OpenVPN + Linux Client Problem

suportegrupobilharva

Hello, I have an OpenVPN server which is assigned to Windows clients using their IP config-dir ccd-OK so far.
The only problem is that on a Linux client (Debian Squeeze) does not get the IP assigned to the Common Name on the CCD-config-dir, taking the 1st of my available IP network.

Does anyone know what can be?

Thank you.

janjust

run the server using 'verb 7' and watch for messages about the CCD file.
Alternatively , run the server with

--ccd-exclusive

and connect the linux client - if there's a name mismatch then the client will not be able to connect and you know where to look.

Finally, take a good look at the contents of the CCD file itself: some info pages suggest to use

ifconfig-push  10.8.0.9 10.8.0.10

but the correct format is actually the other way round:

ifconfig-push  10.8.0.10 10.8.0.9

maikcat

also

please server config file ,ccd name + ccd contents..

and server log

Michael.

suportegrupobilharva

maikcat ..
Follow the files in the Order ... log shows that the server can not find the file with the same name as the Common Name on the CCD.

Awaited return ...

Common Name: Administrador
content : ifconfig-push 192.168.3.57 192.168.3.58

server.conf

# ***** Arquivo de Configuracao do OpenVPN ***** #

# Indica qual a interface que processo escutara
#local a.b.c.d

# Define a porta de comunicacao e o protocolo a ser usado.
port 15000
proto udp

management localhost 7505

# "dev tun" eh usado no modo Routing e "dev tap" no modo Bridge
dev tun

# Cria um ambiente Chroot
#chroot /etc/openvpn/

# Local do armazenamento dos certificados.
ca  /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
# Habilita a Assinatura HMAC nos pacotes do 3Way handshake
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0

# Define o modo de funcionamento do OpenVPN
# Ex: server <Rede Escolhida> <Mascara da Rede Escolhida> <<-- Modo Routing;
# Para usar o modo Bridge, primeiramente o OS devera ter uma interface TAP
# Ex: server-bridge <IP e Mascara da Interface TAP> <Faixa de IPs destinada aos clientes> <<-- Modo bridge;
server 192.168.3.0 255.255.255.0

# Mantem um registro do IP usado pelo cliente caso nao seja atribuido staticamente
# Caso o servico seja reiniciado os cliente irao pegar o mesmo endereco de antes
#ifconfig-pool-persist ipp.txt

# Configura no cliente as rotas para outras redes no momento da conexao
#push "route 192.168.1.3 255.255.255.255"

# Para determinar um IP para um cliente especifico usa-se a diretiva "client-config-dir <nome_diretorio_configuracoes>"
# dentro do diretorio devera ser criando um arquivo com o mesmo nome do "Common Name" do certificado do cliente
# e dentro do arquivo devera ser colocado a diretiva "ifconfig-push <IP Cliente> <IP Servidor> "
# Esta diretiva somente sera valida se os IPs pertencerem a uma mascara /30(255.255.255.252).
# Dentro deste mesmo arquivo podera ser impostas outas configuracoes especificas para este cliente tipo:
# push route "192.168.10.0 255.255.255.0" ou push "redirect-gateway" sendo que estas colocadas no arquivo de configuracao
# sera valida para TODOS os usuarios!!!
client-config-dir /etc/openvpn/clientes

# Opcao que altera em TODOS os clientes o seu gateway padrao, redirecionando todo seu trafego para a VPN,
# incluindo acesso a WEB e DNS. Para isto a interface do OpenVPN devera ser roteada.
#push "redirect-gateway"

# Configura o DNS e WINS nos clientes
#push "dhcp-option DNS 10.8.0.1"
#push "dhcp-option WINS 10.8.0.1"

# Permite que os clientes VPN acessem recursos locais uns aos outros. Desabilitando esta diretiva 
# os clientes somente terao acesso aos recursos do servidor.
#client-to-client

# Permite que varios clientes VPN usem o mesmo certificado ou certificados com o mesmo "Common Name"
#duplicate-cn

# Verifica se a conexao com cada cliente esta ativa enviando PING periodicamente.
# Envia um PING a cada 10 sec e assume como o cliente Off-Line se nao receber o retorno em 120 sec
keepalive 30 60

