OpenVPN - does not work login with a password ...

nucleon

OpenVPN - does not work login with a password ...
Tune openvpn server FreeBSD 8.0
for some reason, I want users to be authorized with a password.
Authorization does not pass
in the log server has an error message:

AUTH-PAM: BACKGROUND: user 'admin' failed to authenticate: authentication error
PLUGIN_CALL: POST /usr/local/lib/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/local/lib/openvpn-auth-pam.so
Note: cannot open openvpn_up_cf43858b231e43faba028e15f92050a4.tmp for WRITE
TLS Auth Error: could not write username/password to file: openvpn_up_cf43858b231e43faba028e15f92050a4.tmp
TLS Auth Error: Auth Username/Password verification failed for peer
Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA

server config:

mode server
tls-server
daemon
ifconfig 192.168.0.1 255.255.255.0
port 1195
proto tcp-server
dev tap1
ca   /usr/local/etc/openvpn2/keys/ca.crt
cert /usr/local/etc/openvpn2/keys/gate.crt
key  /usr/local/etc/openvpn2/keys/gate.key
dh   /usr/local/etc/openvpn2/keys/dh1024.pem
push "route 192.168.0.0 255.255.255.0 192.168.0.1"
plugin /usr/local/lib/openvpn-auth-pam.so "login login USERNAME password PASSWORD"
auth-user-pass-verify "/usr/local/etc/openvpn2/auth-pam.pl /usr/local/etc/openvpn2/users.pw" via-file
auth MD5                                              
tls-server
tls-auth /usr/local/etc/openvpn2/keys/ta.key 0
tls-timeout 120
cipher BF-CBC                                   
keepalive 10 120
client-to-client                                
client-cert-not-required                        
user nobody
group nobody
max-clients 10                                  
comp-lzo
persist-key
persist-tun
status          openvpn-pass-status.log
log             /var/log/openvpn-pass.log
verb 3

client config:

client
dev tap
proto tcp
remote xxx.xxx.xxx.xxx 1195
resolv-retry infinite
persist-key
persist-tun
ca ca.crt
tls-client
tls-auth ta.key 1
auth-user-pass
;ns-cert-type server
cipher BF-CBC
auth MD5 
comp-lzo
verb 3
mute 20

example of the password file on the server user.pw:

admin
qwerty

user
ytrewq

nucleon

tell me where I go wrong?

janjust

try adding

tmp-dir /tmp

to the server config , restart the server and reconnect.

this is a not-too-well documented change in openvpn 2.2

nucleon

error message has changed, but the problem remains:

Initial packet from xxx.xxx.xxx.xxx:58977, sid=bdc7bf38 21cec3e3
AUTH-PAM: BACKGROUND: user 'admin' failed to authenticate: authentication error
PLUGIN_CALL: POST /usr/local/lib/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/local/lib/openvpn-auth-pam.so
openvpn_execve: external program may not be called unless '--script-security 2' or higher is enabled.  Use '--script-security 3 system' for backward compatibility with 2.1_rc8 and earlier.  See --help text or man page for detailed info.
TLS Auth Error: user-pass-verify script failed to execute: /usr/local/etc/openvpn2/auth-pam.pl /usr/local/etc/openvpn2/users.pw /tmp/openvpn_up_1060bd81bb4a3345e20211de916d3702.tmp
TLS Auth Error: Auth Username/Password verification failed for peer

janjust

the (new) warning message should give you a hint: try adding

script-security 2

(or '3' if that does not work)

nucleon

tried 2 and 3 ...
script-security 2:

AUTH-PAM: BACKGROUND: user 'admin' failed to authenticate: authentication error
PLUGIN_CALL: POST /usr/local/lib/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/local/lib/openvpn-auth-pam.so
Can't locate Authen/PAM.pm in @INC (@INC contains: /usr/local/lib/perl5/5.10.1/BSDPAN /usr/local/lib/perl5/site_perl/5.10.1/mach /usr/local/lib/perl5/site_perl/5.10.1 /usr/local/lib/perl5/5.10.1/mach /usr/local/lib/perl5/5.10.1) at /usr/local/etc/openvpn2/auth-pam.pl line 30.
BEGIN failed--compilation aborted at /usr/local/etc/openvpn2/auth-pam.pl line 30.
TLS Auth Error: Auth Username/Password verification failed for peer
Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA

script-security 3:

TLS: Initial packet from xxx.xxx.xxx.xxx:58989, sid=a5cb2838 aee6bcdb
AUTH-PAM: BACKGROUND: user 'admin' failed to authenticate: authentication error
PLUGIN_CALL: POST /usr/local/lib/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/local/lib/openvpn-auth-pam.so
Can't locate Authen/PAM.pm in @INC (@INC contains: /usr/local/lib/perl5/5.10.1/BSDPAN /usr/local/lib/perl5/site_perl/5.10.1/mach /usr/local/lib/perl5/site_perl/5.10.1 /usr/local/lib/perl5/5.10.1/mach /usr/local/lib/perl5/5.10.1) at /usr/local/etc/openvpn2/auth-pam.pl line 30.
BEGIN failed--compilation aborted at /usr/local/etc/openvpn2/auth-pam.pl line 30.
TLS Auth Error: Auth Username/Password verification failed for peer
Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA

similarly
may be necessary to fix the script login? /usr/local/etc/openvpn2/auth-pam.pl

janjust

you're missing the Authen/PAM.pm package - I don't know how this perl module can be installed on FreeBSD but you can find all Perl modules on http://www.cpan.org

nucleon

Do I understand correctly - I need to reinstall PERL enabled PAM.pm?

