user-auth-verify Win7 write error

Bionic711

No matter what I try or where I place the tmp-dir, openvpn continues to get write errors. I've set openvpn permissions in windows as well as changed the directories permissions to allow my user to have full control for testing. Each time openvpn attempts to write, the directory where it is attempting to write gains a read-only status and fails to be able to write thus failing the authentication script.

I've tried a seperate harddrive from the OS, flash drives, external harddrives, all as directory locations. I really do not want to turn off UAC in order to get this to work the way it should.

Does anyone have a solution to this issue?

Mimiko

Post config files, logs, the directory structure where OpenVPN is installed and the output of the

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\OpenVPN"

Bionic711

Directory Structure:

D:\OpenVPN - OS is on C:\

Server Conf

local xxx.xxx.xxx.xxx
server-bridge
script-security 3
tun-mtu 1500
fragment 1300
mssfix
#push "redirect-gateway bypass-dhcp bypass-dns def1"
push "persist-tun"
push "persist-key"
port 1194
dev tap
#cipher AES-256-CBC
proto udp
keepalive 10 60
client-to-client
#tls-auth /cygdrive/d/openvpn/config/tls.key 0
dh "D:\\OpenVPN\\easy-rsa\\keys-443\\dh1024.pem"
ca "D:\\OpenVPN\\easy-rsa\\keys-443\\ca.crt"
cert "D:\\OpenVPN\\easy-rsa\\keys-443\\Port443Server.crt"
key "D:\\OpenVPN\\easy-rsa\\keys-443\\Port443Server.key"
auth-user-pass-verify "/cygdrive/d/openvpn/config/verify.sh" via-file
tmp-dir "D:\\OpenVPN"
verb 7

I've disabled some of the security measures while trying to implement the un/pw functions on the windows machine.

Client config appropriately connects before adding the auth-user-pass command. Will submit upon further request (Do not currently have the machine or the backup with me).

Server Log failure

Here's several lines before and after the failure. If you need a full log let me know what verb setting you want. I have it running at 7 to see all this.

Sun Dec 18 12:29:57 2011 us=769000 GET INST BY REAL: 192.168.17.195:1194 [succeeded]
Sun Dec 18 12:29:57 2011 us=769000 192.168.17.195:1194 UDPv4 READ [114] from 192.168.17.195:1194: P_CONTROL_V1 kid=0 [ ] pid=28 DATA len=100
Sun Dec 18 12:29:57 2011 us=769000 192.168.17.195:1194 UDPv4 WRITE [22] to 192.168.17.195:1194: P_ACK_V1 kid=0 [ 28 ]
Sun Dec 18 12:29:57 2011 us=769000 GET INST BY REAL: 192.168.17.195:1194 [succeeded]
Sun Dec 18 12:29:57 2011 us=769000 192.168.17.195:1194 UDPv4 READ [60] from 192.168.17.195:1194: P_CONTROL_V1 kid=0 [ ] pid=29 DATA len=46
Sun Dec 18 12:29:57 2011 us=832000 192.168.17.195:1194 Note: cannot open E:\\openvpn_up_4b517aad35fae4390114dd23cbca947c.tmp for WRITE
Sun Dec 18 12:29:57 2011 us=832000 192.168.17.195:1194 TLS Auth Error: could not write username/password to file: E:\\openvpn_up_4b517aad35fae4390114dd23cbca947c.tmp
Sun Dec 18 12:29:57 2011 us=832000 192.168.17.195:1194 TLS Auth Error: Auth Username/Password verification failed for peer
Sun Dec 18 12:29:57 2011 us=832000 192.168.17.195:1194 SIGTERM[soft,auth-control-exit] received, client-instance exiting
Sun Dec 18 12:29:57 2011 us=832000 MULTI: multi_close_instance called
Sun Dec 18 12:29:57 2011 us=832000 PID packet_id_free
Sun Dec 18 12:29:57 2011 us=832000 PID packet_id_free
Sun Dec 18 12:29:57 2011 us=832000 PID packet_id_free
Sun Dec 18 12:29:57 2011 us=832000 PID packet_id_free
Sun Dec 18 12:29:57 2011 us=832000 PID packet_id_free
Sun Dec 18 12:29:57 2011 us=832000 PID packet_id_free
Sun Dec 18 12:29:57 2011 us=832000 PID packet_id_free
Sun Dec 18 12:29:57 2011 us=832000 PID packet_id_free
Sun Dec 18 12:29:57 2011 us=832000 PID packet_id_free
Sun Dec 18 12:29:58 2011 us=315000 MULTI: REAP range 192 -> 208
Sun Dec 18 12:29:59 2011 us=17000 MULTI: REAP range 208 -> 224
Sun Dec 18 12:30:00 2011 us=328000 MULTI: REAP range 224 -> 240
Sun Dec 18 12:30:01 2011 us=669000 MULTI: REAP range 240 -> 256
Sun Dec 18 12:30:02 2011 us=137000 MULTI: REAP range 0 -> 16
Sun Dec 18 12:30:03 2011 us=494000 MULTI: REAP range 16 -> 32
Sun Dec 18 12:30:03 2011 us=494000 TLS State Error: No TLS state for client 192.168.17.195:1194, opcode=4
Sun Dec 18 12:30:03 2011 us=494000 GET INST BY REAL: 192.168.17.195:1194 [failed]