# For extra security beyond that provided
# by SSL/TLS, create an "HMAC firewall"
# to help block DoS attacks and UDP port flooding.
#
# Generate with:
#   openvpn --genkey --secret ta.key
#
# The server and each client must have
# a copy of this key.
# The second parameter should be '0'
# on the server and '1' on the clients.
;tls-auth ta.key 0 # This file is secret

# Select a cryptographic cipher.
# This config item must be copied to
# the client config file as well.
cipher BF-CBC        # Blowfish (default)
;cipher AES-128-CBC   # AES
;cipher DES-EDE3-CBC  # Triple-DES

# Habilita a compressao dos dados usando a biblioteca com-lzo. Esta diretiva deve ser ativada no cliente
comp-lzo

# Numero maximo de clientes simultaneos que o servidor ira suportar
max-clients 16

# Usuario e grupo que o Daemon do OpenVPN ira usar para rodar.
user openvpn
group openvpn

# Manten a interface e as chaves carregadas quando o daemon for reiniciado ou houver queda de conexao, o que torna mais rapida a restaurao das conexoes com os clientes
persist-key
persist-tun

# Permite que o tunel continue aberto mesmo que o IP do cliente mude. Em situacoes normais, a mudanca de IP faria com que a conexao fosse encerrada. O OpenVPN passa a monitorar as mudancas de enderecos, mantendo o tunel aberto enquanto houver conexao entre as duas partes. Essa opcao tamb deve ser incluida tanto na configuracao do servidor quanto do cliente
float

# Mostra um status curto das conexoes ativas
status /var/log/openvpn/openvpn-status.log

# Por padrao as messagens serao escritas no syslog(Linux) e no Windows("C:\Arquivos de Programa\OpenVPN\log").
# log: ira criar um novo arquivo de log a cada inicializacao do OpenVPN
# log-append: ira usar o mesmo arquivo sempre 
# NUNCA USE OS 2 AO MESMO TEMPO!!
#log /var/log/openvpn/openvpn.log
log-append /var/log/openvpn/openvpn.log

# Define o nivel de mensagens no LOG
  # 0 -> Silencioso, exceto para mensanges de Erros Fatais;
  # 4 -> Nivel usado em ambiente normais
  # 5 e 6 -> Usado para DEBUG em problemas na conexao
  # 9 -> Exibe todas as mensagens
verb 7

