]: handshake_window = 60
May 15 15:31:32 packdeploy ovpn-server[24892]: transition_window = 3600
May 15 15:31:32 packdeploy ovpn-server[24892]: single_session = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: push_peer_info = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: tls_exit = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: tls_auth_file = '[UNDEF]'
May 15 15:31:32 packdeploy ovpn-server[24892]: pkcs11_protected_authentication = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: pkcs11_protected_authentication = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: pkcs11_protected_authentication = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: pkcs11_protected_authentication = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: pkcs11_protected_authentication = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: pkcs11_protected_authentication = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: pkcs11_protected_authentication = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: pkcs11_protected_authentication = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: pkcs11_protected_authentication = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: pkcs11_protected_authentication = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: pkcs11_protected_authentication = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: pkcs11_protected_authentication = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: pkcs11_protected_authentication = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: pkcs11_protected_authentication = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: pkcs11_protected_authentication = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: pkcs11_protected_authentication = DISABLED
May 15 15:31:32 packdeploy ovpn-server[24892]: pkcs11_private_mode = 00000000
May 15 15:31:32 packdeploy ovpn-server[24892]: pkcs11_private_mode = 00000000
May 15 15:31:32 packdeploy ovpn-server[24892]: pkcs11_private_mode = 00000000
May 15 15:31:32 packdeploy ovpn-server[24892]: pkcs11_private_mode = 00000000
May 15 15:31:32 packdeploy ovpn-server[24892]: pkcs11_private_mode = 00000000
May 15 15:31:32 packdeploy ovpn-server[24892]: pkcs11_private_mode = 00000000
May 15 15:31:32 packdeploy ovpn-server[24892]: pkcs11_private_mode = 00000000
May 15 15:31:32 packdeploy ovpn-server[24898]: GID set to nogroup
May 15 15:31:32 packdeploy ovpn-server[24898]: UID set to nobody
May 15 15:31:32 packdeploy ovpn-server[24898]: Listening for incoming TCP connection on [undef]
May 15 15:31:32 packdeploy ovpn-server[24898]: TCPv4_SERVER link local (bound): [undef]
May 15 15:31:32 packdeploy ovpn-server[24898]: TCPv4_SERVER link remote: [undef]
May 15 15:31:32 packdeploy ovpn-server[24898]: MULTI: multi_init called, r=256 v=256
May 15 15:31:32 packdeploy ovpn-server[24898]: IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
May 15 15:31:32 packdeploy ovpn-server[24898]: ifconfig_pool_read(), in='S-LT-028.domain.tld,10.8.0.4', TODO: IPv6
May 15 15:31:32 packdeploy ovpn-server[24898]: succeeded -> ifconfig_pool_set()
May 15 15:31:32 packdeploy ovpn-server[24898]: IFCONFIG POOL LIST
May 15 15:31:32 packdeploy ovpn-server[24898]: S-LT-028.domain.tld,10.8.0.4
May 15 15:31:32 packdeploy ovpn-server[24898]: MULTI: TCP INIT maxclients=10 maxevents=14
May 15 15:31:32 packdeploy ovpn-server[24898]: Initialization Sequence Completed
Client
Thu May 15 16:34:11 2014 us=412042 Current Parameter Settings:
Thu May 15 16:34:11 2014 us=412042 config = 'SMS.ovpn'
Thu May 15 16:34:11 2014 us=412042 mode = 0
Thu May 15 16:34:11 2014 us=412042 show_ciphers = DISABLED
Thu May 15 16:34:11 2014 us=412042 show_digests = DISABLED
