OpenVPN client behind ISA ( Forefront TMG )

teseospa

Hi,
I have an OpenVPN client behind ISA Server ( Forefront TMG ) but I can't connect to OpenVPN server.
I tried from Win7 logged on domain and from WinXpHome, but I have the same results. I tried from a PC with direct access to Internet and the connection works without errors.
Below you can found client.ovpn, server.ovpn and the result on client.

Thanks for any ideas.

client.ovpn :
client
dev tun
dev-node "OpenVPN"
proto tcp
remote x.x.x.x 443
resolv-retry infinite
nobind
persist-key
persist-tun
http-proxy y.y.y.y 8080 login.txt ntlm2 ( the same with ntlm )
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\vnc-pc.crt"
key "C:\\Program Files\\OpenVPN\\config\\vnc-pc.key"
ns-cert-type server
tls-auth ta.key 1
comp-lzo
verb 3
---------------------------------

server.opvn:
port 443
proto tcp
dev tun
ca "C:\\Programmi\\OpenVPN\\config\\ca.crt"
cert "C:\\Programmi\\OpenVPN\\config\\server.crt"
key "C:\\Programmi\\OpenVPN\\config\\server.key" # This file should be kept secret
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
tls-auth ta.key 0 # This file is secret
comp-lzo
max-clients 10
persist-key
persist-tun
status openvpn-status.log
verb 3
-----------------------
And this is the client result:

Wed Apr 13 18:34:14 2011 OpenVPN 2.1.4 i686-pc-mingw32 [SSL] [LZO2] [PKCS11] built on Nov 8 2010
Wed Apr 13 18:34:14 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Apr 13 18:34:14 2011 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Wed Apr 13 18:34:14 2011 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Apr 13 18:34:14 2011 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Apr 13 18:34:14 2011 LZO compression initialized
Wed Apr 13 18:34:14 2011 Control Channel MTU parms [ L:1544 D:168 EF:68 EB:0 ET:0 EL:0 ]
Wed Apr 13 18:34:14 2011 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Apr 13 18:34:14 2011 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Apr 13 18:34:14 2011 Local Options hash (VER=V4): 'ee93268d'
Wed Apr 13 18:34:14 2011 Expected Remote Options hash (VER=V4): 'bd577cd1'
Wed Apr 13 18:34:14 2011 Attempting to establish TCP connection with 172.27.0.50:8080
Wed Apr 13 18:34:14 2011 TCP connection established with y.y.y.y:8080
Wed Apr 13 18:34:14 2011 Send to HTTP proxy: 'CONNECT x.x.x.x:443 HTTP/1.0'
Wed Apr 13 18:34:14 2011 Attempting NTLM Proxy-Authorization phase 1
Wed Apr 13 18:34:14 2011 HTTP proxy returned: 'HTTP/1.1 407 Proxy Authentication Required ( Access is denied. )'
Wed Apr 13 18:34:14 2011 Proxy requires authentication
Wed Apr 13 18:34:14 2011 HTTP proxy returned: 'Via: 1.1 PROXYSRVNAME'
Wed Apr 13 18:34:14 2011 HTTP proxy returned: 'Proxy-Authenticate: NTLM
TlRMTVNTUAACAAAABgAGADgAAAAGAoECdhzAfS0l/ugAAAAAAAAAAJoAmg
A+AAAABgByFwAAAA9UV1BOMDkCAAwAVABXAFAATgAwADkAAQAWAEQAS
QBTAEMATwBWAEUAUgBZADAAOQAEABQAVABXAFAATgAwADkALgBOAEUAV
AADACwARABJAFMAQwBPAFYARQBSAFkAMAA5AC4AVABXAFAATgAwADkALg
BOAEUAVAAFABQAVABXAFAATgAwADkALgBOAEUAVAAHAAgAvhEJ7vn5ywE
AAAAA'
Wed Apr 13 18:34:14 2011 auth string: 'TlRMTVNTUAACAAAABgAGADgAAAAGAoECdhzAfS0l/ugAAAAAAAAAAJoAmg
A+AAAABgByFwAAAA9UV1BOMDkCAAwAVABXAFAATgAwADkAAQAWAEQAS
QBTAEMATwBWAEU'
Wed Apr 13 18:34:14 2011 Received NTLM Proxy-Authorization phase 2 response
Wed Apr 13 18:34:16 2011 recv_line: TCP port read timeout expired
Wed Apr 13 18:34:16 2011 Send to HTTP proxy: 'CONNECT x.x.x.x:443 HTTP/1.0'
Wed Apr 13 18:34:16 2011 Send to HTTP proxy: 'Host: x.x.x.x'
Wed Apr 13 18:34:16 2011 Attempting NTLM Proxy-Authorization phase 3
Wed Apr 13 18:34:16 2011 NTLM Proxy-Authorization phase 3 failed: received corrupted data from proxy server
Wed Apr 13 18:34:16 2011 TCP/UDP: Closing socket
Wed Apr 13 18:34:16 2011 SIGTERM[soft,init_instance] received, process exiting