I had to edit your query a bit to find the right reg directory because the original you posted was unfound.

modified command is:

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\OpenVPN"

And the answer to that:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\OpenVPN
(Default) REG_SZ D:\OpenVPN
config_dir REG_SZ D:\OpenVPN\config
config_ext REG_SZ ovpn
exe_path REG_SZ D:\OpenVPN\bin\openvpn.exe
log_dir REG_SZ D:\OpenVPN\log
priority REG_SZ NORMAL_PRIORITY_CLASS
log_append REG_SZ 0

If you need more just ask and thanks for the help!

Mimiko

Sun Dec 18 12:29:57 2011 us=832000 192.168.17.195:1194 Note: cannot open E:\\openvpn_up_4b517aad35fae4390114dd23cbca947c.tmp for WRITE

This is not consistent with your config file "tmp-dir" option. So you are using different config file then.
2)

auth-user-pass-verify "/cygdrive/d/openvpn/config/verify.sh" via-file

is not correct, as in windows path to files is noted with backslashes and is started with disk letter. And is the file verify.sh exists on that path?
3) Update to latest version of OpenVPN as some versions have bug with the "auth-user-pass-verify" option.

Bionic711

No. It's not consistent with my tmp-dir because I mistakenly changed it back in between the log and config settings. Changed it back to try to the original directory.

And yes, the directory for the auth-user is correct as it references a program that runs linux code in windows, it's not referencing a windows program, it's referencing a linux script that's being read through Cygwin.

Any other ideas on why it won't write to any directory? (Regardless of what it says in the conf and logs, neither directory writes, D: is an internal harddrive that has the majority of my programs in it, and E: is a flash drive).

Mimiko

Again, update to lates version of OpenVPN.
"tmp-dir" must point to a real everyone full access folder.
"auth-user-pass-verify" calls a script in specified path, so it must comply with the windows path writting rules.

Roamer

I'm seeing this same behavior (Note: cannot open ..\path\filename.tmp for WRITE) in OpenVPN 2.2.2 (for Windows), when trying to implement auth-user-pass-verify via-file.

Server Config:

port 4911
proto tcp
dev tun
ca ..\\easy-rsa\\keys\\ca.crt
cert ..\\easy-rsa\\keys\\server.crt
key ..\\easy-rsa\\keys\\server.key
dh ..\\easy-rsa\\keys\\dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.log
push "route 192.168.1.0 255.255.255.0"
route 192.168.2.0 255.255.255.0
push "dhcp-option DOMAIN domain.local"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
log-append openvpn.log
verb 4
tmp-dir ..\\tmp
script-security 3
auth-user-pass-verify auth_via-file.cmd via-file

