OpenVPN with AD auth [LDAP] Random Disconnects and failures

lowtek

Hello!!! I have been using OpenVPN for a few weeks now and it works great.
My task now is Active Directory integration which was easy to setup and it works fine. I'm actually posting here while connected to my VPN right now.

However, it will disconnect after a while, and after it disconnects, won't allow logins again for a while (I have to wait) and it will just randomly work again....

Server Config:

port 43961
proto udp
dev tun
ca ca.crt
cert openvpntest.crt
key openvpntest.key
dh dh2048.pem
server 10.20.8.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.10.2.0 255.255.255.0"
push "route 10.10.3.0 255.255.255.0"
push "route 10.10.4.0 255.255.255.0"
push "route 10.10.5.0 255.255.255.0"
push "route 10.10.10.0 255.255.255.0"
push "route 10.10.15.0 255.255.255.0"
push "route 10.10.25.0 255.255.255.0"
push "route 10.20.3.0 255.255.255.0"
push "route 10.20.5.0 255.255.255.0"
push "route 10.20.6.0 255.255.255.0"
push "route 10.20.10.0 255.255.255.0"
push "route 10.20.15.0 255.255.255.0"
push "route 10.20.16.0 255.255.255.0"
push "route 10.20.20.0 255.255.255.0"
push "route 10.20.25.0 255.255.255.0"
push "route 10.20.26.0 255.255.255.0"
push "route 10.30.3.0 255.255.255.0"
push "dhcp-option DOMAIN prod.local"
push "dhcp-option DNS 10.10.3.5"
push "dhcp-option DNS 10.20.3.5"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
management 127.0.0.1 2999
client-cert-not-required
username-as-common-name
tmp-dir "/etc/openvpn/tmp/"
duplicate-cn
plugin /usr/lib/openvpn/openvpn-auth-ldap.so /etc/openvpn/auth/auth-ldap.conf

Client:

client
dev tun
proto udp
remote my.ip.is.hidden 43961
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
ns-cert-type server
keepalive 10 120
verb 3
auth-user-pass
auth-nocache
comp-lzo

Unfortunately the Client Logs overwrite themselves so I can't see the errors in there, I'll try to edit this post when the issue occurs again.
When it does happen, the client has entries like this:

TLS Error: TLS handshake failed

Even though TLS is disabled everywhere.

Here is server syslog entries:

Jan  7 22:18:27 ip-10-20-3-112 ovpn-server[9958]: Initialization Sequence Completed
Jan  7 22:18:36 ip-10-20-3-112 ovpn-server[9958]: my.ip.is.hidden:60400 TLS: Initial packet from [AF_INET]my.ip.is.hidden:60400, sid=df3f58e6 a98e6678
Jan  7 22:18:51 ip-10-20-3-112 ovpn-server[9958]: LDAP search failed: Timed out
Jan  7 22:18:51 ip-10-20-3-112 ovpn-server[9958]: LDAP user "testuser" was not found.
Jan  7 22:18:51 ip-10-20-3-112 ovpn-server[9958]: my.ip.is.hidden:60400 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-ldap.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
Jan  7 22:18:51 ip-10-20-3-112 ovpn-server[9958]: my.ip.is.hidden:60400 PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/lib/openvpn/openvpn-auth-ldap.so
Jan  7 22:18:51 ip-10-20-3-112 ovpn-server[9958]: my.ip.is.hidden:60400 TLS Auth Error: Auth Username/Password verification failed for peer
Jan  7 22:18:51 ip-10-20-3-112 ovpn-server[9958]: my.ip.is.hidden:60400 SIGTERM[soft,auth-control-exit] received, client-instance exiting

Jan  7 22:19:43 ip-10-20-3-112 ovpn-server[9958]: my.ip.is.hidden:18082 TLS: Initial packet from [AF_INET]my.ip.is.hidden:18082, sid=97a00654 a5cb2522
Jan  7 22:19:58 ip-10-20-3-112 ovpn-server[9958]: LDAP search failed: Timed out
Jan  7 22:19:58 ip-10-20-3-112 ovpn-server[9958]: LDAP user "testuser" was not found.
Jan  7 22:19:58 ip-10-20-3-112 ovpn-server[9958]: my.ip.is.hidden:18082 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-ldap.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
Jan  7 22:19:58 ip-10-20-3-112 ovpn-server[9958]: my.ip.is.hidden:18082 PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/lib/openvpn/openvpn-auth-ldap.so
Jan  7 22:19:58 ip-10-20-3-112 ovpn-server[9958]: my.ip.is.hidden:18082 TLS Auth Error: Auth Username/Password verification failed for peer
Jan  7 22:19:58 ip-10-20-3-112 ovpn-server[9958]: my.ip.is.hidden:18082 SIGTERM[soft,auth-control-exit] received, client-instance exiting