janjust

nltm support in the 'http-proxy' option is bad - I've never managed to get it to work myself. OpenVPN sends incorrect messages to the proxy, so I am not surprised that some proxies return the wrong answers also...

teseospa

I found an article where an Italian found a BUG in ntml.c http://www.morzello.com/index.php/openvpn-ntlm-e-quel-proxy-infame/
He changed the row 179 of ntlm.c from
buf_printf (&out, "%s", "TlRMTVNTUAABAAAAAgIAAA==");
to
buf_printf (&out, "%s", "TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAFASgKAAAADw==");

He say that found the solution sniffing other software like Firefox when connects to Proxy.

What do you think?

janjust

I tried that some time ago, it did not work for me; see
https://community.openvpn.net/openvpn/ticket/94 for more info

teseospa

I found the solution: a buffer too small!!
You need to change the size of buf2 from 128 to 512 in proxy.c and ntlm.c and delete this line:

buf2[127] = 0;

Now it works!

stortoaranci

Hi All,

since several people told me that changes I made to the software does not work at 100% I modified the code as shown in this post.

But I would say that line:

buf2[127] = 0;

should not be removed but changed in:

buf2[511] = 0;

for security reasons.

A patched version of the client exe is available at:

http://www.morzello.com/repository/network/openvpn-2.1.4-ntlmv2.zip

If you think it's useful we could make a patch for the community.

please, let me know at:

http://www.morzello.com

bye.

janjust

Good idea! I'd like to stomp out this NTLM bug once and for all.
However, when I look through the 2.1.4 code base , file ntlm.c , I don't see any lines like

buf2[127] = 0;

am I missing something? Once we get this sorted out as a proper patch (including valid NTLM handshake as seen by Wireshark) then I'd like to submit this as a patch to the devel team.

stortoaranci

Take a look to proxy.c also 🙂

storto

janjust

thanks! I've managed to recompile openvpn with your patch but I still could not get it working. After some debugging I found out that my test server (apache httpd 2.2 + mod_proxy + mod_ntlm) itself does not work properly: it also fails when handing https traffic from Firefox or Internet Explorer. It acts fine as a proxy for http:// traffic but it won't do HTTP CONNECTs . Do you know any open source proxy servers that support NTLM ?

dave

Hi,

i have the same Problem.
My Client-Log looks exactly the same:

recv_line: TCP port read timeout expired
Send to HTTP proxy: 'CONNECT x.x.x.x:443 HTTP/1.0'
Send to HTTP proxy: 'Host: x.x.x.x'
Attempting NTLM Proxy-Authorization phase 3
NTLM Proxy-Authorization phase 3 failed: received corrupted data from proxy server
TCP/UDP: Closing socket
SIGTERM[soft,init_instance] received, process exiting

My Client is behind an Astaro Security Gateway (in ActiveDirectory, so NTLM) and i try to connect to an other Astaro.
I tried the Astaro SSl VPN Client (which is OpenVPN), and other older, and the newest official OpenVPN-Versions.
Also i tried the fix from stortoaranci (thanks for that!).