Client Config:

client
dev tun
proto tcp
remote domain.dyndns-office.com 4911
resolv-retry infinite
nobind
persist-key
persist-tun
ca ..\\easy-rsa\\keys\\ca.crt
cert ..\\easy-rsa\\keys\\client1.crt
key ..\\easy-rsa\\keys\\client1.key
ns-cert-type server
comp-lzo
verb 4
auth-user-pass

Server openvpn.log (partial):

Sun Jan 08 19:55:57 2012 us=700000 Initialization Sequence Completed
Sun Jan 08 19:56:04 2012 us=280000 MULTI: multi_create_instance called
Sun Jan 08 19:56:04 2012 us=280000 Re-using SSL/TLS context
Sun Jan 08 19:56:04 2012 us=280000 LZO compression initialized
Sun Jan 08 19:56:04 2012 us=280000 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Sun Jan 08 19:56:04 2012 us=280000 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Jan 08 19:56:04 2012 us=280000 Local Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Sun Jan 08 19:56:04 2012 us=280000 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Sun Jan 08 19:56:04 2012 us=280000 Local Options hash (VER=V4): 'c0103fa8'
Sun Jan 08 19:56:04 2012 us=280000 Expected Remote Options hash (VER=V4): '69109d17'
Sun Jan 08 19:56:04 2012 us=280000 TCP connection established with 1.2.3.4:56335
Sun Jan 08 19:56:04 2012 us=280000 TCPv4_SERVER link local: [undef]
Sun Jan 08 19:56:04 2012 us=280000 TCPv4_SERVER link remote: 1.2.3.4:56335
Sun Jan 08 19:56:04 2012 us=290000 1.2.3.4:56335 TLS: Initial packet from 1.2.3.4:56335, sid=8cf28ae6 6f7e9e94
Sun Jan 08 19:56:05 2012 us=561000 1.2.3.4:56335 VERIFY OK: depth=1, /C=US/ST=ST/L=City/O=Domain/OU=Office/CN=SERVER/name=Company/emailAddress=tech.support@domain.com
Sun Jan 08 19:56:05 2012 us=561000 1.2.3.4:56335 VERIFY OK: depth=0, /C=US/ST=ST/L=City/O=Domain/OU=Office/CN=client1/name=client1/emailAddress=tech.support@domain.com
Sun Jan 08 19:56:06 2012 us=102000 1.2.3.4:56335 Note: cannot open ..\tmp\openvpn_up_e2ec6c725741baeeafb271dcdb6fe11f.tmp for WRITE
Sun Jan 08 19:56:06 2012 us=102000 1.2.3.4:56335 TLS Auth Error: could not write username/password to file: ..\tmp\openvpn_up_e2ec6c725741baeeafb271dcdb6fe11f.tmp
Sun Jan 08 19:56:06 2012 us=102000 1.2.3.4:56335 TLS Auth Error: Auth Username/Password verification failed for peer
Sun Jan 08 19:56:06 2012 us=102000 1.2.3.4:56335 SIGTERM[soft,auth-control-exit] received, client-instance exiting
Sun Jan 08 19:56:06 2012 us=102000 TCP/UDP: Closing socket
Sun Jan 08 19:56:11 2012 us=139000 MULTI: multi_create_instance called
Sun Jan 08 19:56:11 2012 us=139000 Re-using SSL/TLS context
Sun Jan 08 19:56:11 2012 us=139000 LZO compression initialized
Sun Jan 08 19:56:11 2012 us=139000 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Sun Jan 08 19:56:11 2012 us=139000 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Jan 08 19:56:11 2012 us=139000 Local Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Sun Jan 08 19:56:11 2012 us=139000 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Sun Jan 08 19:56:11 2012 us=139000 Local Options hash (VER=V4): 'c0103fa8'
Sun Jan 08 19:56:11 2012 us=139000 Expected Remote Options hash (VER=V4): '69109d17'
Sun Jan 08 19:56:11 2012 us=139000 TCP connection established with 1.2.3.4:56336
Sun Jan 08 19:56:11 2012 us=139000 TCPv4_SERVER link local: [undef]
Sun Jan 08 19:56:11 2012 us=139000 TCPv4_SERVER link remote: 1.2.3.4:56336
Sun Jan 08 19:56:11 2012 us=139000 1.2.3.4:56336 TLS: Initial packet from 1.2.3.4:56336, sid=3229a090 29bf41da
Sun Jan 08 19:56:12 2012 us=371000 1.2.3.4:56336 VERIFY OK: depth=1, /C=US/ST=ST/L=City/O=Domain/OU=Office/CN=SERVER/name=Company/emailAddress=tech.support@domain.com
Sun Jan 08 19:56:12 2012 us=371000 1.2.3.4:56336 VERIFY OK: depth=0, /C=US/ST=ST/L=City/O=Domain/OU=Office/CN=client1/name=client1/emailAddress=tech.support@domain.com
Sun Jan 08 19:56:12 2012 us=912000 1.2.3.4:56336 Note: cannot open ..\tmp\openvpn_up_9204050cc194f7c14196a5fc56012c65.tmp for WRITE
Sun Jan 08 19:56:12 2012 us=912000 1.2.3.4:56336 TLS Auth Error: could not write username/password to file: ..\tmp\openvpn_up_9204050cc194f7c14196a5fc56012c65.tmp
Sun Jan 08 19:56:12 2012 us=912000 1.2.3.4:56336 TLS Auth Error: Auth Username/Password verification failed for peer
Sun Jan 08 19:56:12 2012 us=912000 1.2.3.4:56336 SIGTERM[soft,auth-control-exit] received, client-instance exiting
Sun Jan 08 19:56:12 2012 us=912000 TCP/UDP: Closing socket
Sun Jan 08 19:56:17 2012 us=949000 MULTI: multi_create_instance called

