Server Side & Client Side error?

teckins

Hi Everyone,

I'm using Free Radius ATM and I'm trying to use it with OpenVPN. I had a client login and they ran into this error:

 OpenVPN 2.3.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug  7 2014
Sun Oct 12 20:43:17 2014 library versions: OpenSSL 1.0.1i 6 Aug 2014, LZO 2.05
Sun Oct 12 20:43:17 2014 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Sun Oct 12 20:43:17 2014 Need hold release from management interface, waiting...
Sun Oct 12 20:43:18 2014 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Sun Oct 12 20:43:18 2014 MANAGEMENT: CMD 'state on'
Sun Oct 12 20:43:18 2014 MANAGEMENT: CMD 'log all on'
Sun Oct 12 20:43:18 2014 MANAGEMENT: CMD 'hold off'
Sun Oct 12 20:43:18 2014 MANAGEMENT: CMD 'hold release'
Sun Oct 12 20:43:23 2014 MANAGEMENT: CMD 'username "Auth" "venzbusiness@gmail.com"'
Sun Oct 12 20:43:23 2014 MANAGEMENT: CMD 'password [...]'
Sun Oct 12 20:43:23 2014 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Sun Oct 12 20:43:24 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sun Oct 12 20:43:24 2014 UDPv4 link local: [undef]
Sun Oct 12 20:43:24 2014 UDPv4 link remote: [AF_INET]178.62.196.205:1194
Sun Oct 12 20:43:24 2014 MANAGEMENT: >STATE:1413161004,WAIT,,,
Sun Oct 12 20:43:24 2014 MANAGEMENT: >STATE:1413161004,AUTH,,,
Sun Oct 12 20:43:24 2014 TLS: Initial packet from [AF_INET]178.62.196.205:1194, sid=a004cb4b 8726d024
Sun Oct 12 20:43:24 2014 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sun Oct 12 20:43:24 2014 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=changeme, CN=changeme, name=changeme, emailAddress=mail@host.domain
Sun Oct 12 20:43:24 2014 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=changeme, CN=server, name=changeme, emailAddress=mail@host.domain
Sun Oct 12 20:43:26 2014 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Oct 12 20:43:26 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Oct 12 20:43:26 2014 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Oct 12 20:43:26 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Oct 12 20:43:26 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sun Oct 12 20:43:26 2014 [server] Peer Connection Initiated with [AF_INET]178.62.196.205:1194
Sun Oct 12 20:43:27 2014 MANAGEMENT: >STATE:1413161007,GET_CONFIG,,,
Sun Oct 12 20:43:28 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sun Oct 12 20:43:28 2014 AUTH: Received control message: AUTH_FAILED
Sun Oct 12 20:43:28 2014 SIGUSR1[soft,auth-failure] received, process restarting
Sun Oct 12 20:43:28 2014 MANAGEMENT: >STATE:1413161008,RECONNECTING,auth-failure,,
Sun Oct 12 20:43:28 2014 Restart pause, 2 second(s)
Sun Oct 12 20:43:40 2014 MANAGEMENT: CMD 'username "Auth" "venzbusiness@gmail.com"'
Sun Oct 12 20:43:40 2014 MANAGEMENT: CMD 'password [...]'
Sun Oct 12 20:43:40 2014 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Sun Oct 12 20:43:40 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sun Oct 12 20:43:40 2014 UDPv4 link local: [undef]
Sun Oct 12 20:43:40 2014 UDPv4 link remote: [AF_INET]178.62.196.205:1194
Sun Oct 12 20:43:40 2014 MANAGEMENT: >STATE:1413161020,WAIT,,,
Sun Oct 12 20:43:40 2014 MANAGEMENT: >STATE:1413161020,AUTH,,,
Sun Oct 12 20:43:40 2014 TLS: Initial packet from [AF_INET]178.62.196.205:1194, sid=ea23353e 2e58e552
Sun Oct 12 20:43:41 2014 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=changeme, CN=changeme, name=changeme, emailAddress=mail@host.domain
Sun Oct 12 20:43:41 2014 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=changeme, CN=server, name=changeme, emailAddress=mail@host.domain
Sun Oct 12 20:43:42 2014 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Oct 12 20:43:42 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Oct 12 20:43:42 2014 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Oct 12 20:43:42 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Oct 12 20:43:42 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sun Oct 12 20:43:42 2014 [server] Peer Connection Initiated with [AF_INET]178.62.196.205:1194
Sun Oct 12 20:43:43 2014 MANAGEMENT: >STATE:1413161023,GET_CONFIG,,,
Sun Oct 12 20:43:44 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sun Oct 12 20:43:45 2014 AUTH: Received control message: AUTH_FAILED
Sun Oct 12 20:43:45 2014 SIGUSR1[soft,auth-failure] received, process restarting
Sun Oct 12 20:43:45 2014 MANAGEMENT: >STATE:1413161025,RECONNECTING,auth-failure,,
Sun Oct 12 20:43:45 2014 Restart pause, 2 second(s)
Sun Oct 12 20:43:45 2014 MANAGEMENT: CMD 'auth-retry none'
Sun Oct 12 20:43:47 2014 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Sun Oct 12 20:43:47 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sun Oct 12 20:43:47 2014 UDPv4 link local: [undef]
Sun Oct 12 20:43:47 2014 UDPv4 link remote: [AF_INET]178.62.196.205:1194
Sun Oct 12 20:43:47 2014 MANAGEMENT: >STATE:1413161027,WAIT,,,
Sun Oct 12 20:43:47 2014 MANAGEMENT: >STATE:1413161027,AUTH,,,
Sun Oct 12 20:43:47 2014 TLS: Initial packet from [AF_INET]178.62.196.205:1194, sid=7f739eec b3240020

