LDAP Authentification Problem !

florianV

Hello !

I have a problem with my ldap authentification with openvpn, I need to connect my clients with their LDAP login's but i'm actually in trouble.

I checked and tried a lot of tutorials, forum's help, bug report etc, but nothing solved my problem. Thank you in advance. (I'm sorry for my english).

So, i'm gonna explain you my config :
I am on a CentOS 7. The LDAP and OpenVPN servers are on the same server, but it's not me who administrate the LDAP service.

Server config file :

port 443
proto tcp
dev tun
ca ca.crt
cert cert.crt
key key.key
dh dh.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
log-append /var/log/openvpn/openvpn.log
verb 7
plugin /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so /etc/openvpn/ldap.conf
client-cert-not-required

Normally I use the user/group nobody and chroot directives but for my tests I disabled theses ones.

File /etc/openvpn/ldap.conf :

<LDAP>
        # LDAP server URL
        URL             ldap://localhost
        # Bind DN (If your LDAP server doesn't support anonymous binds)
        BindDN                cn=admin,dc=domain,dc=fr
        # Bind Password
        Password      secret
        # Network timeout (in seconds)
        Timeout         15
        # Enable Start TLS
        TLSEnable       yes
        # TLS CA Certificate File
        TLSCACertFile   /etc/openldap/certs/ca.crt
        # TLS CA Certificate Directory
        TLSCACertDir    /etc/openldap/certs
</LDAP>
<Authorization>
        # Base DN
        BaseDN          "ou=People,dc=domain,dc=fr"
        SearchFilter    "(&(uid=%u))"
        # Require Group Membership
        RequireGroup    false
</Authorization>

Client config file :

client
dev tun
proto tcp
remote @IP_VPN 443
persist-key
persist-tun
ca ca.crt
comp-lzo
verb 7
auth-user-pass

And finally, my logs (for the simplicty, I show you the logs in verb 4, but in verb 7 no more informations anyway :

