OpenVPN Support Forum

Hi,

I have configured openvpn server (openvpn 2.3.2 version) with domain authentication on Windows Server 2012. When I run this command in server "C:/Windows/System32/cscript.exe /H:cscript C:/Progra~1/OpenVPN/config/Auth4OpenVPN.vbs <domain username> <domain password> , I got result in which the authentication successful. But when i want connect client to the openvpn server I got error as below:

--------------------------------------------------------------------------------------------------------------
Fri Feb 28 15:20:22 2014 Warning: cannot open --log file: C:\Program Files\OpenVPN\log\client01.log: Access is denied. (errno=5)
Fri Feb 28 15:20:22 2014 OpenVPN 2.3.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Fri Feb 28 15:20:22 2014 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Fri Feb 28 15:20:22 2014 Need hold release from management interface, waiting...
Fri Feb 28 15:20:22 2014 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Fri Feb 28 15:20:22 2014 MANAGEMENT: CMD 'state on'
Fri Feb 28 15:20:22 2014 MANAGEMENT: CMD 'log all on'
Fri Feb 28 15:20:22 2014 MANAGEMENT: CMD 'hold off'
Fri Feb 28 15:20:22 2014 MANAGEMENT: CMD 'hold release'
Fri Feb 28 15:20:32 2014 MANAGEMENT: CMD 'username "Auth" "nuruljannah"'
Fri Feb 28 15:20:32 2014 MANAGEMENT: CMD 'password [...]'
Fri Feb 28 15:20:33 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Fri Feb 28 15:20:33 2014 UDPv4 link local: [undef]
Fri Feb 28 15:20:33 2014 UDPv4 link remote: [AF_INET]192.168.103.76:1194
Fri Feb 28 15:20:33 2014 MANAGEMENT: >STATE:1393572033,WAIT,,,
Fri Feb 28 15:20:33 2014 MANAGEMENT: >STATE:1393572033,AUTH,,,
Fri Feb 28 15:20:33 2014 TLS: Initial packet from [AF_INET]192.168.103.76:1194, sid=49293fda 7d5594f8
Fri Feb 28 15:20:33 2014 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Fri Feb 28 15:20:33 2014 VERIFY OK: depth=1, C=MY, ST=SE, L=PJ, O=ECSM, OU=KUSH, CN=ecsvpn, name=admin, emailAddress=is@ecsm.com.my
Fri Feb 28 15:20:33 2014 VERIFY OK: nsCertType=SERVER
Fri Feb 28 15:20:33 2014 VERIFY OK: depth=0, C=MY, ST=SE, L=PJ, O=ECSM, OU=KUSH, CN=ecsvpn, name=admin, emailAddress=is@ecsm.com.my
Fri Feb 28 15:20:33 2014 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Feb 28 15:20:33 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Feb 28 15:20:33 2014 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Feb 28 15:20:33 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Feb 28 15:20:33 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Fri Feb 28 15:20:33 2014 [ecsvpn] Peer Connection Initiated with [AF_INET]server ip address:1194
Fri Feb 28 15:20:34 2014 MANAGEMENT: >STATE:1393572034,GET_CONFIG,,,
Fri Feb 28 15:20:35 2014 SENT CONTROL [ecsvpn]: 'PUSH_REQUEST' (status=1)
Fri Feb 28 15:20:35 2014 AUTH: Received control message: AUTH_FAILED
Fri Feb 28 15:20:35 2014 SIGUSR1[soft,auth-failure] received, process restarting
Fri Feb 28 15:20:35 2014 MANAGEMENT: >STATE:1393572035,RECONNECTING,auth-failure,,
Fri Feb 28 15:20:35 2014 Restart pause, 2 second(s)
--------------------------------------------------------------------------------------------------------------

And why suddenly when I would like to restart the openvpn service in services, the services will stop automatically?
I'm stuck on this. Please help me. Thank you.

