Hi,
We're using 2.0.24 Access Server and Duo Security
https://duo.com as a 2FA. We have one user who can't connect to VPN with Ubuntu. The Ubuntu is originally 14.04 and has been upgraded to 16.04. The user can log in with Windows client, but not with Ubuntu.
-The user is connecting with command
sudo openvpn --auth-retry interact --config ~/Downloads/client.ovpn
-User inputs his username and password. There's an error
LDAP invalid credentials on ... if the username or password is wrong so they can't be wrong.
-Then the client asks for Duo passcode or second factor.
-If the user writes wrong passcode, there's error
Incorrect passcode. Please try again.
-If the user writes correct passcode, there's
AUTH_FAILED error on client side and
'password': omi/auth:382 (exceptions.KeyError) on web client.
Google doesn't find anything with
'password': omi/auth:382 (exceptions.KeyError)
With the same computer I could connect with my own client.ovpn file. I've checked with a comparison tool that the .ovpn configuration files differ only from user names and certificates.
Here's log from server side when the user tries to connect:
OVPN 1 OUT: 'Fri Jan 20 15:51:54 2017 193.97.x.x:9864 TLS: Initial packet from [AF_INET]193.97.x.x:9864, sid=229302a2 3db33997'
OVPN 1 OUT: 'Fri Jan 20 15:51:54 2017 193.97.x.x:9864 VERIFY OK: depth=1, /CN=OpenVPN CA'
OVPN 1 OUT: 'Fri Jan 20 15:51:54 2017 193.97.x.x:9864 VERIFY OK: nsCertType=CLIENT'
OVPN 1 OUT: 'Fri Jan 20 15:51:54 2017 193.97.x.x:9864 VERIFY OK: depth=0, /CN=yoman_user'
OVPN 1 OUT: 'Fri Jan 20 15:51:54 2017 193.97.x.x:9864 peer info: IV_VER=2.3.10'
OVPN 1 OUT: 'Fri Jan 20 15:51:54 2017 193.97.x.x:9864 peer info: IV_PLAT=linux'
OVPN 1 OUT: 'Fri Jan 20 15:51:54 2017 193.97.x.x:9864 peer info: IV_PROTO=2'
OVPN 1 OUT: 'Fri Jan 20 15:51:54 2017 193.97.x.x:9864 peer info: IV_HWADDR=40:f0:2f:4b:91:b5'
OVPN 1 OUT: 'Fri Jan 20 15:51:54 2017 193.97.x.x:9864 peer info: IV_SSL=OpenSSL_1.0.2g__1_Mar_2016'
VPN Auth Failed: "'password': omi/auth:382 (exceptions.KeyError)" [None]
OVPN 1 OUT: 'Fri Jan 20 15:51:54 2017 193.97.x.x:9864 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA'
OVPN 1 OUT: 'Fri Jan 20 15:51:54 2017 193.97.x.x:9864 [yoman_user] Peer Connection Initiated with [AF_INET]193.97.x.x:9864'
OVPN 1 OUT: 'Fri Jan 20 15:51:54 2017 MANAGEMENT: CMD \'client-deny 186 0 "AS auth failed"\''
OVPN 1 OUT: 'Fri Jan 20 15:51:54 2017 MULTI: connection rejected: AS auth failed, CLI:[NULL]'
OVPN 1 OUT: 'Fri Jan 20 15:51:57 2017 193.97.x.x:9864 Delayed exit in 5 seconds'
OVPN 1 OUT: "Fri Jan 20 15:51:57 2017 193.97.x.x:9864 SENT CONTROL [yoman_user]: 'AUTH_FAILED' (status=1)"
OVPN 1 OUT: 'Fri Jan 20 15:52:02 2017 193.97.x.x:9864 SIGTERM[soft,delayed-exit] received, client-instance exiting'
Here's my connection log with the same computer from server side.
OVPN 1 OUT: 'Mon Jan 23 11:31:18 2017 193.97.x.x:36492 TLS: Initial packet from [AF_INET]193.97.x.x:36492, sid=1c967b6f 7819c4f0'
OVPN 1 OUT: 'Mon Jan 23 11:31:18 2017 193.97.x.x:36492 VERIFY OK: depth=1, /CN=OpenVPN CA'
OVPN 1 OUT: 'Mon Jan 23 11:31:18 2017 193.97.x.x:36492 VERIFY OK: nsCertType=CLIENT'
OVPN 1 OUT: 'Mon Jan 23 11:31:18 2017 193.97.x.x:36492 VERIFY OK: depth=0, /CN=mursu_user'
OVPN 1 OUT: 'Mon Jan 23 11:31:18 2017 193.97.x.x:36492 peer info: IV_VER=2.3.10'
OVPN 1 OUT: 'Mon Jan 23 11:31:18 2017 193.97.x.x:36492 peer info: IV_PLAT=linux'
OVPN 1 OUT: 'Mon Jan 23 11:31:18 2017 193.97.x.x:36492 peer info: IV_PROTO=2'
OVPN 1 OUT: 'Mon Jan 23 11:31:18 2017 193.97.x.x:36492 peer info: IV_HWADDR=40:f0:2f:4b:91:b5'