Thu May 15 16:34:11 2014 us=412042 show_engines = DISABLED
Thu May 15 16:34:11 2014 us=412042 genkey = DISABLED
Thu May 15 16:34:11 2014 us=412042 key_pass_file = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 show_tls_ciphers = DISABLED
Thu May 15 16:34:11 2014 us=412042 Connection profiles [default]:
Thu May 15 16:34:11 2014 us=412042 proto = tcp-client
Thu May 15 16:34:11 2014 us=412042 local = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 local_port = 0
Thu May 15 16:34:11 2014 us=412042 remote = 'vpn.domain.tld'
Thu May 15 16:34:11 2014 us=412042 remote_port = 1194
Thu May 15 16:34:11 2014 us=412042 remote_float = DISABLED
Thu May 15 16:34:11 2014 us=412042 bind_defined = DISABLED
Thu May 15 16:34:11 2014 us=412042 bind_local = DISABLED
Thu May 15 16:34:11 2014 us=412042 connect_retry_seconds = 5
Thu May 15 16:34:11 2014 us=412042 connect_timeout = 10
Thu May 15 16:34:11 2014 us=412042 connect_retry_max = 0
Thu May 15 16:34:11 2014 us=412042 socks_proxy_server = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 socks_proxy_port = 0
Thu May 15 16:34:11 2014 us=412042 socks_proxy_retry = DISABLED
Thu May 15 16:34:11 2014 us=412042 tun_mtu = 1500
Thu May 15 16:34:11 2014 us=412042 tun_mtu_defined = ENABLED
Thu May 15 16:34:11 2014 us=412042 link_mtu = 1500
Thu May 15 16:34:11 2014 us=412042 link_mtu_defined = DISABLED
Thu May 15 16:34:11 2014 us=412042 tun_mtu_extra = 0
Thu May 15 16:34:11 2014 us=412042 tun_mtu_extra_defined = DISABLED
Thu May 15 16:34:11 2014 us=412042 mtu_discover_type = -1
Thu May 15 16:34:11 2014 us=412042 fragment = 0
Thu May 15 16:34:11 2014 us=412042 mssfix = 1450
Thu May 15 16:34:11 2014 us=412042 explicit_exit_notification = 0
Thu May 15 16:34:11 2014 us=412042 Connection profiles END
Thu May 15 16:34:11 2014 us=412042 remote_random = DISABLED
Thu May 15 16:34:11 2014 us=412042 ipchange = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 dev = 'tun'
Thu May 15 16:34:11 2014 us=412042 dev_type = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 dev_node = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 lladdr = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 topology = 1
Thu May 15 16:34:11 2014 us=412042 tun_ipv6 = DISABLED
Thu May 15 16:34:11 2014 us=412042 ifconfig_local = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 ifconfig_remote_netmask = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 ifconfig_noexec = DISABLED
Thu May 15 16:34:11 2014 us=412042 ifconfig_nowarn = DISABLED
Thu May 15 16:34:11 2014 us=412042 ifconfig_ipv6_local = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 ifconfig_ipv6_netbits = 0
Thu May 15 16:34:11 2014 us=412042 ifconfig_ipv6_remote = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 shaper = 0
Thu May 15 16:34:11 2014 us=412042 mtu_test = 0
Thu May 15 16:34:11 2014 us=412042 mlock = DISABLED
Thu May 15 16:34:11 2014 us=412042 keepalive_ping = 0
Thu May 15 16:34:11 2014 us=412042 keepalive_timeout = 0
Thu May 15 16:34:11 2014 us=412042 inactivity_timeout = 0
Thu May 15 16:34:11 2014 us=412042 ping_send_timeout = 0
Thu May 15 16:34:11 2014 us=412042 ping_rec_timeout = 0
Thu May 15 16:34:11 2014 us=412042 ping_rec_timeout_action = 0
Thu May 15 16:34:11 2014 us=412042 ping_timer_remote = DISABLED
Thu May 15 16:34:11 2014 us=412042 remap_sigusr1 = 0
Thu May 15 16:34:11 2014 us=412042 persist_tun = ENABLED
Thu May 15 16:34:11 2014 us=412042 persist_local_ip = DISABLED
Thu May 15 16:34:11 2014 us=412042 persist_remote_ip = DISABLED
Thu May 15 16:34:11 2014 us=412042 persist_key = ENABLED
Thu May 15 16:34:11 2014 us=412042 passtos = DISABLED
Thu May 15 16:34:11 2014 us=412042 resolve_retry_seconds = 1000000000
