OpenVPN HMAC Error

snoberdale

Gentlemen,

I'm at my wit's end to configure OpenVPN for our client and cannot seem to crack this. I'm just trying to setup OpenVPN with authentication and possibly with Dual factor though I haven't started to get to it yet. We need to at least make OpenVPN authenticate users first before thinking of setting up Dual Factor.
Can some expert take a look and let me know what I'm doing wrong.
Appreciate any input.

port 443
proto tcp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt
push "route 10.1.0.0 255.255.0.0"
push "route 10.3.0.0 255.255.0.0"
push "dhcp-option DNS 10.x.x.x"
push "dhcp-option DNS 10.x.x.x"
push "dhcp-option DOMAIN bbc.local"
keepalive 10 120
tls-auth ta.key 0 # This file is secret
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
verb 9
explicit-exit-notify 0
verify-client-cert none
username-as-common-name
tmp-dir "/etc/openvpn/tmp/"
plugin /usr/lib/x86_64-linux-gnu/openvpn/plugins/openvpn-plugin-auth-pam.so /etc/pam.d/common-session

client
dev tun
proto tcp
remote 54.159.142.118 443
nobind
user nobody
group nogroup
persist-key
persist-tun
remote-cert-tls server
tls-auth ta.key 1
cipher AES-256-CBC
verb 9
auth-user-pass
<ca>
xxx
</ca>
<cert>
xxx
</cert>
<tls-auth>
xxx
</tls-auth>

Server Logs:

Jul  7 15:14:55 vpn ovpn-server[10009]: EP_WAIT[0] rwflags=0x0001 ev=0x00000001 arg=0x00000001
Jul  7 15:14:55 vpn ovpn-server[10009]: MULTI: REAP range 32 -> 48
Jul  7 15:14:55 vpn ovpn-server[10009]: MULTI: multi_create_instance called
Jul  7 15:14:55 vpn ovpn-server[10009]: PO_INIT maxevents=4 flags=0x00000002
Jul  7 15:14:55 vpn ovpn-server[10009]: Re-using SSL/TLS context
Jul  7 15:14:55 vpn ovpn-server[10009]: crypto_adjust_frame_parameters: Adjusting frame parameters for crypto by 28 bytes
Jul  7 15:14:55 vpn ovpn-server[10009]: TLS: tls_session_init: entry
Jul  7 15:14:55 vpn ovpn-server[10009]: PID packet_id_init seq_backtrack=64 time_backtrack=15
Jul  7 15:14:55 vpn ovpn-server[10009]: PID packet_id_init seq_backtrack=64 time_backtrack=15
Jul  7 15:14:55 vpn ovpn-server[10009]: TLS: tls_session_init: new session object, sid=b8199994 bc05fcc9
Jul  7 15:14:55 vpn ovpn-server[10009]: TLS: tls_session_init: entry
Jul  7 15:14:55 vpn ovpn-server[10009]: PID packet_id_init seq_backtrack=64 time_backtrack=15
Jul  7 15:14:55 vpn ovpn-server[10009]: PID packet_id_init seq_backtrack=64 time_backtrack=15
Jul  7 15:14:55 vpn ovpn-server[10009]: TLS: tls_session_init: new session object, sid=f27137e7 72d90f99
Jul  7 15:14:55 vpn ovpn-server[10009]: Control Channel MTU parms [ L:1623 D:1182 EF:68 EB:0 ET:0 EL:3 ]
Jul  7 15:14:55 vpn ovpn-server[10009]: MTU DYNAMIC mtu=1450, flags=2, 1623 -> 1450
Jul  7 15:14:55 vpn ovpn-server[10009]: Data Channel MTU parms [ L:1623 D:1450 EF:123 EB:406 ET:0 EL:3 ]
Jul  7 15:14:55 vpn ovpn-server[10009]: crypto_adjust_frame_parameters: Adjusting frame parameters for crypto by 56 bytes
Jul  7 15:14:55 vpn ovpn-server[10009]: calc_options_string_link_mtu: link-mtu 1623 -> 1559
Jul  7 15:14:55 vpn ovpn-server[10009]: crypto_adjust_frame_parameters: Adjusting frame parameters for crypto by 56 bytes
Jul  7 15:14:55 vpn ovpn-server[10009]: calc_options_string_link_mtu: link-mtu 1623 -> 1559
Jul  7 15:14:55 vpn ovpn-server[10009]: Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1559,tun-mtu 1500,proto TCPv4_SERVER,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Jul  7 15:14:55 vpn ovpn-server[10009]: Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1559,tun-mtu 1500,proto TCPv4_CLIENT,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Jul  7 15:14:55 vpn ovpn-server[10009]: STREAM: RESET
Jul  7 15:14:55 vpn ovpn-server[10009]: STREAM: INIT maxlen=1626
Jul  7 15:14:55 vpn ovpn-server[10009]: TCP connection established with [AF_INET]165.225.48.84:21636
Jul  7 15:14:55 vpn ovpn-server[10009]: TCPv4_SERVER link local: (not bound)
Jul  7 15:14:55 vpn ovpn-server[10009]: TCPv4_SERVER link remote: [AF_INET]165.225.48.84:21636
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 SENT PING
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 TIMER: coarse timer wakeup 1 seconds
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 TLS: tls_multi_process: i=0 state=S_INITIAL, mysid=b8199994 bc05fcc9, stored-sid=00000000 00000000, stored-ip=[AF_INET]165.225.48.84:21636
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 TLS: tls_process: chg=0 ks=S_INITIAL lame=S_UNDEF to_link->len=0 wakeup=604800
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 ACK mark active outgoing ID 0
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 TLS: Initial Handshake, sid=b8199994 bc05fcc9
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 ACK reliable_can_send active=1 current=1 : [1] 0
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 SSL state (accept): before SSL initialization
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 TLS: tls_process: chg=1 ks=S_PRE_START lame=S_UNDEF to_link->len=0 wakeup=604800
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 ACK reliable_can_send active=1 current=1 : [1] 0
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 ACK reliable_send_timeout 0 [1] 0
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 TLS: tls_process: timeout set to 1
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 TLS: tls_multi_process: i=1 state=S_INITIAL, mysid=f27137e7 72d90f99, stored-sid=00000000 00000000, stored-ip=[AF_UNSPEC]
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 TLS: tls_multi_process: i=2 state=S_UNDEF, mysid=00000000 00000000, stored-sid=00000000 00000000, stored-ip=[AF_UNSPEC]
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 RANDOM USEC=9481
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 SCHEDULE: schedule_add_modify wakeup=[Tue Jul  7 15:14:56 2020 us=959704] pri=0
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 MULTI TCP: instance added: 165.225.48.84:21636
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 MULTI TCP: multi_tcp_action a=TA_INITIAL p=0
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 MULTI TCP: multi_tcp_dispatch a=TA_INITIAL mi=0x55dc86926c00
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 STREAM: SET NEXT, buf=[532,0] next=[532,1626] len=-1 maxlen=1626
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 EP_CTL fd=12 rwflags=0x0001 ev=0x00000001 arg=0x55dc86926c00
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 TLS: tls_multi_process: i=0 state=S_PRE_START, mysid=b8199994 bc05fcc9, stored-sid=00000000 00000000, stored-ip=[AF_INET]165.225.48.84:21636
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 TLS: tls_process: chg=0 ks=S_PRE_START lame=S_UNDEF to_link->len=0 wakeup=604800
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 ACK reliable_can_send active=1 current=1 : [1] 0
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 ACK reliable_send_timeout 0 [1] 0
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 TLS: tls_process: timeout set to 1
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 TLS: tls_multi_process: i=1 state=S_INITIAL, mysid=f27137e7 72d90f99, stored-sid=00000000 00000000, stored-ip=[AF_UNSPEC]
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 TLS: tls_multi_process: i=2 state=S_UNDEF, mysid=00000000 00000000, stored-sid=00000000 00000000, stored-ip=[AF_UNSPEC]
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 STREAM: SET NEXT, buf=[532,0] next=[532,1626] len=-1 maxlen=1626
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 MULTI TCP: multi_tcp_post TA_INITIAL -> TA_UNDEF
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 SCHEDULE: schedule_find_least wakeup=[Tue Jul  7 15:14:56 2020 us=959704] pri=980370454
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 EP_WAIT[0] rwflags=0x0001 ev=0x00000001 arg=0x55dc86926c00
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 MULTI TCP: multi_tcp_action a=TA_SOCKET_READ p=0
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 MULTI TCP: multi_tcp_dispatch a=TA_SOCKET_READ mi=0x55dc86926c00
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 STREAM: GET NEXT len=1626
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 STREAM: ADD length_added=44
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 STREAM: ADD returned TRUE, buf_len=42, residual_len=0
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 STREAM: GET FINAL len=42
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 STREAM: RESET
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 TCPv4_SERVER read returned 42
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 TCPv4_SERVER READ [42] from [AF_INET]165.225.48.84:21636: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 sid=568147e0 029d0b1d tls_hmac=e5f3125d 039d9e33 0ac92777 d7bcd7bc 80189493 pid=[ #1 / time = (1594134895) Tue Jul  7 15:14:55 2020 ] [ ] pid=0 DATA
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 TLS: control channel, op=P_CONTROL_HARD_RESET_CLIENT_V2, IP=[AF_INET]165.225.48.84:21636
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 TLS: initial packet test, i=0 state=S_PRE_START, mysid=b8199994 bc05fcc9, rec-sid=568147e0 029d0b1d, rec-ip=[AF_INET]165.225.48.84:21636, stored-sid=00000000 00000000, stored-ip=[AF_INET]165.225.48.84:21636
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 TLS: initial packet test, i=1 state=S_INITIAL, mysid=f27137e7 72d90f99, rec-sid=568147e0 029d0b1d, rec-ip=[AF_INET]165.225.48.84:21636, stored-sid=00000000 00000000, stored-ip=[AF_UNSPEC]
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 TLS: initial packet test, i=2 state=S_UNDEF, mysid=00000000 00000000, rec-sid=568147e0 029d0b1d, rec-ip=[AF_INET]165.225.48.84:21636, stored-sid=00000000 00000000, stored-ip=[AF_UNSPEC]
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 TLS: Initial packet from [AF_INET]165.225.48.84:21636, sid=568147e0 029d0b1d
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 DECRYPT FROM: e5f3125d 039d9e33 0ac92777 d7bcd7bc 80189493 00000001 5f04916f 3856814[more...]
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 Authenticate/Decrypt packet error: packet HMAC authentication failed
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 TLS Error: incoming packet authentication failed from [AF_INET]165.225.48.84:21636
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 TLS: tls_multi_process: i=0 state=S_PRE_START, mysid=b8199994 bc05fcc9, stored-sid=00000000 00000000, stored-ip=[AF_INET]165.225.48.84:21636
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 TLS: tls_process: chg=0 ks=S_PRE_START lame=S_UNDEF to_link->len=0 wakeup=604800
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 ACK reliable_can_send active=1 current=1 : [1] 0
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 ACK reliable_send_timeout 0 [1] 0
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 TLS: tls_process: timeout set to 1
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 TLS: tls_multi_process: i=1 state=S_INITIAL, mysid=f27137e7 72d90f99, stored-sid=00000000 00000000, stored-ip=[AF_UNSPEC]
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 TLS: tls_multi_process: i=2 state=S_UNDEF, mysid=00000000 00000000, stored-sid=00000000 00000000, stored-ip=[AF_UNSPEC]
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 Fatal TLS error (check_tls_errors_co), restarting
Jul  7 15:14:55 vpn ovpn-server[10009]: 165.225.48.84:21636 SIGUSR1[soft,tls-error] received, client-instance restarting
Jul  7 15:14:55 vpn ovpn-server[10009]: MULTI: multi_close_instance called
Jul  7 15:14:55 vpn ovpn-server[10009]: EP_DEL ev=12
Jul  7 15:14:55 vpn ovpn-server[10009]: PID packet_id_free
Jul  7 15:14:55 vpn ovpn-server[10009]: message repeated 7 times: [ PID packet_id_free]
Jul  7 15:14:55 vpn ovpn-server[10009]: TCP/UDP: Closing socket
Jul  7 15:14:55 vpn ovpn-server[10009]: PID packet_id_free