# Nao exibe as mesmas mensagens repetidas
mute 20

LOG

Thu Nov 17 14:21:10 2011 us=115842 /sbin/route add -net 192.168.3.0 netmask 255.255.255.0 gw 192.168.3.2
Thu Nov 17 14:21:10 2011 us=118108 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Nov 17 14:21:10 2011 us=120683 GID set to openvpn
Thu Nov 17 14:21:10 2011 us=120798 UID set to openvpn
Thu Nov 17 14:21:10 2011 us=120864 UDPv4 link local (bound): [undef]
Thu Nov 17 14:21:10 2011 us=120911 UDPv4 link remote: [undef]
Thu Nov 17 14:21:10 2011 us=120964 MULTI: multi_init called, r=256 v=256
Thu Nov 17 14:21:10 2011 us=121138 IFCONFIG POOL: base=192.168.3.4 size=62
Thu Nov 17 14:21:10 2011 us=121220 Initialization Sequence Completed
Thu Nov 17 14:21:20 2011 us=131315 MULTI: REAP range 0 -> 16
Thu Nov 17 14:21:26 2011 us=290972 MULTI: REAP range 16 -> 32
Thu Nov 17 14:21:26 2011 us=291093 MULTI: multi_create_instance called
Thu Nov 17 14:21:26 2011 us=291169 192.168.0.2:58581 Re-using SSL/TLS context
Thu Nov 17 14:21:26 2011 us=291231 192.168.0.2:58581 LZO compression initialized
Thu Nov 17 14:21:26 2011 us=291269 192.168.0.2:58581 MTU DYNAMIC mtu=0, flags=1, 0 -> 166
Thu Nov 17 14:21:26 2011 us=291316 192.168.0.2:58581 PID packet_id_init seq_backtrack=64 time_backtrack=15
Thu Nov 17 14:21:26 2011 us=291545 192.168.0.2:58581 PID packet_id_init seq_backtrack=64 time_backtrack=15
Thu Nov 17 14:21:26 2011 us=291588 192.168.0.2:58581 PID packet_id_init seq_backtrack=64 time_backtrack=15
Thu Nov 17 14:21:26 2011 us=291685 192.168.0.2:58581 PID packet_id_init seq_backtrack=64 time_backtrack=15
Thu Nov 17 14:21:26 2011 us=291719 192.168.0.2:58581 Control Channel MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Thu Nov 17 14:21:26 2011 us=291754 192.168.0.2:58581 MTU DYNAMIC mtu=1450, flags=2, 1542 -> 1450
Thu Nov 17 14:21:26 2011 us=291801 192.168.0.2:58581 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Nov 17 14:21:26 2011 us=291908 192.168.0.2:58581 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Thu Nov 17 14:21:26 2011 us=291939 192.168.0.2:58581 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Thu Nov 17 14:21:26 2011 us=292011 192.168.0.2:58581 Local Options hash (VER=V4): '14168603'
Thu Nov 17 14:21:26 2011 us=292069 192.168.0.2:58581 Expected Remote Options hash (VER=V4): '504e774e'
Thu Nov 17 14:21:26 2011 us=292145 192.168.0.2:58581 SENT PING
Thu Nov 17 14:21:26 2011 us=292212 192.168.0.2:58581 GET INST BY REAL: 192.168.0.2:58581 [created]
Thu Nov 17 14:21:26 2011 us=292268 192.168.0.2:58581 UDPv4 READ [42] from [AF_INET]192.168.0.2:58581: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #1 ] [ ] pid=0 DATA len=0
Thu Nov 17 14:21:26 2011 us=292322 192.168.0.2:58581 TLS: Initial packet from [AF_INET]192.168.0.2:58581, sid=92116fcd e8dbf3ac
Thu Nov 17 14:21:26 2011 us=292402 192.168.0.2:58581 UDPv4 WRITE [54] to [AF_INET]192.168.0.2:58581: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 pid=[ #1 ] [ 0 ] pid=0 DATA len=0

Thu Nov 17 14:21:26 2011 us=329120 GET INST BY REAL: 192.168.0.2:58581 [succeeded]
Thu Nov 17 14:21:26 2011 us=329164 192.168.0.2:58581 UDPv4 READ [142] from [AF_INET]192.168.0.2:58581: P_CONTROL_V1 kid=0 pid=[ #52 ] [ ] pid=24 DATA len=100
Thu Nov 17 14:21:26 2011 us=329836 192.168.0.2:58581 VERIFY OK: depth=1, /C=BR/ST=Rio_Grande_do_Sul/L=Pelotas/O=Grupo_Bilharva/CN=Grupo_Bilharva_CA/emailAddress=suporte@grupobilharva.com.br
Thu Nov 17 14:21:26 2011 us=330185 192.168.0.2:58581 VERIFY OK: depth=0, /C=BR/ST=Rio_Grande_do_Sul/L=Pelotas/O=Grupo_Bilharva/CN=Administrador/emailAddress=suporte@grupobilharva.com.br
Thu Nov 17 14:21:26 2011 us=330280 192.168.0.2:58581 UDPv4 WRITE [50] to [AF_INET]192.168.0.2:58581: P_ACK_V1 kid=0 pid=[ #51 ] [ 24 ]
Thu Nov 17 14:21:26 2011 us=330372 GET INST BY REAL: 192.168.0.2:58581 [succeeded]
Thu Nov 17 14:21:26 2011 us=330417 192.168.0.2:58581 UDPv4 READ [142] from [AF_INET]192.168.0.2:58581: P_CONTROL_V1 kid=0 pid=[ #53 ] [ ] pid=25 DATA len=100
Thu Nov 17 14:21:26 2011 us=339272 192.168.0.2:58581 UDPv4 WRITE [50] to [AF_INET]192.168.0.2:58581: P_ACK_V1 kid=0 pid=[ #52 ] [ 25 ]
Thu Nov 17 14:21:26 2011 us=339369 GET INST BY REAL: 192.168.0.2:58581 [succeeded]
Thu Nov 17 14:21:26 2011 us=339413 192.168.0.2:58581 UDPv4 READ [142] from [AF_INET]192.168.0.2:58581: P_CONTROL_V1 kid=0 pid=[ #54 ] [ ] pid=26 DATA len=100
Thu Nov 17 14:21:26 2011 us=339815 192.168.0.2:58581 UDPv4 WRITE [50] to [AF_INET]192.168.0.2:58581: P_ACK_V1 kid=0 pid=[ #53 ] [ 26 ]
Thu Nov 17 14:21:26 2011 us=339899 GET INST BY REAL: 192.168.0.2:58581 [succeeded]

