icowx Hi I set up an openvpn server using ldap login, the ldap service is not stable. When the ldap service is unstable, openvpn can not log in, this is understandable and acceptable. But when ldap is unstable, users who have logged in will immediately drop out, which is unacceptable. I have tried the following: 1. Use openvpn-auth-ldap plugin 2. Use python scripts to verify ldap login 3. Change server.conf from udp protocol to tcp protocol Without ldap login, openvpn has been very stable, users will not be dropped. What is going on, can someone help me? port 11941 proto tcp4 dev tun ca ca.crt cert server.crt key server.key dh dh2048.pem topology subnet server x.x.x.0 255.255.255.0 push "route x.x.x.0 255.255.255.0 vpn_gateway" push "route x.x.x.0 255.255.255.0 vpn_gateway" push "dhcp-option DNS x.x.x.x" push "dhcp-option DNS x.x.x.x" remote-cert-tls client keepalive 3 15 tls-auth ta.key 0 # This file is secret cipher AES-256-CBC user openvpn group openvpn persist-key persist-tun status /var/log/openvpn/openvpn-status_tcp.log log /var/log/openvpn/openvpn_tcp.log log-append /var/log/openvpn/openvpn_tcp.log verb 3 reneg-sec 0 verify-client-cert optional script-security 3 # plugin /usr/lib64/openvpn/plugin/lib/openvpn-auth-ldap.so "/etc/openvpn/auth/ldap.conf" auth-user-pass-verify /etc/openvpn/auth/ldap_auth.py via-env username-as-common-name duplicate-cn client pull tls-client dev tun proto tcp keepalive 3 15 remote x.x.x.x 11941 remote x.x.x.x 11941 resolv-retry infinite nobind persist-key persist-tun remote-cert-tls server auth-nocache auth-user-pass cipher AES-256-CBC verb 3 reneg-sec 0 tls-auth ta.key 1 ca ca.crt
icowx TinCanTech wrote icowx wrote What is going on The pain ... See your log files at --verb 4 Sorry, I can't find the logs now because I'm not using ldap authentication
openvpn_inc Hi icowx, I guess you'll want to try to debug your --auth-user-pass-verify script. There is nothing we can do for you without logs. good luck, rob0
