vpn user is randomly disconnected

guy3145

Hi

i have 50 vpn users. i have issues with one user who keeps disconnecting from the VPN server randomly usually between minutes to one hour.
on the access server in the syslog file I see this:
any ideas?
thanks!

Jul 21 10:15:48 XXXX ovpn-server[1249]: 77.138.177.99:61087 TLS: Initial packet from [AF_INET]77.138.177.99:61087, sid=5e84a29b 8193f145
Jul 21 10:15:48 XXXX ovpn-server[1249]: 77.138.177.99:61087 CRL CHECK OK: C=US, ST=CA, L=SanFrancisco, O=SF, OU=MyOrganizationalUnit, CN=SF CA, name=server, emailAddress=me@myhost.mydomain
Jul 21 10:15:48 XXX ovpn-server[1249]: 77.138.177.99:61087 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=SF, OU=MyOrganizationalUnit, CN=SF CA, name=server, emailAddress=me@myhost.mydomain
Jul 21 10:15:48 XXXX ovpn-server[1249]: 77.138.177.99:61087 CRL CHECK OK: C=IL, ST=IL, L=IL, O=XXXX, OU=XXXX, CN=XXXXX, name=server, emailAddress=DOTAN@XXXX.COM
Jul 21 10:15:48 XXXXX ovpn-server[1249]: 77.138.177.99:61087 VERIFY OK: depth=0, C=IL, ST=IL, L=IL, O=XXXX, OU=SILVERFORT, CN=XXXX, name=server, emailAddress=DOTAN@XXXXX.COM
Jul 21 10:15:48 XXXX ovpn-server[1249]: 77.138.177.99:61087 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-plugin-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
Jul 21 10:15:48 XXXXX ovpn-server[1249]: 77.138.177.99:61087 PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/lib/openvpn/openvpn-plugin-auth-pam.so
Jul 21 10:15:48 XXXX ovpn-server[1249]: 77.138.177.99:61087 TLS Auth Error: Auth Username/Password verification failed for peer
Jul 21 10:15:48 XXXXX ovpn-server[1249]: 77.138.177.99:61087 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Jul 21 10:15:48 XXXX ovpn-server[1249]: 77.138.177.99:61087 [XXXXX] Peer Connection Initiated with [AF_INET]77.138.177.99:61087
Jul 21 10:15:48 XXXX ovpn-server[1249]: 77.138.177.99:61087 PUSH: Received control message: 'PUSH_REQUEST'
Jul 21 10:15:48 XXXX ovpn-server[1249]: 77.138.177.99:61087 Delayed exit in 5 seconds
Jul 21 10:15:48 XXXXX ovpn-server[1249]: 77.138.177.99:61087 SENT CONTROL [SILVERFORT]: 'AUTH_FAILED' (status=1)
Jul 21 10:15:53 XXXXX ovpn-server[1249]: 77.138.177.99:61087 SIGTERM[soft,delayed-exit] received, client-instance exiting

Pippin

Is this about OpenVPN Access Server or Community version?

guy3145

community version

TinCanTech

guy3145 wrote Jul 21 10:15:48 XXXX ovpn-server[1249]: 77.138.177.99:61087 TLS: Initial packet from [AF_INET]77.138.177.99:61087, sid=5e84a29b 8193f145
Jul 21 10:15:48 XXXX ovpn-server[1249]: 77.138.177.99:61087 CRL CHECK OK: C=US, ST=CA, L=SanFrancisco, O=SF, OU=MyOrganizationalUnit, CN=SF CA, name=server, emailAddress=me@myhost.mydomain
Jul 21 10:15:48 XXX ovpn-server[1249]: 77.138.177.99:61087 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=SF, OU=MyOrganizationalUnit, CN=SF CA, name=server, emailAddress=me@myhost.mydomain
Jul 21 10:15:48 XXXX ovpn-server[1249]: 77.138.177.99:61087 CRL CHECK OK: C=IL, ST=IL, L=IL, O=XXXX, OU=XXXX, CN=XXXXX, name=server, emailAddress=DOTAN@XXXX.COM
Jul 21 10:15:48 XXXXX ovpn-server[1249]: 77.138.177.99:61087 VERIFY OK: depth=0, C=IL, ST=IL, L=IL, O=XXXX, OU=SILVERFORT, CN=XXXX, name=server, emailAddress=DOTAN@XXXXX.COM
Jul 21 10:15:48 XXXX ovpn-server[1249]: 77.138.177.99:61087 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-plugin-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
Jul 21 10:15:48 XXXXX ovpn-server[1249]: 77.138.177.99:61087 PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/lib/openvpn/openvpn-plugin-auth-pam.so
Jul 21 10:15:48 XXXX ovpn-server[1249]: 77.138.177.99:61087 TLS Auth Error: Auth Username/Password verification failed for peer
Jul 21 10:15:48 XXXXX ovpn-server[1249]: 77.138.177.99:61087 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Jul 21 10:15:48 XXXX ovpn-server[1249]: 77.138.177.99:61087 [XXXXX] Peer Connection Initiated with [AF_INET]77.138.177.99:61087
Jul 21 10:15:48 XXXX ovpn-server[1249]: 77.138.177.99:61087 PUSH: Received control message: 'PUSH_REQUEST'
Jul 21 10:15:48 XXXX ovpn-server[1249]: 77.138.177.99:61087 Delayed exit in 5 seconds
Jul 21 10:15:48 XXXXX ovpn-server[1249]: 77.138.177.99:61087 SENT CONTROL [SILVERFORT]: 'AUTH_FAILED' (status=1)
Jul 21 10:15:53 XXXXX ovpn-server[1249]: 77.138.177.99:61087 SIGTERM[soft,delayed-exit] received, client-instance exiting

guy3145

this is happening in the middle of the work out of nowhere, the user did not initiate a disconnect or reconnect action

TinCanTech

Then why did you post this log above ?

https://forums.openvpn.net/viewtopic.php?f=30&t=22603

guy3145

because this error is repeating for the user who get disconnected all the time

TinCanTech

The log shows that either:

the user has the wrong credentials
or the server is setup incorrectly

Considering you have ~50 users .. you decide.

TinCanTech wrote https://forums.openvpn.net/viewtopic.php?f=30&t=22603

May be they let their cat put the password in ... ?