Thu Nov 17 14:21:26 2011 us=344027 192.168.0.2:58581 TEST FILE '/etc/openvpn/clientes/Administrador' [0]
Thu Nov 17 14:21:26 2011 us=344057 192.168.0.2:58581 TLS Auth Error: --client-config-dir authentication failed for common name 'Administrador' file='/etc/openvpn/clientes/Administrador'
Thu Nov 17 14:21:26 2011 us=344168 192.168.0.2:58581 UDPv4 WRITE [154] to [AF_INET]192.168.0.2:58581: P_CONTROL_V1 kid=0 pid=[ #70 ] [ 31 ] pid=41 DATA len=100
Thu Nov 17 14:21:26 2011 us=344248 192.168.0.2:58581 UDPv4 WRITE [142] to [AF_INET]192.168.0.2:58581: P_CONTROL_V1 kid=0 pid=[ #71 ] [ ] pid=42 DATA len=100
Thu Nov 17 14:21:26 2011 us=344331 192.168.0.2:58581 UDPv4 WRITE [124] to [AF_INET]192.168.0.2:58581: P_CONTROL_V1 kid=0 pid=[ #72 ] [ ] pid=43 DATA len=82
Thu Nov 17 14:21:26 2011 us=344465 GET INST BY REAL: 192.168.0.2:58581 [succeeded]
Thu Nov 17 14:21:26 2011 us=344508 192.168.0.2:58581 UDPv4 READ [50] from [AF_INET]192.168.0.2:58581: P_ACK_V1 kid=0 pid=[ #72 ] [ 41 ]
Thu Nov 17 14:21:26 2011 us=344699 GET INST BY REAL: 192.168.0.2:58581 [succeeded]
Thu Nov 17 14:21:26 2011 us=344744 192.168.0.2:58581 UDPv4 READ [50] from [AF_INET]192.168.0.2:58581: P_ACK_V1 kid=0 pid=[ #73 ] [ 42 ]
Thu Nov 17 14:21:26 2011 us=345050 GET INST BY REAL: 192.168.0.2:58581 [succeeded]
Thu Nov 17 14:21:26 2011 us=345091 192.168.0.2:58581 UDPv4 READ [50] from [AF_INET]192.168.0.2:58581: P_ACK_V1 kid=0 pid=[ #74 ] [ 43 ]
Thu Nov 17 14:21:26 2011 us=345149 192.168.0.2:58581 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Nov 17 14:21:26 2011 us=345200 192.168.0.2:58581 [Administrador] Peer Connection Initiated with [AF_INET]192.168.0.2:58581
Thu Nov 17 14:21:27 2011 us=410334 MULTI: REAP range 32 -> 48
Thu Nov 17 14:21:28 2011 us=528543 MULTI: REAP range 48 -> 64
Thu Nov 17 14:21:28 2011 us=697245 GET INST BY REAL: 192.168.0.2:58581 [succeeded]
Thu Nov 17 14:21:28 2011 us=697295 192.168.0.2:58581 UDPv4 READ [132] from [AF_INET]192.168.0.2:58581: P_CONTROL_V1 kid=0 pid=[ #75 ] [ ] pid=32 DATA len=90
Thu Nov 17 14:21:28 2011 us=697385 192.168.0.2:58581 PUSH: Received control message: 'PUSH_REQUEST'
Thu Nov 17 14:21:28 2011 us=697416 192.168.0.2:58581 Delayed exit in 5 seconds
Thu Nov 17 14:21:28 2011 us=697482 192.168.0.2:58581 SENT CONTROL [Administrador]: 'AUTH_FAILED' (status=1)
Thu Nov 17 14:21:28 2011 us=697531 192.168.0.2:58581 UDPv4 WRITE [50] to [AF_INET]192.168.0.2:58581: P_ACK_V1 kid=0 pid=[ #73 ] [ 32 ]
Thu Nov 17 14:21:28 2011 us=697633 192.168.0.2:58581 UDPv4 WRITE [132] to [AF_INET]192.168.0.2:58581: P_CONTROL_V1 kid=0 pid=[ #74 ] [ ] pid=44 DATA len=90
Thu Nov 17 14:21:28 2011 us=936600 MULTI: multi_create_instance called
Thu Nov 17 14:21:28 2011 us=936670 192.168.0.2:58582 Re-using SSL/TLS context
Thu Nov 17 14:21:28 2011 us=936721 192.168.0.2:58582 LZO compression initialized
Thu Nov 17 14:21:28 2011 us=936752 192.168.0.2:58582 MTU DYNAMIC mtu=0, flags=1, 0 -> 166
Thu Nov 17 14:21:28 2011 us=937042 192.168.0.2:58582 Control Channel MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Thu Nov 17 14:21:28 2011 us=937073 192.168.0.2:58582 MTU DYNAMIC mtu=1450, flags=2, 1542 -> 1450
Thu Nov 17 14:21:28 2011 us=937114 192.168.0.2:58582 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Nov 17 14:21:28 2011 us=937193 192.168.0.2:58582 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Thu Nov 17 14:21:28 2011 us=937221 192.168.0.2:58582 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Thu Nov 17 14:21:28 2011 us=937274 192.168.0.2:58582 Local Options hash (VER=V4): '14168603'
Thu Nov 17 14:21:28 2011 us=937322 192.168.0.2:58582 Expected Remote Options hash (VER=V4): '504e774e'
Thu Nov 17 14:21:28 2011 us=937358 192.168.0.2:58582 SENT PING
Thu Nov 17 14:21:28 2011 us=937408 192.168.0.2:58582 GET INST BY REAL: 192.168.0.2:58582 [created]