OpenVPN Directory Structure:

C:\>dir C:\Program Files\OpenVPN /a:d /s /o /b
C:\Program Files\OpenVPN\bin
C:\Program Files\OpenVPN\config
C:\Program Files\OpenVPN\driver
C:\Program Files\OpenVPN\easy-rsa
C:\Program Files\OpenVPN\log
C:\Program Files\OpenVPN\sample-config
C:\Program Files\OpenVPN\tmp
C:\Program Files\OpenVPN\config\ccd
C:\Program Files\OpenVPN\easy-rsa\keys

C:\>

Registry Settings:

C:\>REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\OpenVPN"

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\OpenVPN
    <NO NAME>   REG_SZ  C:\Program Files\OpenVPN
    config_dir  REG_SZ  C:\Program Files\OpenVPN\config
    config_ext  REG_SZ  ovpn
    exe_path    REG_SZ  C:\Program Files\OpenVPN\bin\openvpn.exe
    log_dir     REG_SZ  C:\Program Files\OpenVPN\log
    priority    REG_SZ  NORMAL_PRIORITY_CLASS
    log_append  REG_SZ  0

C:\>

When the client tries to logon, the server generates tmp files in the specified tmp-dir location, but the files are created as read-only files, thus preventing the username and password from being written to the file. This is not a directory/file security issue, as Everyone has Full Control on the tmp directory, and the .tmp files that are being created are correctly inheriting the Full Control NTFS permission.

Tmp File Attributes:

C:\>attrib "C:\Program Files\OpenVPN\tmp\*"
A    R     C:\Program Files\OpenVPN\tmp\openvpn_up_9204050cc194f7c14196a5fc56012c65.tmp
A    R     C:\Program Files\OpenVPN\tmp\openvpn_up_e2ec6c725741baeeafb271dcdb6fe11f.tmp

C:\>

NTFS File Attributes:

C:\>cacls "C:\Program Files\OpenVPN\tmp\openvpn_up_9204050cc194f7c14196a5fc56012c65.tmp"
C:\Program Files\OpenVPN\tmp\openvpn_up_9204050cc194f7c14196a5fc56012c65.tmp Everyone:F
                                                                             BUILTIN\Users:R
                                                                             BUILTIN\Power Users:C
                                                                             BUILTIN\Administrators:F
                                                                             NT AUTHORITY\SYSTEM:F


C:\>

What would cause the files be created with the read-only bit set?