Jan  7 22:22:17 ip-10-20-3-112 ovpn-server[9958]: my.ip.is.hidden:1192 TLS: Initial packet from [AF_INET]my.ip.is.hidden:1192, sid=544824e5 a37b3216
Jan  7 22:22:32 ip-10-20-3-112 ovpn-server[9958]: LDAP search failed: Timed out
Jan  7 22:22:32 ip-10-20-3-112 ovpn-server[9958]: LDAP user "testuser" was not found.
Jan  7 22:22:32 ip-10-20-3-112 ovpn-server[9958]: my.ip.is.hidden:1192 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-ldap.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
Jan  7 22:22:32 ip-10-20-3-112 ovpn-server[9958]: my.ip.is.hidden:1192 PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/lib/openvpn/openvpn-auth-ldap.so
Jan  7 22:22:32 ip-10-20-3-112 ovpn-server[9958]: my.ip.is.hidden:1192 TLS Auth Error: Auth Username/Password verification failed for peer
Jan  7 22:22:32 ip-10-20-3-112 ovpn-server[9958]: my.ip.is.hidden:1192 SIGTERM[soft,auth-control-exit] received, client-instance exiting

Jan  7 22:23:21 ip-10-20-3-112 ovpn-server[9958]: my.ip.is.hidden:35154 TLS: Initial packet from [AF_INET]my.ip.is.hidden:35154, sid=73973547 f144534f
Jan  7 22:23:36 ip-10-20-3-112 ovpn-server[9958]: [b][color=#FF0000]LDAP search failed: Timed out[/color][/b]
Jan  7 22:23:36 ip-10-20-3-112 ovpn-server[9958]: LDAP user "testuser" was not found.
Jan  7 22:23:36 ip-10-20-3-112 ovpn-server[9958]: my.ip.is.hidden:35154 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-ldap.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
Jan  7 22:23:36 ip-10-20-3-112 ovpn-server[9958]: my.ip.is.hidden:35154 PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/lib/openvpn/openvpn-auth-ldap.so
Jan  7 22:23:36 ip-10-20-3-112 ovpn-server[9958]: my.ip.is.hidden:35154 TLS Auth Error: Auth Username/Password verification failed for peer
Jan  7 22:23:36 ip-10-20-3-112 ovpn-server[9958]: my.ip.is.hidden:35154 SIGTERM[soft,auth-control-exit] received, client-instance exiting

However, literally just about 5 minutes later I try again WITH NO CHANGES to config and it WORKS:

Jan  7 22:27:54 ip-10-20-3-112 ovpn-server[9958]: my.ip.is.hidden:13295 TLS: Initial packet from [AF_INET]my.ip.is.hidden:13295, sid=c6d34b2d 4d81c2db
Jan  7 22:27:57 ip-10-20-3-112 ovpn-server[9958]: my.ip.is.hidden:13295 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-ldap.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Jan  7 22:27:57 ip-10-20-3-112 ovpn-server[9958]: my.ip.is.hidden:13295 TLS: Username/Password authentication succeeded for username 'testuser' [CN SET]

LDAP config:

<LDAP>
        # LDAP server URL
        URL             ldap://10.10.3.5:389

        BindDN          "CN=openvpnauth,CN=Users,DC=prod,DC=local"

        Password        "PASSWORD_HIDDEN"

        Timeout         15
        TLSEnable       no
        FollowReferrals no
</LDAP>

<Authorization>
        BaseDN          "CN=Users,DC=prod,DC=local"
        SearchFilter    "(sAMAccountName=%u)"
        RequireGroup    true
                <Group>
                        BaseDN  "CN=Users,DC=prod,DC=local"
                        SearchFilter "(cn=VPN Users)"
                        MemberAttribute "member"
                </Group>
</Authorization>

When it actually makes the disconnect and starts to screw up, I see stuff like this:

