RemoteOne
I have a bizarre issue that just appeared this morning. I have an OpenVPN GUI Win10 client and server that have not been modified in months. The client is in daily use. The client uses a certificate, and the server used LDAP to authenticate users.
Suddenly, this morning, I could not get a connection.
I verified from a different machine that everything was still working correctly on the server side - so started to look for troubleshooting issues on the client side.
In my client, I had verb 5. In the client log I found that it was reporting
AUTH: Received control message: AUTH_FAILED
ERROR: could not read Auth username/password/ok/string from management interface
I changed the verb to 6 to see if it reported anything extra, and the connection succeeded - no problem.
I changed it back to 5 again, and the connection failed again - same error.
Back to 6 - no problem.
This appears to be some kind of timing issue on the client side.
Is there any delay that I can configure to prevent this happening?
TinCanTech
--verb does not have anything to do with username/password ..
Make sure you do not have any dead openvpn.exe processes hanging around.
For further help, please post your client log at verb 4
RemoteOne
Just to follow up on this, in case anyone else runs into the issue. After further troubleshooting, the pattern mentioned stopped - and the behaviour became inconsistent regardless of the logging. Eventually I found the issue. We use LDAP authentication against AD, and last week a new Domain Controller was added to the network. It seems it is not handling Auth requests from openVPN. The requests from openVPN were ramdomly (or whatever) getting passed to different domain controllers and if they hit the new controller they were failing. In advance of trying to get that part fixed I edited the auth config, and used specific links to the known good DCs instead of just the domain name and everything is happy again.
# Changed to specific DC names as the new dc3 is not handing auth requests at this time
# URL "ldap://mynetwork.net"
URL "ldap://dc1.mynetwork.net:3268 ldap://dc2.mynetwork.net:3268"