Thu May 15 16:34:11 2014 us=412042 username = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 groupname = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 chroot_dir = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 cd_dir = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 writepid = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 up_script = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 down_script = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 down_pre = DISABLED
Thu May 15 16:34:11 2014 us=412042 up_restart = DISABLED
Thu May 15 16:34:11 2014 us=412042 up_delay = DISABLED
Thu May 15 16:34:11 2014 us=412042 daemon = DISABLED
Thu May 15 16:34:11 2014 us=412042 inetd = 0
Thu May 15 16:34:11 2014 us=412042 log = ENABLED
Thu May 15 16:34:11 2014 us=412042 suppress_timestamps = DISABLED
Thu May 15 16:34:11 2014 us=412042 nice = 0
Thu May 15 16:34:11 2014 us=412042 verbosity = 4
Thu May 15 16:34:11 2014 us=412042 mute = 0
Thu May 15 16:34:11 2014 us=412042 status_file = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 status_file_version = 1
Thu May 15 16:34:11 2014 us=412042 status_file_update_freq = 60
Thu May 15 16:34:11 2014 us=412042 occ = ENABLED
Thu May 15 16:34:11 2014 us=412042 rcvbuf = 0
Thu May 15 16:34:11 2014 us=412042 sndbuf = 0
Thu May 15 16:34:11 2014 us=412042 sockflags = 0
Thu May 15 16:34:11 2014 us=412042 fast_io = DISABLED
Thu May 15 16:34:11 2014 us=412042 lzo = 0
Thu May 15 16:34:11 2014 us=412042 route_script = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 route_default_gateway = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 route_default_metric = 0
Thu May 15 16:34:11 2014 us=412042 route_noexec = DISABLED
Thu May 15 16:34:11 2014 us=412042 route_delay = 5
Thu May 15 16:34:11 2014 us=412042 route_delay_window = 30
Thu May 15 16:34:11 2014 us=412042 route_delay_defined = ENABLED
Thu May 15 16:34:11 2014 us=412042 route_nopull = DISABLED
Thu May 15 16:34:11 2014 us=412042 route_gateway_via_dhcp = DISABLED
Thu May 15 16:34:11 2014 us=412042 max_routes = 100
Thu May 15 16:34:11 2014 us=412042 allow_pull_fqdn = DISABLED
Thu May 15 16:34:11 2014 us=412042 management_addr = '127.0.0.1'
Thu May 15 16:34:11 2014 us=412042 management_port = 25340
Thu May 15 16:34:11 2014 us=412042 management_user_pass = 'stdin'
Thu May 15 16:34:11 2014 us=412042 management_log_history_cache = 250
Thu May 15 16:34:11 2014 us=412042 management_echo_buffer_size = 100
Thu May 15 16:34:11 2014 us=412042 management_write_peer_info_file = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 management_client_user = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 management_client_group = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 management_flags = 6
Thu May 15 16:34:11 2014 us=412042 shared_secret_file = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 key_direction = 0
Thu May 15 16:34:11 2014 us=412042 ciphername_defined = ENABLED
Thu May 15 16:34:11 2014 us=412042 ciphername = 'BF-CBC'
Thu May 15 16:34:11 2014 us=412042 authname_defined = ENABLED
Thu May 15 16:34:11 2014 us=412042 authname = 'SHA1'
Thu May 15 16:34:11 2014 us=412042 prng_hash = 'SHA1'
Thu May 15 16:34:11 2014 us=412042 prng_nonce_secret_len = 16
Thu May 15 16:34:11 2014 us=412042 keysize = 0
Thu May 15 16:34:11 2014 us=412042 engine = DISABLED
Thu May 15 16:34:11 2014 us=412042 replay = ENABLED
Thu May 15 16:34:11 2014 us=412042 mute_replay_warnings = DISABLED
Thu May 15 16:34:11 2014 us=412042 replay_window = 64
Thu May 15 16:34:11 2014 us=412042 replay_time = 15
Thu May 15 16:34:11 2014 us=412042 packet_id_file = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 use_iv = ENABLED
Thu May 15 16:34:11 2014 us=412042 test_crypto = DISABLED