Hi,

Below are the configuration of server and client. Goal: OpenVPN authentication with Active Directory. But I face a problem in which when I run
--------------------------------------------------------------------------------------------------------
server.ovpn configuration:

port 1194
proto udp
dev tun

ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\server.crt"
key "C:\\Program Files\\OpenVPN\\config\\server.key"
dh "C:\\Program Files\\OpenVPN\\config\\dh1024.pem"

server 10.88.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo

persist-tun
status openvpn-status.log
verb 3

script-security 3
auth-user-pass-verify "C:/Windows/System32/cscript.exe /H:cscript C:/Program Files/OpenVPN/config/Auth4OpenVPN.vbs" via-env
--------------------------------------------------------------------------------------------------------

--------------------------------------------------------------------------------------------------------
client.ovpn

client
dev tun
proto udp

remote [server ip address] 1194
resolv-retry infinite
nobind
persist-key
persist-tun

ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\client01.crt"
key "C:\\Program Files\\OpenVPN\\config\\client01.key"

ns-cert-type server
comp-lzo
verb 3

auth-user-pass
auth-retry interact

--------------------------------------------------------------------------------------------------------
Auth4OpenVPN.ini configuration

Server = "ip address of AD"

Domain = "company domain"

DN = "dc="",dc="",dc=""

Group = "vpnusers"

Logging = "On"

--------------------------------------------------------------------------------------------------------

when I run the script using this syntax: auth4openvpn.vbs <user> <password>, the result is "Authentication Successful" but when I connect the client to the server there is an error as below:

****
Fri Feb 28 15:20:22 2014 Warning: cannot open --log file: C:\Program Files\OpenVPN\log\client01.log: Access is denied. (errno=5)
Fri Feb 28 15:20:22 2014 OpenVPN 2.3.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Fri Feb 28 15:20:22 2014 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Fri Feb 28 15:20:22 2014 Need hold release from management interface, waiting...
Fri Feb 28 15:20:22 2014 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Fri Feb 28 15:20:22 2014 MANAGEMENT: CMD 'state on'
Fri Feb 28 15:20:22 2014 MANAGEMENT: CMD 'log all on'
Fri Feb 28 15:20:22 2014 MANAGEMENT: CMD 'hold off'
Fri Feb 28 15:20:22 2014 MANAGEMENT: CMD 'hold release'
Fri Feb 28 15:20:32 2014 MANAGEMENT: CMD 'username "Auth" "nuruljannah"'
Fri Feb 28 15:20:32 2014 MANAGEMENT: CMD 'password [...]'
Fri Feb 28 15:20:33 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Fri Feb 28 15:20:33 2014 UDPv4 link local: [undef]
Fri Feb 28 15:20:33 2014 UDPv4 link remote: [AF_INET]192.168.103.76:1194
Fri Feb 28 15:20:33 2014 MANAGEMENT: >STATE:1393572033,WAIT,,,
Fri Feb 28 15:20:33 2014 MANAGEMENT: >STATE:1393572033,AUTH,,,
Fri Feb 28 15:20:33 2014 TLS: Initial packet from [AF_INET]192.168.103.76:1194, sid=49293fda 7d5594f8
Fri Feb 28 15:20:33 2014 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Fri Feb 28 15:20:33 2014 VERIFY OK: depth=1, C=MY, ST=SE, L=PJ, O=ECSM, OU=KUSH, CN=ecsvpn, name=admin, emailAddress=is@ecsm.com.my
Fri Feb 28 15:20:33 2014 VERIFY OK: nsCertType=SERVER
Fri Feb 28 15:20:33 2014 VERIFY OK: depth=0, C=MY, ST=SE, L=PJ, O=ECSM, OU=KUSH, CN=ecsvpn, name=admin, emailAddress=is@ecsm.com.my
Fri Feb 28 15:20:33 2014 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Feb 28 15:20:33 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Feb 28 15:20:33 2014 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Feb 28 15:20:33 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Feb 28 15:20:33 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Fri Feb 28 15:20:33 2014 [ecsvpn] Peer Connection Initiated with [AF_INET]server ip address:1194
Fri Feb 28 15:20:34 2014 MANAGEMENT: >STATE:1393572034,GET_CONFIG,,,
Fri Feb 28 15:20:35 2014 SENT CONTROL [ecsvpn]: 'PUSH_REQUEST' (status=1)
Fri Feb 28 15:20:35 2014 AUTH: Received control message: AUTH_FAILED
Fri Feb 28 15:20:35 2014 SIGUSR1[soft,auth-failure] received, process restarting
Fri Feb 28 15:20:35 2014 MANAGEMENT: >STATE:1393572035,RECONNECTING,auth-failure,,
Fri Feb 28 15:20:35 2014 Restart pause, 2 second(s)

Hello
I have the same problem on an w2012 - openvpn 2.3.2
It works on MS-DOS command line. When using script, it logs 'Auth4OpenVPN: -2147221164, Classe non enregistrée' in w2012 events.

Did you find something to solve your problem ?

Thanks

Hi!

I got a fix for this.

Can you please test?

post47736.html?hilit=Auth4OpenVPN#p47736

Thx.