P.S. - I also tried the simple batch file described in thread "problem with auth-user-pass-verify option" [http://forums.openvpn.net/topic8523.html], but it appears the read-only problem is preventing the script from running, so it didn't write the test output to the log.

-Jeff

Mimiko

Try setting tmp-dir to absolute path.

Roamer

tmp-dir "C:\\Program Files\\OpenVPN\\tmp"
tmp-dir C:\\Temp

Both options result in the openvpn_up_*.tmp files being written to the specified locations, but still read-only, preventing the username and password from being written to the files.

-Jeff

Bionic711

I too, have not found a way to correct the issue with the read-only *.tmp files being created. I've even tried network attached drives as well as a brand new 500GB drive I installed solely for the purpose of trying to find a work-around for this issue.

Roamer

Just for my own peace of mind, I just now tried an additional drive, as well. I attached an external USB drive to computer, formatted the drive as FAT32 (just to ensure NTFS couldn't possibly get in the way), changed the server config to use the root of the eternal drive for its temporary files (tmp-dir E:\\), changed auth-user-pass-verify from via-env to via-file, restarted the OpenVPN server, and tried connecting with the OpenVPN client.

I got the exact same results; tmp files being created as read-only files in the tmp-dir location (E:\)

-Jeff

troxy

System: Windows Server 2008 R2 Foundation, OpenVPN 2.2.2.
I experienced the same problem with my client-connect script and dynamic config files.
Temporary files created by OpenVPN on Windows have "read-only" attribute set, which prevents OpenVPN service from writing and deleting the .tmp files.
In my case, I got "Access is denied" when my client-connect script tried to echo something to the file specified in %1 argument.
Log also said "problem deleting temporary file" because OpenVPN also failed to delete it.

To workaround it, add this command to the script and it works: (it removes read-only attribute on temp file)

attrib -R %1

OpenVPN log with attrib workaround: (successful)

Tue Mar 27 17:10:46 2012 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Tue Mar 27 17:10:46 2012 WARNING: --keepalive option is missing from server config
Tue Mar 27 17:10:46 2012 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Tue Mar 27 17:10:46 2012 NOTE: --script-security method='system' is deprecated due to the fact that passed parameters will be subject to shell expansion
Tue Mar 27 17:10:46 2012 Diffie-Hellman initialized with 1024 bit key
Tue Mar 27 17:10:46 2012 Control Channel Authentication: using 'ta.pem' as a OpenVPN static key file
Tue Mar 27 17:10:46 2012 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 27 17:10:46 2012 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 27 17:10:46 2012 TLS-Auth MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Tue Mar 27 17:10:46 2012 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Mar 27 17:10:46 2012 TAP-WIN32 device [OpenVPN] opened: \\.\Global\{EB52C257-FCF2-4F6D-86F6-6E0C15979F3F}.tap
Tue Mar 27 17:10:46 2012 TAP-Win32 Driver Version 9.9 
Tue Mar 27 17:10:46 2012 TAP-Win32 MTU=1500
Tue Mar 27 17:10:46 2012 Set TAP-Win32 TUN subnet mode network/local/netmask = 10.11.0.0/10.11.0.1/255.255.0.0 [SUCCEEDED]
Tue Mar 27 17:10:46 2012 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.11.0.1/255.255.0.0 on interface {EB52C257-FCF2-4F6D-86F6-6E0C15979F3F} [DHCP-serv: 10.11.255.254, lease-time: 31536000]
Tue Mar 27 17:10:46 2012 Sleeping for 10 seconds...
Tue Mar 27 17:10:56 2012 Successful ARP Flush on interface [17] {EB52C257-FCF2-4F6D-86F6-6E0C15979F3F}
Tue Mar 27 17:10:56 2012 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Mar 27 17:10:56 2012 UDPv4 link local (bound): [undef]:30010
Tue Mar 27 17:10:56 2012 UDPv4 link remote: [undef]
Tue Mar 27 17:10:56 2012 MULTI: multi_init called, r=256 v=256
Tue Mar 27 17:10:56 2012 Initialization Sequence Completed
Tue Mar 27 17:11:02 2012 MULTI: multi_create_instance called
Tue Mar 27 17:11:02 2012 192.168.24.201:2414 Re-using SSL/TLS context
Tue Mar 27 17:11:02 2012 192.168.24.201:2414 LZO compression initialized
Tue Mar 27 17:11:02 2012 192.168.24.201:2414 Control Channel MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Tue Mar 27 17:11:02 2012 192.168.24.201:2414 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Mar 27 17:11:02 2012 192.168.24.201:2414 Local Options hash (VER=V4): '14168603'
Tue Mar 27 17:11:02 2012 192.168.24.201:2414 Expected Remote Options hash (VER=V4): '504e774e'
Tue Mar 27 17:11:02 2012 192.168.24.201:2414 TLS: Initial packet from 192.168.24.201:2414, sid=94945031 7fe7468e
Tue Mar 27 17:11:02 2012 192.168.24.201:2414 VERIFY OK: depth=1, /C=SE/O=Troxy/OU=troxy-server/CN=ca
Tue Mar 27 17:11:02 2012 192.168.24.201:2414 VERIFY OK: depth=0, /C=SE/O=Troxy/OU=troxy-server/CN=client1
Tue Mar 27 17:11:02 2012 192.168.24.201:2414 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Mar 27 17:11:02 2012 192.168.24.201:2414 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 27 17:11:02 2012 192.168.24.201:2414 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Mar 27 17:11:02 2012 192.168.24.201:2414 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 27 17:11:02 2012 192.168.24.201:2414 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Mar 27 17:11:02 2012 192.168.24.201:2414 [client1] Peer Connection Initiated with 192.168.24.201:2414