OVPN 1 OUT: 'Mon Jan 23 11:31:18 2017 193.97.x.x:36492 peer info: IV_SSL=OpenSSL_1.0.2g__1_Mar_2016'
OVPN 1 OUT: 'Mon Jan 23 11:31:18 2017 193.97.x.x:36492 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA'
OVPN 1 OUT: 'Mon Jan 23 11:31:18 2017 193.97.x.x:36492 [mursu_user] Peer Connection Initiated with [AF_INET]193.97.x.x:36492'
VPN Auth Failed: 'challenge' ['CRV1:R,E:t3s5ltqg37yTrLKCIFQVlzNqCkzpKB2U:aWlzdGk=:Duo passcode or second factor:']
OVPN 1 OUT: 'Mon Jan 23 11:31:18 2017 MANAGEMENT: CMD \'client-deny 263 0 "AS auth failed" "CRV1:R,E:t3s5ltqg37yTrLKCIFQVlzNqCkzpKB2U:aWlzdGk=:Duo passcode or second factor:"\''
OVPN 1 OUT: 'Mon Jan 23 11:31:18 2017 MULTI: connection rejected: AS auth failed, CLI:CRV1:R,E:t3s5ltqg37yTrLKCIFQVlzNqCkzpKB2U:aWlzdGk=:Duo passcode or second factor:'
OVPN 1 OUT: 'Mon Jan 23 11:31:20 2017 193.97.x.x:36492 Delayed exit in 5 seconds'
OVPN 1 OUT: "Mon Jan 23 11:31:20 2017 193.97.x.x:36492 SENT CONTROL [mursu_user]: 'AUTH_FAILED,CRV1:R,E:t3s5ltqg37yTrLKCIFQVlzNqCkzpKB2U:aWlzdGk=:Duo passcode or second factor:' (status=1)"
OVPN 1 OUT: 'Mon Jan 23 11:31:25 2017 193.97.x.x:36492 SIGTERM[soft,delayed-exit] received, client-instance exiting'
OVPN 1 OUT: 'Mon Jan 23 11:31:37 2017 193.97.x.x:16508 TLS: Initial packet from [AF_INET]193.97.x.x:16508, sid=4b877310 26d16e05'
OVPN 1 OUT: 'Mon Jan 23 11:31:37 2017 193.97.x.x:16508 VERIFY OK: depth=1, /CN=OpenVPN CA'
OVPN 1 OUT: 'Mon Jan 23 11:31:37 2017 193.97.x.x:16508 VERIFY OK: nsCertType=CLIENT'
OVPN 1 OUT: 'Mon Jan 23 11:31:37 2017 193.97.x.x:16508 VERIFY OK: depth=0, /CN=mursu_user'
OVPN 1 OUT: 'Mon Jan 23 11:31:37 2017 193.97.x.x:16508 peer info: IV_VER=2.3.10'
OVPN 1 OUT: 'Mon Jan 23 11:31:37 2017 193.97.x.x:16508 peer info: IV_PLAT=linux'
OVPN 1 OUT: 'Mon Jan 23 11:31:37 2017 193.97.x.x:16508 peer info: IV_PROTO=2'
OVPN 1 OUT: 'Mon Jan 23 11:31:37 2017 193.97.x.x:16508 peer info: IV_HWADDR=40:f0:2f:4b:91:b5'
OVPN 1 OUT: 'Mon Jan 23 11:31:37 2017 193.97.x.x:16508 peer info: IV_SSL=OpenSSL_1.0.2g__1_Mar_2016'
OVPN 1 OUT: 'Mon Jan 23 11:31:37 2017 193.97.x.x:16508 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA'
OVPN 1 OUT: 'Mon Jan 23 11:31:37 2017 193.97.x.x:16508 [mursu_user] Peer Connection Initiated with [AF_INET]193.97.x.x:16508'
AUTH SUCCESS {'status': 0, 'reason': u'Success. Logging you in...', 'serial_list': [], 'user': u'mursu_user', 'proplist': {u'prop_autogenerate': u'true'}, 'common_name': u'mursu_user', 'client_reason': u'Success. Logging you in...', 'serial': '2'} cli=u'linux'/u'2.3.10'
OVPN 1 OUT: "Mon Jan 23 11:31:54 2017 MANAGEMENT: CMD 'client-auth 264 0'"
OVPN 1 OUT: 'Mon Jan 23 11:31:58 2017 mursu_user/193.97.x.x:16508 OPTIONS IMPORT: compression parms modified'
OVPN 1 OUT: 'Mon Jan 23 11:31:58 2017 mursu_user/193.97.x.x:16508 MULTI: Learn: 10.121.145.190 -> mursu_user/193.97.x.x:16508'
OVPN 1 OUT: 'Mon Jan 23 11:31:58 2017 mursu_user/193.97.x.x:16508 MULTI: primary virtual IP for mursu_user/193.97.x.x:16508: 10.121.145.190'
OVPN 1 OUT: 'Mon Jan 23 11:32:03 2017 mursu_user/193.97.x.x:16508 send_push_reply(): safe_cap=940'
OVPN 1 OUT: "Mon Jan 23 11:32:03 2017 mursu_user/193.97.x.x:16508 SENT CONTROL [mursu_user]: 'PUSH_REPLY,explicit-exit-notify,topology subnet,route-delay 5 30,dhcp-pre-release,dhcp-renew,dhcp-release,route-metric 101,ping 12,ping-restart 50,auth-token SESS_ID,comp-lzo yes,redirect-gateway def1,redirect-gateway bypass-dhcp,redirect-gateway autolocal,route-gateway 10.121.145.129,dhcp-option DNS 192.168.1.20,dhcp-option DNS 192.168.1.9,dhcp-option DOMAIN huuhaa-main.huuhaa.com,register-dns,block-ipv6,ifconfig 10.121.145.190 255.255.255.128' (status=1)"
