Good morning,
I'm trying to configure a VPN as step 5 of Harden OpenVPN
https://www.linode.com/docs/networking/vpn/set-up-a-hardened-openvpn-server#harden-openvpn.
server - openvpn 2.3.4
server.conf
port 1194
proto udp
dev tun
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key # This file should be kept secret
dh dh4096.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-to-client
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0 # This file is secret
comp-lzo
user openvpn_server
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
cipher AES-256-CBC
auth SHA512
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-256-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA:TLS-DHE-RSA-WITH-AES-128-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA
client - openvpn 2.2.1
client.conf
client
dev tun
proto udp
remote x.x.x.x 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca /etc/openvpn/linode-openvpn/ca.crt
cert /etc/openvpn/linode-openvpn/diego-notebook.crt
key /etc/openvpn/linode-openvpn/diego-notebook.key
ns-cert-type server
tls-auth /etc/openvpn/linode-openvpn/ta.key 1
cipher AES-256-CBC
auth SHA512
tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA:TLS-DHE-RSA-WITH-3DES-EDE-CBC-SHA:TLS-DHE-RSA-WITH-AES-128-CBC-SHA:TLS-DHE-RSA-WITH-SEED-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA:TLS-DHE-RSA-WITH-DES-CBC-SHA
comp-lzo
verb 3
Error:
Fri Mar 25 14:27:23 2016 Problem with cipher list: TLS-DHE-RSA-WITH-AES-256-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA:TLS-DHE-RSA-WITH-3DES-EDE-CBC-SHA:TLS-DHE-RSA-WITH-AES-128-CBC-SHA:TLS-DHE-RSA-WITH-SEED-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA:TLS-DHE-RSA-WITH-DES-CBC-SHA: error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match
Fri Mar 25 14:27:23 2016 Exiting
if I use non IANA naming in server and in client:
tls-cipher DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-CAMELLIA256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-CAMELLIA128-SHA256
Error in client:
Fri Mar 25 14:30:05 2016 TLS_ERROR: BIO read tls_read_plaintext error: error:140830B5:SSL routines:SSL3_CLIENT_HELLO:no ciphers available
Fri Mar 25 14:30:05 2016 TLS Error: TLS object -> incoming plaintext read error
Fri Mar 25 14:30:05 2016 TLS Error: TLS handshake failed
Fri Mar 25 14:30:05 2016 TCP/UDP: Closing socket
Fri Mar 25 14:30:05 2016 SIGUSR1[soft,tls-error] received, process restarting
Fri Mar 25 14:30:05 2016 Restart pause, 2 second(s)
Error in server:
Fri Mar 25 14:31:04 2016 myip:55928 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Fri Mar 25 14:31:04 2016 myip:55928 TLS Error: TLS handshake failed
Fri Mar 25 14:31:04 2016 myip:55928 SIGUSR1[soft,tls-error] received, client-instance restarting
But if I use NetworkManager importing client.conf the connection is successful:
(tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-256-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA:TLS-DHE-RSA-WITH-AES-128-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA)
Fri Mar 25 14:51:27 2016 myip:52104 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Mar 25 14:51:27 2016 myip:52104 Data Channel Encrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Fri Mar 25 14:51:27 2016 myip:52104 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Mar 25 14:51:27 2016 myip:52104 Data Channel Decrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Fri Mar 25 14:51:27 2016 myip:52104 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Fri Mar 25 14:51:27 2016 myip:52104 [diego-notebook] Peer Connection Initiated with [AF_INET]myip:52104
Fri Mar 25 14:51:27 2016 diego-notebook/myip:52104 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Fri Mar 25 14:51:27 2016 diego-notebook/myip:52104 MULTI: Learn: 10.8.0.6 -> diego-notebook/myip:52104
Fri Mar 25 14:51:27 2016 diego-notebook/myip:52104 MULTI: primary virtual IP for diego-notebook/myip: 10.8.0.6
Fri Mar 25 14:51:30 2016 diego-notebook/myip:52104 PUSH: Received control message: 'PUSH_REQUEST'
Fri Mar 25 14:51:30 2016 diego-notebook/myip:52104 send_push_reply(): safe_cap=940
Fri Mar 25 14:51:30 2016 diego-notebook/myip:52104 SENT CONTROL [diego-notebook]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
:?:
cheers