Thu May 15 16:34:11 2014 us=412042 tls_server = DISABLED
Thu May 15 16:34:11 2014 us=412042 tls_client = ENABLED
Thu May 15 16:34:11 2014 us=412042 key_method = 2
Thu May 15 16:34:11 2014 us=412042 ca_file = 'ca.crt'
Thu May 15 16:34:11 2014 us=412042 ca_path = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 dh_file = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 cert_file = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 priv_key_file = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 pkcs12_file = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 cryptoapi_cert = 'SUBJ:S-LT-028.domain.tld'
Thu May 15 16:34:11 2014 us=412042 cipher_list = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 tls_verify = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 tls_export_cert = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 verify_x509_type = 0
Thu May 15 16:34:11 2014 us=412042 verify_x509_name = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 crl_file = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 ns_cert_type = 0
Thu May 15 16:34:11 2014 us=412042 remote_cert_ku[i] = 0
Thu May 15 16:34:11 2014 us=412042 remote_cert_ku[i] = 0
Thu May 15 16:34:11 2014 us=412042 remote_cert_ku[i] = 0
Thu May 15 16:34:11 2014 us=412042 remote_cert_ku[i] = 0
Thu May 15 16:34:11 2014 us=412042 remote_cert_ku[i] = 0
Thu May 15 16:34:11 2014 us=412042 remote_cert_ku[i] = 0
Thu May 15 16:34:11 2014 us=412042 remote_cert_ku[i] = 0
Thu May 15 16:34:11 2014 us=412042 remote_cert_ku[i] = 0
Thu May 15 16:34:11 2014 us=412042 remote_cert_ku[i] = 0
Thu May 15 16:34:11 2014 us=412042 remote_cert_ku[i] = 0
Thu May 15 16:34:11 2014 us=412042 remote_cert_ku[i] = 0
Thu May 15 16:34:11 2014 us=412042 remote_cert_ku[i] = 0
Thu May 15 16:34:11 2014 us=412042 remote_cert_ku[i] = 0
Thu May 15 16:34:11 2014 us=412042 remote_cert_ku[i] = 0
Thu May 15 16:34:11 2014 us=412042 remote_cert_ku[i] = 0
Thu May 15 16:34:11 2014 us=412042 remote_cert_ku[i] = 0
Thu May 15 16:34:11 2014 us=412042 remote_cert_eku = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 ssl_flags = 0
Thu May 15 16:34:11 2014 us=412042 tls_timeout = 2
Thu May 15 16:34:11 2014 us=412042 renegotiate_bytes = 0
Thu May 15 16:34:11 2014 us=412042 renegotiate_packets = 0
Thu May 15 16:34:11 2014 us=412042 renegotiate_seconds = 3600
Thu May 15 16:34:11 2014 us=412042 handshake_window = 60
Thu May 15 16:34:11 2014 us=412042 transition_window = 3600
Thu May 15 16:34:11 2014 us=412042 single_session = DISABLED
Thu May 15 16:34:11 2014 us=412042 push_peer_info = DISABLED
Thu May 15 16:34:11 2014 us=412042 tls_exit = DISABLED
Thu May 15 16:34:11 2014 us=412042 tls_auth_file = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 pkcs11_protected_authentication = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_protected_authentication = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_protected_authentication = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_protected_authentication = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_protected_authentication = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_protected_authentication = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_protected_authentication = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_protected_authentication = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_protected_authentication = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_protected_authentication = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_protected_authentication = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_protected_authentication = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_protected_authentication = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_protected_authentication = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_protected_authentication = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_protected_authentication = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_private_mode = 00000000
