Provided credentials are refused

[Sleipnir]

Hello,

I installed openvpn-as on Ubuntu 20.04, following the procedure and was provided with credentials. The only problem is that the server doesn't accept those credentials. Is there something else I forgot to do?

[Sleipnir]

After 8 uninstallations/reinstallations it eventually accepted the credentials.

[openvpn_inc]

Hi Sleipnir,

That sounds pretty odd to be honest. Since we have no other reports on this I'm thinking this might just be some temporary issue. In any case, if anyone encounters this thread in the future because they're having trouble to login, you can also just use the reset password instructions to set a new admin password. The information is here:
https://openvpn.net/vpn-server-resource ... ive-access

Kind regards,
Johan

[Ethanol6]

I experienced the same thing.

I downloaded the .vdh for Hyper-V. Using the credentials described here: https://openvpn.net/faq/default-passwor ... appliance/ to login as root and run the setup. Once the setup completes it says "login with 'openvpn' and the password used to login to this Unix machine" or something to that effect.

Then navigating to the Admin WebUI I use "openvpn" as user and "openvpnas" as the password. Since that's the password used to login as root, and what it tells me is now the password to login to the WebUI. These credentials don't work.

I used the instructions found here: https://openvpn.net/vpn-server-resource ... ive-access to change the password, although that didn't solve the problem either.
When I run

Code: Select all

./sacli --user "openvpn" --new_pass=<PASSWORD> SetLocalPassword

does the new password need to be in quotes?

[openvpn_inc]

Hello Ethanol6,

Sorry about that, it can be confusing. We have changed things recently with the Access Server 2.10 release. Our documentation that I linked earlier does describe this difference but you may have missed this. We have changed the messages and how things are done with our latest releases. But our ready-to-deploy images are due for an update to the latest version and are still on version 2.8.5.

Let me first describe what the Hyper-V and ESXi images are doing at this moment as they are still using version 2.8.5. In the future when the images get updated this will change to the new 2.10 behavior.

On the images for HyperV and ESXi you get version 2.8.5. This version has per the FAQ document (https://openvpn.net/faq/default-passwor ... appliance/) a login for SSH/console access which is root/openvpnas. This is not for the web interface. You are expected to change the password for the root account for obvious security reasons. And the web interface does not by default have a password set on Access Server versions below 2.10. You are expected to set one with the command 'passwd openvpn'. The message "Login as openvpn with the same password used to authenticate to this UNIX host" means that the password you now set on this UNIX host itself is what will be used for the web interface. The password in Access Server versions below 2.10 is basically the password you set in the operating system with the command 'passwd openvpn'. So then the login credentials become openvpn/whateverpasswordyouset.

Our deployment guides describe these steps:
https://openvpn.net/vpn-server-resource ... n-hyper-v/
https://openvpn.net/vpn-server-resource ... ware-esxi/

As of Access Server 2.10 things are quite different. We migrated away from a user in the operating system to a user in the LOCAL authentication system of the Access Server itself for administrative tasks. As of Access Server 2.10 you also by default get a random password assigned right away. Or you can set one immediately during the setup process itself.

In either situation, whether you're using Access Server 2.10, or anything older than that, the password can be reset. The procedure for both cases is explained in this document:
https://openvpn.net/vpn-server-resource ... ive-access

In your particular situation Ethanol6, you have version 2.8.5, and so you need to use the 'passwd openvpn' command to set a password.

Kind regards,
Johan