Tue Jun  2 12:00:14 2015 us=513047 OpenVPN 2.3.6 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Dec  2 2014
Tue Jun  2 12:00:14 2015 us=513059 library versions: OpenSSL 1.0.1e-fips 11 Feb 2013, LZO 2.06
AUTH-PAM: BACKGROUND: INIT service='/etc/openvpn/ldap.conf'
Tue Jun  2 12:00:14 2015 us=513739 PLUGIN_INIT: POST /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so '[/usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so] [/etc/openvpn/ldap.conf]' intercepted=PLUGIN_AUTH_USER_PASS_VERIFY 
Tue Jun  2 12:00:14 2015 us=520642 Diffie-Hellman initialized with 2048 bit key
Tue Jun  2 12:00:14 2015 us=520660 WARNING: POTENTIALLY DANGEROUS OPTION --client-cert-not-required may accept clients which do not present a certificate
Tue Jun  2 12:00:14 2015 us=521257 TLS-Auth MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Tue Jun  2 12:00:14 2015 us=521302 Socket Buffers: R=[87380->131072] S=[16384->131072]
Tue Jun  2 12:00:14 2015 us=521408 ROUTE_GATEWAY 194.214.x.x/255.255.255.0 IFACE=eno16780032 HWADDR=00:50:56:8e:98:50
Tue Jun  2 12:00:14 2015 us=521669 TUN/TAP device tun0 opened
Tue Jun  2 12:00:14 2015 us=521691 TUN/TAP TX queue length set to 100
Tue Jun  2 12:00:14 2015 us=521704 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Jun  2 12:00:14 2015 us=521727 /usr/sbin/ip link set dev tun0 up mtu 1500
Tue Jun  2 12:00:14 2015 us=523957 /usr/sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Tue Jun  2 12:00:14 2015 us=526840 /usr/sbin/ip route add 10.8.0.0/24 via 10.8.0.2
Tue Jun  2 12:00:14 2015 us=528083 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Jun  2 12:00:14 2015 us=528111 Listening for incoming TCP connection on [undef]
Tue Jun  2 12:00:14 2015 us=528126 TCPv4_SERVER link local (bound): [undef]
Tue Jun  2 12:00:14 2015 us=528133 TCPv4_SERVER link remote: [undef]
Tue Jun  2 12:00:14 2015 us=528153 MULTI: multi_init called, r=256 v=256
Tue Jun  2 12:00:14 2015 us=528176 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Tue Jun  2 12:00:14 2015 us=528195 IFCONFIG POOL LIST
Tue Jun  2 12:00:14 2015 us=528220 MULTI: TCP INIT maxclients=1024 maxevents=1028
Tue Jun  2 12:00:14 2015 us=528245 Initialization Sequence Completed
Tue Jun  2 12:00:25 2015 us=67744 MULTI: multi_create_instance called
Tue Jun  2 12:00:25 2015 us=67872 Re-using SSL/TLS context
Tue Jun  2 12:00:25 2015 us=67939 LZO compression initialized
Tue Jun  2 12:00:25 2015 us=68137 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Tue Jun  2 12:00:25 2015 us=68183 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Jun  2 12:00:25 2015 us=68269 Local Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Tue Jun  2 12:00:25 2015 us=68315 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Tue Jun  2 12:00:25 2015 us=68356 Local Options hash (VER=V4): 'c0103fa8'
Tue Jun  2 12:00:25 2015 us=68383 Expected Remote Options hash (VER=V4): '69109d17'
Tue Jun  2 12:00:25 2015 us=68432 TCP connection established with [AF_INET]194.214.x.x:57406
Tue Jun  2 12:00:25 2015 us=68454 TCPv4_SERVER link local: [undef]
Tue Jun  2 12:00:25 2015 us=68471 TCPv4_SERVER link remote: [AF_INET]194.214.x.x:57406
Tue Jun  2 12:00:26 2015 us=67978 194.214.124.175:57406 TLS: Initial packet from [AF_INET]194.214.x.x:57406, sid=12db7615 68e17dc7
AUTH-PAM: BACKGROUND: received command code: 0
AUTH-PAM: BACKGROUND: USER: myuser
AUTH-PAM: BACKGROUND: user 'myuser' failed to authenticate: Authentication failure
Tue Jun  2 12:00:26 2015 us=258471 194.214.x.x:57406 PLUGIN_CALL: POST /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
Tue Jun  2 12:00:26 2015 us=258513 194.214.x.x:57406 PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so
Tue Jun  2 12:00:26 2015 us=258598 194.214.x.x:57406 TLS Auth Error: Auth Username/Password verification failed for peer
Tue Jun  2 12:00:26 2015 us=301879 194.214.x.x:57406 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Tue Jun  2 12:00:26 2015 us=301950 194.214.x.x:57406 Peer Connection Initiated with [AF_INET]194.214.124.175:57406
Tue Jun  2 12:00:28 2015 us=622690 194.214.x.x:57406 PUSH: Received control message: 'PUSH_REQUEST'
Tue Jun  2 12:00:28 2015 us=622771 194.214.x.x:57406 Delayed exit in 5 seconds
Tue Jun  2 12:00:28 2015 us=622802 194.214.x.x:57406 SENT CONTROL [UNDEF]: 'AUTH_FAILED' (status=1)
Tue Jun  2 12:00:28 2015 us=662044 194.214.x.x:57406 Connection reset, restarting [0]
Tue Jun  2 12:00:28 2015 us=662094 194.214.x.x:57406 SIGUSR1[soft,connection-reset] received, client-instance restarting
Tue Jun  2 12:00:28 2015 us=662238 TCP/UDP: Closing socket

So, this is my problem, i tried a lot of possibilities but all time the same problem. I'm stuck and I need your help...
Thank you in advance !

florianV

Hi,

Ok, I fixed my problem with an other solution using nss-pam-ldap.

If it can help you...

yum install nss-pam-ldap

/etc/openvpn/server.conf :

plugin /usr/lib64/openvpn/plugin/lib/openvpn-plugin-auth-pam.so openvpn

If you you are using a chroot :

chown -R nobody:nobody /etc/openvpn/jail/

/etc/pam.d/openvpn :

account required pam_ldap.so
auth required pam_ldap.so
password required pam_ldap.so
session required pam_ldap.so

Then edit /etc/nslcd.conf

uri ldaps://ldap_ip
ldap_version 3
base dc=domain,dc=fr
binddn cn=admin,dc=domain,dc=fr
bindpw password_admin