Jan  7 22:02:13 ip-10-20-3-112 ovpn-server[8628]: message repeated 196 times: [ 168.161.192.15:4560 IP packet with unknown IP version=15 seen]
Jan  7 22:04:39 ip-10-20-3-112 ovpn-server[8628]: 168.161.192.15:62821 [UNDEF] Inactivity timeout (--ping-restart), restarting
Jan  7 22:04:39 ip-10-20-3-112 ovpn-server[8628]: 168.161.192.15:62821 SIGUSR1[soft,ping-restart] received, client-instance restarting
Jan  7 22:04:39 ip-10-20-3-112 ovpn-server[8628]: PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-ldap.so/PLUGIN_CLIENT_DISCONNECT status=0
Jan  7 22:06:13 ip-10-20-3-112 ovpn-server[8628]: 168.161.192.15:4560 [UNDEF] Inactivity timeout (--ping-restart), restarting
Jan  7 22:06:13 ip-10-20-3-112 ovpn-server[8628]: 168.161.192.15:4560 SIGUSR1[soft,ping-restart] received, client-instance restarting
Jan  7 22:06:13 ip-10-20-3-112 ovpn-server[8628]: PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-ldap.so/PLUGIN_CLIENT_DISCONNECT status=0
Jan  7 22:08:52 ip-10-20-3-112 ovpn-server[8628]: event_wait : Interrupted system call (code=4)
Jan  7 22:08:52 ip-10-20-3-112 ovpn-server[8628]: /sbin/ip route del 10.20.8.0/24
Jan  7 22:08:52 ip-10-20-3-112 ovpn-server[8628]: Closing TUN/TAP interface
Jan  7 22:08:52 ip-10-20-3-112 ovpn-server[8628]: /sbin/ip addr del dev tun0 local 10.20.8.1 peer 10.20.8.2
Jan  7 22:08:52 ip-10-20-3-112 ovpn-server[8628]: PLUGIN_CLOSE: /usr/lib/openvpn/openvpn-auth-ldap.so
Jan  7 22:08:52 ip-10-20-3-112 ovpn-server[8628]: SIGTERM[hard,] received, process exiting

Finally, a few server warnings I saw and have no idea how to solve them. Not sure if related to my issue:

Jan  7 22:10:41 ip-10-20-3-112 ovpn-server[9707]: my.ip.is.hidden:6782 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1541', remote='link-mtu 1542'
Jan  7 22:10:41 ip-10-20-3-112 ovpn-server[9707]: my.ip.is.hidden:6782 WARNING: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'

A few thoughts/Things I've tried:
No network blocking because it does work (for a while)
I did an endless ping FROM the vpn server TO the active directory server, with a good strong connection.
I tried disabling com-lzo
I tried swapping to TCP

maikcat

Unfortunately the Client Logs overwrite themselves so I can't see the errors in there

use log-append instead of log

Even though TLS is disabled everywhere.

you are using certs so ssl/tls IS enabled.

LDAP user "testuser" was not found.

not much to say about it...
if you perform an ldapsearch in the same time , do you get similar result?

btw i noticed you are using ldap , can you switch to ldaps?
Michael.

lowtek

maikcat wrote
Unfortunately the Client Logs overwrite themselves so I can't see the errors in there
use log-append instead of log

Even though TLS is disabled everywhere.
you are using certs so ssl/tls IS enabled.

LDAP user "testuser" was not found.
not much to say about it...
if you perform an ldapsearch in the same time , do you get similar result?

btw i noticed you are using ldap , can you switch to ldaps?
Michael.

Thanks Michael

not much to say about it...
if you perform an ldapsearch in the same time , do you get similar result?

Nope, I seem to authenticate over LDAP just fine, VPN connects fine as well after a few mins. So crazy.

Jan  7 22:27:57 ip-10-20-3-112 ovpn-server[9958]: my.ip.is.hidden:13295 TLS: Username/Password authentication succeeded for username 'testuser' [CN SET]

btw i noticed you are using ldap , can you switch to ldaps?

Not at this time

use log-append instead of log

Will do, thanks.

mevans336

Have you thought about dropping OpenVPN authentication via LDAP and allowing your OS (PAM) to handle it, then just using the OpenVPN PAM module? I also tried LDAP first, but it never worked right with our AD domain.

After joining your OS to your AD domain, just add the following to your server.conf (this is for CentOS 7):

# Username and Password authentication.
plugin /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so login

You may have to tweak your PAM configuration, but if you're running this on CentOS 7, when you join your server to AD, it makes all the changes for you. This is been extremely reliable and very easy to deploy for me so far.