Hi,
I have a synology nas with docker and container transmission-openvpn, it worked with another vpn provider, but it was really slow, so I try to use vpnsecure instead.
I followed this tutorial :
https://support.vpnsecure.me/articles/miscellaneous/docker-transmission-openvpn
But I keep getting this error:
Starting OpenVPN using config Belgium.ovpn
Setting OpenVPN credentials...
adding route to local network 192.168.0.0/24 via 172.18.0.1 dev eth0
Sun Jan 31 22:07:15 2021 WARNING: Ignoring option 'dh' in tls-client mode, please only include this in your server configuration
Sun Jan 31 22:07:15 2021 WARNING: file '/etc/openvpn/vpnsecure/auth.txt' is group or others accessible
Sun Jan 31 22:07:15 2021 OpenVPN 2.4.10 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Jan 4 2021
Sun Jan 31 22:07:15 2021 library versions: OpenSSL 1.1.1i 8 Dec 2020, LZO 2.10
Sun Jan 31 22:07:15 2021 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Sun Jan 31 22:07:15 2021 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sun Jan 31 22:07:15 2021 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sun Jan 31 22:07:15 2021 OpenSSL: error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt
Sun Jan 31 22:07:15 2021 OpenSSL: error:23077074:PKCS12 routines:PKCS12_pbe_crypt:pkcs12 cipherfinal error
Sun Jan 31 22:07:15 2021 OpenSSL: error:2306A075:PKCS12 routines:PKCS12_item_decrypt_d2i:pkcs12 pbe crypt error
Sun Jan 31 22:07:15 2021 OpenSSL: error:0907B00D:PEM routines:PEM_read_bio_PrivateKey:ASN1 lib
Sun Jan 31 22:07:15 2021 Cannot load private key file [[INLINE]]
Sun Jan 31 22:07:15 2021 Error: private key password verification failed
Sun Jan 31 22:07:15 2021 Exiting due to fatal error
I contacted support team, the agent sent me multiple keys, but same result, authentication error.
The last key I received directly from chat support was a little bit different "RSA PRIVATE KEY" instead of "ENCRYPTED PRIVATE KEY", the error log is different but same "private key password verification failed" at the end:
Creating TUN device /dev/net/tun
Using OpenVPN provider: VPNSECURE
Starting OpenVPN using config Belgium.ovpn
Setting OpenVPN credentials...
adding route to local network 192.168.0.0/24 via 172.18.0.1 dev eth0
Sun Jan 31 22:36:13 2021 WARNING: Ignoring option 'dh' in tls-client mode, please only include this in your server configuration
Sun Jan 31 22:36:13 2021 WARNING: file '/etc/openvpn/vpnsecure/auth.txt' is group or others accessible
Sun Jan 31 22:36:13 2021 OpenVPN 2.4.10 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Jan 4 2021
Sun Jan 31 22:36:13 2021 library versions: OpenSSL 1.1.1i 8 Dec 2020, LZO 2.10
Sun Jan 31 22:36:13 2021 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Sun Jan 31 22:36:13 2021 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sun Jan 31 22:36:13 2021 OpenSSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch
Sun Jan 31 22:36:13 2021 Cannot load private key file [[INLINE]]
Sun Jan 31 22:36:13 2021 Error: private key password verification failed
Sun Jan 31 22:36:13 2021 Exiting due to fatal error
I don't know if everything is useful , but I have this in my docker\vpnsecure folder :
- auth.txt ( with my password only inside, only number and letters)
- ca.crt
- dh2048.pem
- myusername.crt
- myusername.key (with last given key)
- belgium.ovpn
I modified belgium.ovpn, because I had errors:
neither stdin nor stderr are a tty device and you have neither a controlling tty nor systemd - can't ask for 'Enter Private Key Password:'. If you used --daemon, you need to use --askpass to make passphrase-protected keys work, and you can not use --auth-nocache.
so I used "askpass" instead of "auth-nocache"
Then :
Options error: --keepalive conflicts with --ping, --ping-exit, or --ping-restart. If you use --keepalive, you don't need any of the other --ping directives.
So I simply remove the keep alive line, maybe a bad idea, but the error disappeard
my belgium.ovpn file :
client
proto udp
dev tun
dh dh2048.pem
ca ca.crt
cert saltpepper.crt
key saltpepper.key
remote us3.bukbukimachicken.me 1191
cipher DES-CBC
verb 2
askpass /etc/openvpn/vpnsecure/auth.txt
mute 20
comp-lzo
persist-key
persist-tun
float
resolv-retry infinite
nobind
<ca>
-----BEGIN CERTIFICATE-----
......
-----END CERTIFICATE-----
</ca>
<key>
-----BEGIN ENCRYPTED PRIVATE KEY-----
.....
-----END ENCRYPTED PRIVATE KEY-----
</key>
<cert>
-----BEGIN CERTIFICATE-----
......
-----END CERTIFICATE-----
</cert>
My docker-compose :
transmission:
container_name: transmission-openvpn
image: haugene/transmission-openvpn
cap_add:
- NET_ADMIN
restart: unless-stopped
ports:
- "9091:9091"
dns:
- 1.1.1.1
volumes:
- /etc/localtime:/etc/localtime:ro
- /volume1/docker/transmission:/data
- /volume1/docker/transmission/config:/config
- /volume1/docker/transmission/resolv.conf:/etc/resolv.conf
- /volume3/MimirVol3/Transmission:/downloads
- /volume3/MimirVol3/Transmission/watch:/watch
- /volume1/docker/vpnsecure:/etc/openvpn/vpnsecure
environment:
- PUID=1026
- PGID=100
- OPENVPN_PROVIDER=vpnsecure
- OPENVPN_USERNAME=KS2-....................
- OPENVPN_PASSWORD="password".........
- OPENVPN_CONFIG=Belgium
- OPENVPN_OPTS=--inactive 3600 --ping 10 --ping-exit 60
- LOCAL_NETWORK=192.168.0.0/24
- TRANSMISSION_INCOMPLETE_DIR=/downloads/incomplete
- TRANSMISSION_DOWNLOAD_DIR=/downloads/completed
- TRANSMISSION_WATCH_DIR=/watch
logging:
driver: json-file
options:
max-size: 10m
What is my mistake?
Where is the problem?
Please help...
Thanks a lot