But nothing worked.

Am I doing something wrong or is there another bug?

@ stortoaranci:
My knowledge about coding is not good. So im not able to compile a patched Windows Client.
So i would be interested in a working Windows-Version.

Thanks for help already, and sry for my bad English.

Dave

stortoaranci

Hi Dave, did you try the win version available at morzello.com?

that works fine for me.

I think the best practice is to take a look to the firefox ntlm implementation in order to resolve any possible issue. I don't know if anyone is working on that right now.

dave

Yes i tried your OpenVPN.exe, but the Problem is the same.
What do you mean with the Firefox NTLM Implementation?

With the browsers Firefox and InternetExplorer i can browse through the proxy.

openvpn@weavweb.net

Just a quick follow-up; I have been testing stortoaranci patches on an ISA server requiring ntlm2 + Active Directory and confirm the exact same results. Chrome/FF/IE work fine. I have provided the detailed logs to stortoaranci; unfortunately I am not in a position to recompile and test on my own.

Not sure what I can do to directly help but I am here to support in any way I can.
Thanks

stortoaranci

Just a question on Login and password. is there any strange (unicode) char in the ntlmv2 auth string? (ie: domain, login, pwd)?

i think it could be an issue.

openvpn@weavweb.net

Hmm, interesting question.
Yes; my earlier password had a "`" in it (left of the #1 key). I have since changed it to include only a combination of letter and numbers with different cases.

I still fail at Phase 3 (however my logs do not look identical to the others above):

Mon May 09 17:09:25 2011 us=562000 Received NTLM Proxy-Authorization phase 2 response
Mon May 09 17:09:27 2011 us=562000 recv_line: TCP port read timeout expired
Mon May 09 17:09:27 2011 us=562000 Send to HTTP proxy: 'CONNECT x.x.x.x:443 HTTP/1.1'
Mon May 09 17:09:27 2011 us=562000 Send to HTTP proxy: 'Host: x.x.x.x
Mon May 09 17:09:27 2011 us=562000 Attempting NTLM Proxy-Authorization phase 3

I do NOT get the following (as posted by "dave" above):
NTLM Proxy-Authorization phase 3 failed: received corrupted data from proxy server
TCP/UDP: Closing socket
SIGTERM[soft,init_instance] received, process exiting

stortoaranci

I just want to take stock of the situation:

- "NTLM Proxy-Authorization phase 3 failed: received corrupted data from proxy server" means that ovpn was unable to manage the phase2 decoding the base64 message;

- if nothing happen after "Attempting NTLM Proxy-Authorization phase 3" than i think that phase 3 message is empty for some reason.

since i do not have access to an isa proxy i'm not able to do more tests.

logs I checked from Dale show that the proxy uses a negotiation step before asking for ntlm:

from IE7 sniffer:

HTTP/1.1 407 Proxy Authentication Required ( The ISA Server requires authorization to fulfill the request. Access to the Web Proxy filter is denied.  )
Via: 1.1 PROXY NAME
Proxy-Authenticate: Negotiate
Proxy-Authenticate: Kerberos
Proxy-Authenticate: NTLM
Connection: Keep-Alive

then the browser reply with:

GET http://www.mysite.com HTTP/1.1
Accept: */*
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.1; .NET CLR 3.0.04506.30; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E; MS-RTC LM 8)
Accept-Encoding: gzip, deflate
Host: www.mysite.com
Proxy-Connection: Keep-Alive
Proxy-Authorization: Negotiate TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAFASgKAAAADw==

openvpn do not support that approach but sends NTLM phase 1 message directly:

CONNECT openvpn.site:443 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; MS-RTC LM 8)
Proxy-Connection: Keep-Alive
Proxy-Authorization: NTLM TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAFASgKAAAADw==

in that case ovpn simply ignore the phase 2 message sent by the proxy.