Thu May 15 16:34:11 2014 us=412042 pkcs11_private_mode = 00000000
Thu May 15 16:34:11 2014 us=412042 pkcs11_private_mode = 00000000
Thu May 15 16:34:11 2014 us=412042 pkcs11_private_mode = 00000000
Thu May 15 16:34:11 2014 us=412042 pkcs11_private_mode = 00000000
Thu May 15 16:34:11 2014 us=412042 pkcs11_private_mode = 00000000
Thu May 15 16:34:11 2014 us=412042 pkcs11_private_mode = 00000000
Thu May 15 16:34:11 2014 us=412042 pkcs11_private_mode = 00000000
Thu May 15 16:34:11 2014 us=412042 pkcs11_private_mode = 00000000
Thu May 15 16:34:11 2014 us=412042 pkcs11_private_mode = 00000000
Thu May 15 16:34:11 2014 us=412042 pkcs11_private_mode = 00000000
Thu May 15 16:34:11 2014 us=412042 pkcs11_private_mode = 00000000
Thu May 15 16:34:11 2014 us=412042 pkcs11_private_mode = 00000000
Thu May 15 16:34:11 2014 us=412042 pkcs11_private_mode = 00000000
Thu May 15 16:34:11 2014 us=412042 pkcs11_private_mode = 00000000
Thu May 15 16:34:11 2014 us=412042 pkcs11_private_mode = 00000000
Thu May 15 16:34:11 2014 us=412042 pkcs11_cert_private = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_cert_private = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_cert_private = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_cert_private = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_cert_private = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_cert_private = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_cert_private = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_cert_private = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_cert_private = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_cert_private = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_cert_private = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_cert_private = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_cert_private = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_cert_private = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_cert_private = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_cert_private = DISABLED
Thu May 15 16:34:11 2014 us=412042 pkcs11_pin_cache_period = -1
Thu May 15 16:34:11 2014 us=412042 pkcs11_id = '[UNDEF]'
Thu May 15 16:34:11 2014 us=412042 pkcs11_id_management = DISABLED
Thu May 15 16:34:11 2014 us=412042 server_network = 0.0.0.0
Thu May 15 16:34:11 2014 us=412042 server_netmask = 0.0.0.0
Thu May 15 16:34:11 2014 us=412042 server_network_ipv6 = ::
Thu May 15 16:34:11 2014 us=412042 server_netbits_ipv6 = 0
Thu May 15 16:34:11 2014 us=412042 server_bridge_ip = 0.0.0.0
Thu May 15 16:34:11 2014 us=412042 server_bridge_netmask = 0.0.0.0
Thu May 15 16:34:11 2014 us=427643 server_bridge_pool_start = 0.0.0.0
Thu May 15 16:34:11 2014 us=427643 server_bridge_pool_end = 0.0.0.0
Thu May 15 16:34:11 2014 us=427643 ifconfig_pool_defined = DISABLED
Thu May 15 16:34:11 2014 us=427643 ifconfig_pool_start = 0.0.0.0
Thu May 15 16:34:11 2014 us=427643 ifconfig_pool_end = 0.0.0.0
Thu May 15 16:34:11 2014 us=427643 ifconfig_pool_netmask = 0.0.0.0
Thu May 15 16:34:11 2014 us=427643 ifconfig_pool_persist_filename = '[UNDEF]'
Thu May 15 16:34:11 2014 us=427643 ifconfig_pool_persist_refresh_freq = 600
Thu May 15 16:34:11 2014 us=427643 ifconfig_ipv6_pool_defined = DISABLED
Thu May 15 16:34:11 2014 us=427643 ifconfig_ipv6_pool_base = ::
Thu May 15 16:34:11 2014 us=427643 ifconfig_ipv6_pool_netbits = 0
Thu May 15 16:34:11 2014 us=427643 n_bcast_buf = 256
