client-connect command failed

iserhard

client-connect command failed: could not execute external program

This is the error I get in the OpenVPN log, since the authentication is via LDAP.

Before that, everything was alright and working fine. This is the sequence:

[] Peer Connection Initiated with [AF_INET]x.x.x.x:34446
PLUGIN_CALL: POST /usr/local/lib/openvpn-auth-ldap.so/PLUGIN_CLIENT_CONNECT status=0
client-connect command failed: could not execute external program
PUSH: Received control message: 'PUSH_REQUEST'

Any idea why is that? Could it be related with LDAP permissions?

Cause I guess everything's ok with the OpenVPN

Mimiko

The script does not have execution (x) permission for the user which run the OpenVPN. Set

chmod 777 script_name

for a test.

iserhard

I did that with all possible scripts and plugins and I still got the same error.

My guess is that the problem comes from LDAP user. There might be some kind of restriction. I just can't find no one who have the same issue.

Actually, our openvpn-auth-ldap.so plugin was compiled, different from the one that comes in the debian package, because our LDAP server (which is administrated by someone else) has some particular features.

But thank you anyway, and if someone got this error message, I would appreciate help.

janjust

without your server configuration it is impossible to tell what is failing...

iserhard

auth-ldap.conf

<LDAP>
        # LDAP server URL
        URL ldap://ldapteste.xxx.xxx.xx

        # Bind DN (If your LDAP server doesn't support anonymous binds)
        BindDN  "uid=leitor,dc=xxx,dc=xx"

        # Bind Password
        Password        xxxx
        
        # Network timeout (in seconds)
        Timeout 15

        # Enable Start TLS
        TLSEnable yes

        # Follow LDAP Referrals (anonimously)
        FollowReferrals no

        # TLS CA Certificate File
        # TLSCACertFile /etc/ssl/certs/ACRxxUFRGS.pem

        # TLS CA Certificate Directory
        # TLSCACertDir /etc/ssl/certs/

        # Client Certificate and key
        # If TLS client authetication is required
        # TLSCertFile   /usr/local/etc/ssl/client-cert.pem
        # TLSKeyFile    /usr/local/etc/ssk/client-key.pem
        # Cipher Suite
        # The defaults are usually fine here
        # TLSCipherSuite        ALL:!ADH:@STRENGTH

</LDAP>

<Authorization>
        #Base DN
        BaseDN  "ou=People,dc=xxx,dc=xx"

        # User Search Filter
        SearchFilter    "(&(uid=%u)(ufrgsVPN=ufrgs))"

        # Require Group Membership
        #RequireGroup   true
        #PosixGroupFormat        true

        #Add non-group members to a PF table (disabled)
        #PFTable        ips_vpn_users
</Authorization>

--

AND server.conf

dev tun

server 10.8.0.0 255.255.255.0
port 1194

#Chaves para a conexao SSL
ca /etc/openvpn/keys/ca.crt                  #CA
cert /etc/openvpn/keys/server.crt            #Certificado do servidor
key /etc/openvpn/keys/server.key             #Chave privada do servidor
dh /etc/openvpn/keys/dh1024.pem              #Parametros Diffie hellman

client-cert-not-required   #desobriga os clientes a possuirem cert.
duplicate-cn               #permite "COMMON NAME" duplicado nos certificados

comp-lzo                   #compressao de dados
max-clients 50
user  nobody               #usuario do openvpn
group nogroup              #grupo do openvpn
persist-key
persist-tun

#rotas
#push "redirect-gateway def1"

#modulo de autenticacao
auth-nocache              # previne cache de password

#plugin /usr/lib/openvpn/openvpn-auth-pam.so login
plugin /usr/local/lib/openvpn-auth-ldap.so "/etc/openvpn/ldap/auth-ldap.conf"

# Pinga a cada 10 segundos, assume desconexao
# se nao houver resposta num periodo de 1200 segundos.
keepalive 10 1200
ping-timer-rem

client-connect /etc/openvpn/scripts/client-connect.sh
client-disconnect /etc/openvpn/scripts/client-disconnect.sh

#Secao de logs
#status         /var/log/openvpn/udp-status.log
#log-append     /var/log/openvpn/udp-total.log
verb 5
push "route xxx.xx.0.0 255.255.0.0 vpn_gateway"

janjust

I'm missing a line

script-security 2

in your server config; also, what is the 'client-connect' script supposed to do? the LDAP authentication is done using the plugin - no need to use a 'client-connect' script for that.