C:\Program Files (x86)\OpenVPN\config>attrib -R "C:\Program Files (x86)\OpenVPN\config\temp\openvpn_cc_edcd48b59b7c84a0ebf031e3080e4289.tmp" 

C:\Program Files (x86)\OpenVPN\config>ECHO ifconfig-push 10.11.0.123 255.255.0.0 1>>"C:\Program Files (x86)\OpenVPN\config\temp\openvpn_cc_edcd48b59b7c84a0ebf031e3080e4289.tmp" 

C:\Program Files (x86)\OpenVPN\config>ECHO push "ping 10" 1>>"C:\Program Files (x86)\OpenVPN\config\temp\openvpn_cc_edcd48b59b7c84a0ebf031e3080e4289.tmp" 

C:\Program Files (x86)\OpenVPN\config>ECHO push "ping-restart 60" 1>>"C:\Program Files (x86)\OpenVPN\config\temp\openvpn_cc_edcd48b59b7c84a0ebf031e3080e4289.tmp" 

C:\Program Files (x86)\OpenVPN\config>ECHO push "dhcp-option DNS 10.11.0.1" 1>>"C:\Program Files (x86)\OpenVPN\config\temp\openvpn_cc_edcd48b59b7c84a0ebf031e3080e4289.tmp" 

C:\Program Files (x86)\OpenVPN\config>ECHO push "register-dns" 1>>"C:\Program Files (x86)\OpenVPN\config\temp\openvpn_cc_edcd48b59b7c84a0ebf031e3080e4289.tmp" 
Tue Mar 27 17:11:02 2012 client1/192.168.24.201:2414 OPTIONS IMPORT: reading client specific options from: C:\Program Files (x86)\OpenVPN\config\temp\openvpn_cc_edcd48b59b7c84a0ebf031e3080e4289.tmp
Tue Mar 27 17:11:02 2012 client1/192.168.24.201:2414 MULTI: Learn: 10.11.0.123 -> client1/192.168.24.201:2414
Tue Mar 27 17:11:02 2012 client1/192.168.24.201:2414 MULTI: primary virtual IP for client1/192.168.24.201:2414: 10.11.0.123
Tue Mar 27 17:11:04 2012 client1/192.168.24.201:2414 PUSH: Received control message: 'PUSH_REQUEST'
Tue Mar 27 17:11:04 2012 client1/192.168.24.201:2414 SENT CONTROL [client1]: 'PUSH_REPLY,topology subnet,route 10.12.0.0 255.255.255.0 10.11.0.1,ping 10,ping-restart 60,dhcp-option DNS 10.11.0.1,register-dns,ifconfig 10.11.0.123 255.255.0.0' (status=1)

