Radius and 2 factor working; re-connection question...

AaronJAnderson

I've been a long time OpenVPN supporter and user. First time install that has required the use of radius/2factor authentication. I authenticate through PAM to a Duo Security agent that either calls your phone and asks you to enter a PIN or pops up something on your smartphone and asks you to press "allow" - pretty neat, but off topic.

When a user connects, they enter their username and password. (Not using client certificates)

Anyway, If the client loses connection and it has to reconnect on it's own, OpenVPN is requiring re-authentication through radius/pam. Which results in a phone call or notification on your phone and requires you to intervene or it will not complete. Is there a way to avoid this?

Server config:

script-security 2
plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so openvpn

port xxxx
proto udp
dev tap0

ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key  
dh /etc/openvpn/dh1024.pem

client-cert-not-required

log-append  /var/log/openvpn.log
server-bridge 10.1.0.145 255.255.255.0 10.1.0.146 10.1.0.149

ifconfig-pool-persist ipp.txt

push "route 192.168.0.0 255.255.0.0"
push "route 10.1.0.0 255.255.0.0"
push "dhcp-option DNS 10.1.0.4"
;push "redirect-gateway"

client-to-client
keepalive 10 120
reneg-sec 36000

;duplicate-cn   # allow more than one connection per cert
;cipher BF-CBC  # Blowfish (default)
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
mute 20
up /etc/openvpn/bridge-start.sh

Client config:

client
dev tap
proto udp
remote x.x.x.x xxx
auth-user-pass
nobind
persist-key
persist-tun
ca ca.crt
ns-cert-type server
comp-lzo
verb 3
mute 20
keepalive 10 120
reneg-sec 0

Here's an excerpt from my log when this happens.... You can see at 5:15am it wants to re-authenticate me. The fourth line seems to be the culprit with the TLS soft reset. It fails about 15 times until I wake up and allow the connection :o - So...

Thu Feb 23 19:15:53 2012 74.134.101.225:61960 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 23 19:15:53 2012 74.134.101.225:61960 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Thu Feb 23 20:15:35 2012 74.134.101.225:61960 TLS: tls_process: killed expiring key
Fri Feb 24 05:15:53 2012 74.134.101.225:61960 TLS: soft reset sec=0 bytes=110589655/0 pkts=448456/0
AUTH-PAM: BACKGROUND: user 'aaron.anderson' failed to authenticate: Authentication service cannot retrieve authentication info
Fri Feb 24 05:16:53 2012 74.134.101.225:61960 PLUGIN_CALL: POST /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
Fri Feb 24 05:16:53 2012 74.134.101.225:61960 PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so
Fri Feb 24 05:16:53 2012 74.134.101.225:61960 TLS Auth Error: Auth Username/Password verification failed for peer
Fri Feb 24 05:16:53 2012 74.134.101.225:61960 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Fri Feb 24 05:16:53 2012 74.134.101.225:61960 TLS Error: TLS handshake failed
Fri Feb 24 05:16:53 2012 74.134.101.225:61960 TLS: move_session: dest=TM_LAME_DUCK src=TM_ACTIVE reinit_src=1
Fri Feb 24 05:16:53 2012 74.134.101.225:61960 TLS ERROR: received control packet with stale session-id=ccf1526c 1744d3fc
Fri Feb 24 05:16:53 2012 74.134.101.225:61960 TLS ERROR: received control packet with stale session-id=ccf1526c 1744d3fc
Fri Feb 24 05:16:53 2012 74.134.101.225:61960 TLS ERROR: received control packet with stale session-id=ccf1526c 1744d3fc
Fri Feb 24 05:16:53 2012 74.134.101.225:61960 TLS ERROR: received control packet with stale session-id=ccf1526c 1744d3fc
Fri Feb 24 05:16:53 2012 74.134.101.225:61960 TLS: Initial packet from x.x.x.x:xxxx, sid=3b61c9e4 241d8d75
AUTH-PAM: BACKGROUND: user 'aaron.anderson' failed to authenticate: Authentication service cannot retrieve authentication info
Fri Feb 24 05:16:54 2012 74.134.101.225:61960 PLUGIN_CALL: POST /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
Fri Feb 24 05:16:54 2012 74.134.101.225:61960 PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so
Fri Feb 24 05:16:54 2012 74.134.101.225:61960 TLS Auth Error: Auth Username/Password verification failed for peer
Fri Feb 24 05:16:54 2012 74.134.101.225:61960 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA

janjust

the message

user 'aaron.anderson' failed to authenticate: Authentication service cannot retrieve authentication info

suggests that the radius auth failed - do a standalone test to see if the username+password is still valid on the radius server

AaronJAnderson

Yes, it is still valid. Radius fails because the radius server is doing 2 factor, and it's trying to call me to verify the "second factor" - I was asleep, so that part times out and fails.

This might be a duplicate post...

Yes, of course it fails, because it's trying to contact me on my phone to authorize the 2factor part. I am asking if there is a way to OpenVPN to not need to reauthorize the radius account when the reconnection happens. The weird part is that it does not need me to enter my user ID and password again..