TinCanTech

--verb 9 is only useful for debugging code.

Use --verb 4

HMAC errors are due to an incorrect --tls-auth key (or --key-direction)

snoberdale

Thank you very much for the pointer. I wiped the config files and redid everything commenting out tls-auth. It works as expected!

snoberdale

Posting for others - FINAL Working configuration.

port 443
proto tcp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt
push "route 10.1.0.0 255.255.0.0"
push "route 10.3.0.0 255.255.0.0"
push "dhcp-option DNS 10.x.x.x"
push "dhcp-option DNS 10.x.x.x"
push "dhcp-option DOMAIN bbc.local"
keepalive 10 120
#tls-auth ta.key 0 # This file is secret
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
verb 4
explicit-exit-notify 0
verify-client-cert none
username-as-common-name
tmp-dir "/etc/openvpn/tmp/"
plugin /usr/lib/x86_64-linux-gnu/openvpn/plugins/openvpn-plugin-auth-pam.so /etc/pam.d/common-session

client
dev tun
proto tcp
remote 54.x.x.x 443
nobind
user nobody
group nogroup
persist-key
persist-tun
remote-cert-tls server
#tls-auth ta.key 1
cipher AES-256-CBC
verb 4
auth-user-pass
<ca>
</ca>
<cert>
</cert>
<key>
</key>
</oconf>

TinCanTech

snoberdale wrote redid everything commenting out tls-auth. It works as expected

Which is a poor decision. It is strongly recommended that you use --tls-auth or --tls-crypt

snoberdale

Thank you. I will definitely consider implementing this as well as some hardening once we get our base setup working.