Hello.
I've been using OpenVPN Access Server (with license) in my organization, for a while. It's been working great for about a year, but recently, I upgraded it to version 2.6.1 (from 2.5.x?), and both RADIUS and LDAP authentication no longer work.
Things were previously working well with RADIUS, which has since broken, and I currently have it configured for LDAP, which is slightly less-broken. With RADIUS active, I can no longer use domain credentials to log into the web console or the VPN service. With LDAP active, I can log into the web console with domain credentials, but the VPN client says "Authentication Failed" when I try to connect. Notably, it does so AFTER asking if I want to allow connections to this VPN, in the future, whereas if I just enter a wrong password, it never gets that far. All users in my organization who have tried to connect to the server have experienced the same symptoms.
On the server, there are a bunch of these in /var/log/openvpnas.log (with IP address redacted):
2019-03-15T12:56:07-0700 [stdout#info] [OVPN 0] OUT: 'Fri Mar 15 19:56:07 2019 TCP connection established with [AF_INET]IPADDRESS:62075'
2019-03-15T12:56:07-0700 [stdout#info] [OVPN 0] OUT: 'Fri Mar 15 19:56:07 2019 Socket flags: TCP_NODELAY=1 succeeded'
2019-03-15T12:56:07-0700 [stdout#info] [OVPN 0] OUT: 'Fri Mar 15 19:56:07 2019 IPADDRESS:62075 TLS: Initial packet from [AF_INET]73.2.122.101:62075, sid=e97e05fe 435e76e6'
2019-03-15T12:56:07-0700 [stdout#info] [OVPN 0] OUT: 'Fri Mar 15 19:56:07 2019 IPADDRESS:62075 TLS Error: reading acknowledgement record from packet'
2019-03-15T12:56:07-0700 [stdout#info] [OVPN 0] OUT: 'Fri Mar 15 19:56:07 2019 IPADDRESS:62075 Fatal TLS error (check_tls_errors_co), restarting'
2019-03-15T12:56:07-0700 [stdout#info] [OVPN 0] OUT: 'Fri Mar 15 19:56:07 2019 IPADDRESS:62075 SIGUSR1[soft,tls-error] received, client-instance restarting'
This is in MYDOMAIN.log on the client:
Fri Mar 15 15:28:05 2019 Fri Mar 15 15:28:05 2019 VERIFY OK : depth=0
cert. version : 3
serial number : 01
issuer name : CN=OpenVPN CA
subject name : CN=OpenVPN Server
issued on : 2018-09-25 21:42:14
expires on : 2028-09-29 21:42:14
signed using : RSA with SHA-256
RSA key size : 2048 bits
basic constraints : CA=false
cert. type : SSL Server
Fri Mar 15 15:28:05 2019 Fri Mar 15 15:28:05 2019 SSL Handshake: TLSv1.2/TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384
Fri Mar 15 15:28:05 2019 Fri Mar 15 15:28:05 2019 Session is ACTIVE
Fri Mar 15 15:28:05 2019 Fri Mar 15 15:28:05 2019 GET_CONFIG
Fri Mar 15 15:28:05 2019 Fri Mar 15 15:28:05 2019 Sending PUSH_REQUEST to server...
Fri Mar 15 15:28:05 2019 Fri Mar 15 15:28:05 2019 AUTH_FAILED
Fri Mar 15 15:28:05 2019 Fri Mar 15 15:28:05 2019 AUTH_FAILED [FATAL-ERR]
Fri Mar 15 15:28:05 2019 Fri Mar 15 15:28:05 2019 DISCONNECTED
Since the client app was downloaded from the server, which generated it, I would expect the client/server configurations to be compatible...but I could be wrong.
I've been working on this for a couple days, now, and I'm completely at a loss as to what the problem might be. Do any of you kind folks have an idea?
Thank-you.