I think we should go by steps, we could start with NTLM auth first and then looking for NTLMv2.

bye.

openvpn@weavweb.net

I completely agree with stortoaranci approach.
I do not have access to an NTLM only proxy but if no one else has one readily available I can set one up temporarily.
Can anyone please confirm that NTLMv1 works.
Dale

janjust

I'd really like to be able to confirm that stortoaranci's works but I lack the resources to set up a NTLM based proxy server; does anybody know how to do that using open source tools? preferably Linux-based? httpd+mod_proxy_mod_ntlm does NOT work.

stortoaranci

Hi,

a new version of the ovpn exe with ntlm patch is available at morzello.com.

http://www.morzello.com/repository/network/openvpn-2.1.4-ntlmv2.zip

I added a very basic support to unicode so I ask you to try if that stuff works.

please, avoid strange chars for test and use the format:

DOMAIN\USER

to authenticate against the proxy.

since I do not have an ISA Proxy Server, any wireshark .cap is usefull.

have a nice weekend.

dave

It looks better now, but it seems reconnecting all the time:

Mon May 16 08:00:19 2011 WARNING: Make sure you understand the semantics of --tls-remote before using it (see the man page).
Mon May 16 08:00:19 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon May 16 08:00:19 2011 Re-using SSL/TLS context
Mon May 16 08:00:19 2011 LZO compression initialized
Mon May 16 08:00:19 2011 Control Channel MTU parms [ L:1556 D:140 EF:40 EB:0 ET:0 EL:0 ]
Mon May 16 08:00:19 2011 Socket Buffers: R=[8192->8192] S=[64512->64512]
Mon May 16 08:00:19 2011 Data Channel MTU parms [ L:1556 D:1450 EF:56 EB:135 ET:0 EL:0 AF:3/1 ]
Mon May 16 08:00:19 2011 Local Options hash (VER=V4): '6190####'
Mon May 16 08:00:19 2011 Expected Remote Options hash (VER=V4): 'a4f1###'
Mon May 16 08:00:19 2011 Attempting to establish TCP connection with ##.##.##.##:3128
Mon May 16 08:00:19 2011 TCP connection established with ##.##.##.##:3128
Mon May 16 08:00:19 2011 Send to HTTP proxy: 'CONNECT ####.dyndns.###:443 HTTP/1.0'
Mon May 16 08:00:19 2011 Attempting NTLM Proxy-Authorization phase 1
Mon May 16 08:00:19 2011 HTTP proxy returned: 'HTTP/1.1 407 Proxy Authorization Required'
Mon May 16 08:00:19 2011 Proxy requires authentication
Mon May 16 08:00:19 2011 HTTP proxy returned: 'Proxy-Authenticate: NTLM TlRMTVNTUAACAAAAEAAQ############################='
Mon May 16 08:00:19 2011 auth string: 'TlRMTVNTUAACAAAAEAAQADgAAAAVgoHik9S1v9XA40EAAAAAA############################='
Mon May 16 08:00:19 2011 Received NTLM Proxy-Authorization phase 2 response
Mon May 16 08:00:21 2011 recv_line: TCP port read timeout expired
Mon May 16 08:00:21 2011 Send to HTTP proxy: 'CONNECT ###.dyndns.###:443 HTTP/1.0'
Mon May 16 08:00:21 2011 Send to HTTP proxy: 'Host: ###.dyndns.###'
Mon May 16 08:00:21 2011 Attempting NTLM Proxy-Authorization phase 3
Mon May 16 08:00:21 2011 Send to HTTP proxy: 'Proxy-Authorization: NTLM TlRMTVNTUAADAAAAAAAAAHAAAAAYABgAQAA##############=='
Mon May 16 08:00:21 2011 HTTP proxy returned: 'HTTP/1.1 200 Connection established'
Mon May 16 08:00:23 2011 TCPv4_CLIENT link local: [undef]
Mon May 16 08:00:23 2011 TCPv4_CLIENT link remote: ##.##.##.##:3128
Mon May 16 08:00:23 2011 Connection reset, restarting [-1]
Mon May 16 08:00:23 2011 TCP/UDP: Closing socket
Mon May 16 08:00:23 2011 SIGUSR1[soft,connection-reset] received, process restarting
Mon May 16 08:00:23 2011 Restart pause, 5 second(s)