janjust

bom dia,

just as I expected:

Thu Nov 17 14:21:26 2011 us=344027 192.168.0.2:58581 TEST FILE '/etc/openvpn/clientes/Administrador' [0]
Thu Nov 17 14:21:26 2011 us=344057 192.168.0.2:58581 TLS Auth Error: --client-config-dir authentication failed for common name 'Administrador' file='/etc/openvpn/clientes/Administrador'

check the permissions of the file
/etc/openvpn/clientes/Administrador

the file must be readable to the user=openvpn, group=openvpn ; perhaps a simple

chgrp openvpn /etc/openvpn/clientes/Administrador
chmod 640 /etc/openvpn/clientes/Administrador

will do the trick?

suportegrupobilharva

janjust,

Man is not the whole problem to the permissions of the files but the user running the service. For now I took it and sent it to run the daemon as root worked perfectly but when I enable the user and group configuration file to give it back error. I've tried changing the shell of this type to a valid User bash but it's the same error.
Do you have any tips?

PS.: Do you Brazilian? Well I read a "good day" in your post

maikcat

permissions on file is a good reason for openvpn not to read the ccd file..

can you post the output of ls -la inside your ccd directory?

Michael.

ps: do you uncomment chroot also?

janjust

bom dia novamente,

as Maikcat said, check the permissions of the entire path:

ls -ald /etc /etc/opevpn /etc/openvpn/clientes /etc/openvpn/clientes/Administrador

the entire path needs to be accessible to the user 'openvpn' ; the shell that that user uses is of no importance.

PS Sou Holandese mas tem uma casa na Bahia 😉

suportegrupobilharva

Good morning gentlemen. I have informed them that this has worked 100% the server was allowed where a small set point to 770 on all files and the owner and group are the User openvpn.
If we put chmod 640 will not work because the files need to be activated with the X flag.

I appreciate everyone's help. If you have any suggestions are welcome