janjust

no you need to install a Perl module http://search.cpan.org/~nikip/Authen-PAM-0.16/d/PAM.pm

nucleon

fulfilled:

cd / usr/ports/security/p5-Authen-Simple-PAM
make install clean

I saw in the logs of installation:

Installing / usr/local/lib/perl5/site_perl/5.10.1/Authen/Simple/PAM.pm

bug is still there, but now without any reference to the module ...

AUTH-PAM: BACKGROUND: user 'admin' failed to authenticate: authentication error
PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: / usr / local / lib / openvpn-auth-pam.so
Auth 'admin' failed, PAM said: authentication error
TLS Auth Error: Auth Username / Password verification failed for peer

error about a missing module does not see.
can be somehow on a different issue Fail user.pw?

janjust

no, now you're getting the next warning message: pam fails to authenticate the user 'admin' ; did you type the right password? can you use another means of authenticating the user 'admin' (e.g. using 'ssh') ?

nucleon

umm I do not understand the part about ssh?
the configuration is written:

plugin / usr / local / lib / openvpn-auth-pam.so "login login USERNAME password PASSWORD" # the way word login exactly should be written twice?
auth-user-pass-verify "/ usr/local/etc/openvpn2/auth-pam.pl / usr/local/etc/openvpn2/users.pw" via-file

may be a bug silent here?

janjust

the line

login login USERNAME password PASSWORD

is correct and should be read as:

- use the pam config file /etc/pam.d/login
- expect a dialog that asks for 'login' first, for which the username should be filled in
- second, expect a dialog that asks for 'password'

so this depends quite a bit on how pam is working on your freebsd setup - and frankly, this is beyond this openvpn forum 😉

nucleon

it is clear that nothing is clear ..))
just in case, bring a script auth-pam.pl
maybe this is not the script that I need ...
downloaded from the examples:

The script can be finished?

#!/usr/bin/perl -t

# OpenVPN PAM AUTHENTICATON
#   This script can be used to add PAM-based authentication
#   to OpenVPN 2.0.  The OpenVPN client must provide
#   a username/password, using the --auth-user-pass directive.
#   The OpenVPN server should specify --auth-user-pass-verify
#   with this script as the argument and the 'via-file' method
#   specified.  The server can also optionally specify
#   --client-cert-not-required and/or --username-as-common-name.

# SCRIPT OPERATION
#   Return success or failure status based on whether or not a
#   given username/password authenticates using PAM.
#   Caller should write username/password as two lines in a file
#   which is passed to this script as a command line argument.

# CAVEATS
#   * Requires Authen::PAM module, which may also
#     require the pam-devel package.
#   * May need to be run as root in order to
#     access username/password file.

# NOTES
#   * This script is provided mostly as a demonstration of the
#     --auth-user-pass-verify script capability in OpenVPN.
#     For real world usage, see the auth-pam module in the plugin
#     folder.

use Authen::PAM;
use POSIX;

# This "conversation function" will pass
# $password to PAM when it asks for it.

sub my_conv_func {
    my @res;
    while ( @_ ) {
        my $code = shift;
        my $msg = shift;
        my $ans = "";

        $ans = $password if $msg =~ /[Pp]assword/;

        push @res, (PAM_SUCCESS(),$ans);
    }
    push @res, PAM_SUCCESS();
    return @res;
}

# Identify service type to PAM
$service = "login";

# Get username/password from file

if ($ARG = shift @ARGV) {
    if (!open (UPFILE, "<$ARG")) {
        print "Could not open username/password file: $ARG\n";
        exit 1;
    }
} else {
    print "No username/password file specified on command line\n";
    exit 1;
}

$username = <UPFILE>;
$password = <UPFILE>;

if (!$username || !$password) {
    print "Username/password not found in file: $ARG\n";
    exit 1;
}

chomp $username;
chomp $password;

close (UPFILE);

# Initialize PAM object

if (!ref($pamh = new Authen::PAM($service, $username, \&my_conv_func))) {
    print "Authen::PAM init failed\n";
    exit 1;
}

# Authenticate with PAM

$res = $pamh->pam_authenticate;

# Return success or failure

if ($res == PAM_SUCCESS()) {
    exit 0;
} else {
    print "Auth '$username' failed, PAM said: ", $pamh->pam_strerror($res), "\n"                                                                                                                                                              ;
    exit 1;
}