OpenVPN log with write and delete error: (without attrib workaround)

Tue Mar 27 17:12:09 2012 192.168.24.201:2414 [client1] Peer Connection Initiated with 192.168.24.201:2414
C:\Program Files (x86)\OpenVPN\config>ECHO ifconfig-push 10.11.0.123 255.255.0.0 1>>"C:\Program Files (x86)\OpenVPN\config\temp\openvpn_cc_586baf677a5e4176831c4ac6c99ca427.tmp" 
Access is denied.

C:\Program Files (x86)\OpenVPN\config>ECHO push "ping 10" 1>>"C:\Program Files (x86)\OpenVPN\config\temp\openvpn_cc_586baf677a5e4176831c4ac6c99ca427.tmp" 
Access is denied.

C:\Program Files (x86)\OpenVPN\config>ECHO push "ping-restart 60" 1>>"C:\Program Files (x86)\OpenVPN\config\temp\openvpn_cc_586baf677a5e4176831c4ac6c99ca427.tmp" 
Access is denied.

C:\Program Files (x86)\OpenVPN\config>ECHO push "dhcp-option DNS 10.11.0.1" 1>>"C:\Program Files (x86)\OpenVPN\config\temp\openvpn_cc_586baf677a5e4176831c4ac6c99ca427.tmp" 
Access is denied.

C:\Program Files (x86)\OpenVPN\config>ECHO push "register-dns" 1>>"C:\Program Files (x86)\OpenVPN\config\temp\openvpn_cc_586baf677a5e4176831c4ac6c99ca427.tmp" 
Access is denied.
Tue Mar 27 17:12:09 2012 client1/192.168.24.201:2426 WARNING: Failed running command (--client-connect): returned error code 1
Tue Mar 27 17:12:11 2012 client1/192.168.24.201:2426 PUSH: Received control message: 'PUSH_REQUEST'
Tue Mar 27 17:12:11 2012 client1/192.168.24.201:2426 Delayed exit in 5 seconds
Tue Mar 27 17:12:11 2012 client1/192.168.24.201:2426 SENT CONTROL [client1]: 'AUTH_FAILED' (status=1)

ld73

Hi guys, I had the same problem with the version of openvpn-2.2.2, and openvpn-2.3-alpha1.
I found a bug in the code and ask the developers to fix a bug in the file win \ config.h.in:

# define S_IRUSR 0
# define S_IWUSR 0

Thank you very much.

#define _S_IREAD 0x0100 /* read permission, owner */
#define _S_IWRITE 0x0080 /* write permission, owner */

troxy

Hi! Is there any bug reported for this issue?
As it appears now, all scripting features that use temp files, like "auth-user-pass-verify", "client-connect" are broken in Windows.

Mimiko

troxy wroteHi! Is there any bug reported for this issue?
As it appears now, all scripting features that use temp files, like "auth-user-pass-verify", "client-connect" are broken in Windows.

There is no bug with this. I've run tests on OpenVPN 2.2 without problems. Just verify correct configuration, paths and permissions.

rana

I can confirm that this problem exists in OpenVPN 2.3-alpha1 running on win2008 R2 x64 server.

It is not a configuration issue, as other have tested.

Issue: OpenVPN Server tries to write to two files - one is the log file "log/server.log" (or whatever the configuration file specifies), and "conf/ipp.txt"; at the same time, it also marks the files as read-only, and when the service starts again, OpenVPN server fails to run.

I needed a solution quickly for my rig; initially I thought of a batch file, but then wrote a small .net service for this.

http://code.google.com/p/openvpn-launcher/

all my service does is, unsets the readonly attributes and starts/watches the service. Hopefully it will be useful to others.

regards

Rana