Authentication failure in Daemon mode

faisal

I installed OpenVPN 2.2.0 in a newly created centos 5.5 server by following instructions from: http://www.webhostingtalk.com/showthread.php?t=1024872

Everything works fine, I can connect from my windows machine with username and password, no issues. However instead of using command line, if I run ovpn in daemon mode I get authentication failure:
"Could not create temporary file '/tmp/openvpn_*****.tmp': Permission denied"

I then added these two lines on to my config file as advised in some other threads in this forum.
script-security 3
tmp-dir /etc/openvpn/tmp

Now, the permission error is gone, but the authentication still failing:
PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so
TLS Auth Error: Auth Username/Password verification failed for peer

anybody has come accross this ? any suggestions ?

Thanks

janjust

the module 'openvpn-auth-pam.so' is failing to authenticate the user - set

  verb 4

in the config file file and re-authenticate - you should now see lots of PAM debugging messages.

faisal

Janjust, thanks for you reply.

changed verbose to 4, here is the log from server:
MULTI: multi_create_instance called
Re-using SSL/TLS context
LZO compression initialized
Control Channel MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Local Options String: 'V4,dev-type tun,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Expected Remote Options String: 'V4,dev-type tun,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Local Options hash (VER=V4): '5b1533a2'
Expected Remote Options hash (VER=V4): 'd3a7571a'
TLS: Initial packet from *.*.*.*:55734, sid=c6a56628 7211856d
PLUGIN_CALL: POST /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so
TLS Auth Error: Auth Username/Password verification failed for peer
Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
[] Peer Connection Initiated with *.*.*.*:55734
PUSH: Received control message: 'PUSH_REQUEST'
Delayed exit in 5 seconds
SENT CONTROL [UNDEF]: 'AUTH_FAILED' (status=1)
SIGTERM[soft,delayed-exit] received, client-instance exiting

Client side log:

Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
[*.*.*.*] Peer Connection Initiated with *.*.*.*:1194
SENT CONTROL [*.*.*.*]: 'PUSH_REQUEST' (status=1)
AUTH: Received AUTH_FAILED control message
TCP/UDP: Closing socket
SIGTERM[soft,auth-failure] received, process exiting
OpenVPN 2.2.1 Win32-MSVC++ [SSL] [LZO2] built on Jul 1 2011
Just wondering why it is not failing on command prompt.

Thanks

janjust

what do you mean by 'command prompt' ?

also,check the temporary file created by the auth-user-pass-verify script - this file should contain the username and password as typed in by the remote user - are they correct?

faisal

It works fine on command line, if I try: openvpn /etc/openvpn/1194.conf &

I think I have found the issue:

it doesn't work if selinux enforced. I disabled selinux and it's working now. I know it's not the right way of doing it. Any suggestions ?

Thanks

janjust

no clue - I normally disable selinux at boot time 😉