The odd part is the password and username are defined in the Free Radius sql tables and they seem to be matching up with what we are putting in.

The only thing that I got on the server was this error:

Sun Oct 12 20:43:24 2014 RADIUS-PLUGIN: Got no response from radius server.
Sun Oct 12 20:43:24 2014 Error: RADIUS-PLUGIN: BACKGROUND  AUTH: Auth failed!.

Sun Oct 12 20:43:40 2014 RADIUS-PLUGIN: Got no response from radius server.
Sun Oct 12 20:43:40 2014 Error: RADIUS-PLUGIN: BACKGROUND  AUTH: Auth failed!.

It seems either OpenVPN is not authenticating off radius or the radius plugin is crashing? The Radius plugin is defining the user in the SQL tables as I'm using the WHMCS plugin so it's automatic.

My server.conf:

port 1194 #- port
proto udp #- protocol
dev tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
reneg-sec 0
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
#plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so /etc/pam.d/login #- C$
plugin /etc/openvpn/radiusplugin.so /etc/openvpn/radiusplugin.cnf #- Uncomment $
client-cert-not-required
username-as-common-name
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 5 30
comp-lzo
persist-key
persist-tun
status 1194.log
verb 3

This is my server section in the radiusplugin.cnf file:

$
server
{
        # The UDP port for radius accounting.
        acctport=1813
        # The UDP port for radius authentication.
        authport=1812
        # The name or ip address of the radius server.
        name=PUBLIC IP ADDRESS ( BLOCKED OUT )
        # How many times should the plugin send the if there is no response?
        retry=1
        # How long should the plugin wait for a response?
        wait=1
        # The shared secret.
        sharedsecret=MY SHARED SECRET ( BLOCKED OUT )
}

Any idea on what's going wrong and how I'm able to fix it?

Traffic

teckins wrote

# How many times should the plugin send the if there is no response?
        retry=1
        # How long should the plugin wait for a response?
        wait=1

Perhaps you are not waiting long enough or maybe there is a network error ?