Thu May 15 16:34:11 2014 us=427643 tcp_queue_limit = 64
Thu May 15 16:34:11 2014 us=427643 real_hash_size = 256
Thu May 15 16:34:11 2014 us=427643 virtual_hash_size = 256
Thu May 15 16:34:11 2014 us=427643 client_connect_script = '[UNDEF]'
Thu May 15 16:34:11 2014 us=427643 learn_address_script = '[UNDEF]'
Thu May 15 16:34:11 2014 us=427643 client_disconnect_script = '[UNDEF]'
Thu May 15 16:34:11 2014 us=427643 client_config_dir = '[UNDEF]'
Thu May 15 16:34:11 2014 us=427643 ccd_exclusive = DISABLED
Thu May 15 16:34:11 2014 us=427643 tmp_dir = 'C:\Users\tt\AppData\Local\Temp\'
Thu May 15 16:34:11 2014 us=427643 push_ifconfig_defined = DISABLED
Thu May 15 16:34:11 2014 us=427643 push_ifconfig_local = 0.0.0.0
Thu May 15 16:34:11 2014 us=427643 push_ifconfig_remote_netmask = 0.0.0.0
Thu May 15 16:34:11 2014 us=427643 push_ifconfig_ipv6_defined = DISABLED
Thu May 15 16:34:11 2014 us=427643 push_ifconfig_ipv6_local = ::/0
Thu May 15 16:34:11 2014 us=427643 push_ifconfig_ipv6_remote = ::
Thu May 15 16:34:11 2014 us=427643 enable_c2c = DISABLED
Thu May 15 16:34:11 2014 us=427643 duplicate_cn = DISABLED
Thu May 15 16:34:11 2014 us=427643 cf_max = 0
Thu May 15 16:34:11 2014 us=427643 cf_per = 0
Thu May 15 16:34:11 2014 us=427643 max_clients = 1024
Thu May 15 16:34:11 2014 us=427643 max_routes_per_client = 256
Thu May 15 16:34:11 2014 us=427643 auth_user_pass_verify_script = '[UNDEF]'
Thu May 15 16:34:11 2014 us=427643 auth_user_pass_verify_script_via_file = DISABLED
Thu May 15 16:34:11 2014 us=427643 client = ENABLED
Thu May 15 16:34:11 2014 us=427643 pull = ENABLED
Thu May 15 16:34:11 2014 us=427643 auth_user_pass_file = '[UNDEF]'
Thu May 15 16:34:11 2014 us=427643 show_net_up = DISABLED
Thu May 15 16:34:11 2014 us=427643 route_method = 0
Thu May 15 16:34:11 2014 us=427643 ip_win32_defined = DISABLED
Thu May 15 16:34:11 2014 us=427643 ip_win32_type = 3
Thu May 15 16:34:11 2014 us=427643 dhcp_masq_offset = 0
Thu May 15 16:34:11 2014 us=427643 dhcp_lease_time = 31536000
Thu May 15 16:34:11 2014 us=427643 tap_sleep = 0
Thu May 15 16:34:11 2014 us=427643 dhcp_options = DISABLED
Thu May 15 16:34:11 2014 us=427643 dhcp_renew = DISABLED
Thu May 15 16:34:11 2014 us=427643 dhcp_pre_release = DISABLED
Thu May 15 16:34:11 2014 us=427643 dhcp_release = DISABLED
Thu May 15 16:34:11 2014 us=427643 domain = '[UNDEF]'
Thu May 15 16:34:11 2014 us=427643 netbios_scope = '[UNDEF]'
Thu May 15 16:34:11 2014 us=427643 netbios_node_type = 0
Thu May 15 16:34:11 2014 us=427643 disable_nbt = DISABLED
Thu May 15 16:34:11 2014 us=427643 OpenVPN 2.3.4 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on May 2 2014
Thu May 15 16:34:11 2014 us=427643 library versions: OpenSSL 1.0.1g 7 Apr 2014, LZO 2.05
Enter Management Password:
Thu May 15 16:34:11 2014 us=427643 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Thu May 15 16:34:11 2014 us=427643 Need hold release from management interface, waiting...
Thu May 15 16:34:11 2014 us=864457 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Thu May 15 16:34:11 2014 us=973660 MANAGEMENT: CMD 'state on'
Thu May 15 16:34:11 2014 us=973660 MANAGEMENT: CMD 'log all on'
Thu May 15 16:34:12 2014 us=176467 MANAGEMENT: CMD 'hold off'
Thu May 15 16:34:12 2014 us=176467 MANAGEMENT: CMD 'hold release'
Thu May 15 16:34:12 2014 us=176467 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Thu May 15 16:34:12 2014 us=410474 MANAGEMENT: Client disconnected
Thu May 15 16:34:12 2014 us=410474 Cannot load certificate "SUBJ:S-LT-028.domain.tld" from Microsoft Certificate Store: error:C5066064:microsoft cryptoapi:CryptAcquireCertificatePrivateKey:Keyset does not exist
Thu May 15 16:34:12 2014 us=410474 Exiting due to fatal error