In the client conf file :

auth-user-pass

If you need to debug don't forget journalctl ! Useful wih nslcd 😉

If you have the solution for my first problem or if you have others solutions, i'm interested ! 🙂
Good Bye

varnav

Thanks a lot!
I spent a lot of time trying to figure out how to use OpenVPN + Active Directory + CentOS 7 and this solution finally worked for me.

varnav

Looks like

account required pam_ldap.so
auth required pam_ldap.so
password required pam_ldap.so
session required pam_ldap.so

can be stripped down to

account required pam_ldap.so
auth required pam_ldap.so

brendan

i have been trying to get the openvpn-auth-ldap setup working, and have not been able to. my setup works otherwise, but the auth piece does not work, and when i try to use it, the tunnel does not come up. disable and restart and it works with no auth. any ideas?

server conf:

#plugin /usr/lib64/openvpn/plugin/lib/openvpn-auth-ldap.so "/etc/openvpn/auth/ldap.conf"
mode server
tls-server
local vpn.bpk2.com
port 1194
management 127.0.0.1 7505
proto udp
dev tap0 mktun
script-security 2
up TapUp.sh
ca ca.crt
cert vpn.crt
key vpn.key
tls-auth tls-auth.key 0
dh dh2048.pem
cipher AES-256-CBC
keysize 256
auth sha256
server-bridge
push "redirect-gateway def1"
push "route-gateway dhcp"
passtos
keepalive 10 120
comp-lzo
fast-io
user nobody
group nobody
ping-timer-rem
persist-tun
persist-key
verb 4
mute 20

ldap.conf:

<LDAP>
	# LDAP server URL
	URL		ldap://server1.bpk2.com

	# Bind DN (If your LDAP server doesn't support anonymous binds)
	# BindDN		uid=Manager,ou=People,dc=example,dc=com
	BindDN		cn=Manager,dc=bpk2,dc=com

	# Bind Password
	# Password	SecretPassword
	Password	**REMOVED***

	# Network timeout (in seconds)
	Timeout		15

	# Enable Start TLS
	TLSEnable	no

	# Follow LDAP Referrals (anonymously)
	FollowReferrals yes

	# TLS CA Certificate File
	TLSCACertFile	/usr/local/etc/ssl/ca.pem

	# TLS CA Certificate Directory
	TLSCACertDir	/etc/ssl/certs

	# Client Certificate and key
	# If TLS client authentication is required
	TLSCertFile	/usr/local/etc/ssl/client-cert.pem
	TLSKeyFile	/usr/local/etc/ssl/client-key.pem

	# Cipher Suite
	# The defaults are usually fine here
	# TLSCipherSuite	ALL:!ADH:@STRENGTH
</LDAP>

<Authorization>
	# Base DN
	BaseDN		"ou=domainUsers,ou=Users,dc=bpk2,dc=com"

	# User Search Filter
	# SearchFilter	"(&(uid=%u)(accountStatus=active))"
	SearchFilter	"(uid=%u)"

	# Require Group Membership
	RequireGroup	true

	# Add non-group members to a PF table (disabled)
	#PFTable	ips_vpn_users

	<Group>
		BaseDN		"ou=domainGroups,ou=Groups,dc=bpk2,dc=com"
		SearchFilter	"(cn=vpnUsers)"
		MemberAttribute	member
		# Add group members to a PF table (disabled)
		#PFTable	ips_vpn_eng
	</Group>
</Authorization>

client conf:

client
dev tap
proto udp
remote host.domain.tld
resolv-retry infinite
keepalive 10 120
ping-timer-rem
persist-tun
persist-key
ca ca.crt
cert laptop.crt
key laptop.key
tls-auth tls-auth.key 1
ns-cert-type server
cipher AES-256-CBC
auth sha256
route-delay 10
script-security 2
up "up.sh"
down "down.sh"
pull
comp-lzo
verb 4
mute 20
explicit-exit-notify 2

what i wind up getting is an error in my logs:

TLS Error: Auth Username/Password was not provided by peer

the odd thing is that no credential prompt is seen on the client when the connection attempt is made.

asainsbury

Have you tried changing "RequiredGroup true" to false and testing again?

I'm getting the exact same error (and hence looking for my own solution) and its all down the the "Group" directive not correctly matching the LDAP membership attribute. Its driving me bonkers!

When set to false it works, just anybody inside of the AD tree can also authenticate which kind of defeats the purpose.

When I get the attribute match working I will post back the response.