Forum Debian Users Gang

Cześć.
mam problem z połączeniem openvpn przy uwierzytelnieniu za pomocą loginu i hasła. Na certyfikatach dla klienta działa bez problemu, ale chciałbym mieć możliwość uwieżytleniać się za pomocą usera i hasła.

W logach przy połączeniu leci tak:

Thu Mar 15 14:32:30 2018 library versions: OpenSSL 1.1.0f  25 May 2017, LZO 2.10
Thu Mar 15 14:32:30 2018 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25341
Thu Mar 15 14:32:30 2018 Need hold release from management interface, waiting...
Thu Mar 15 14:32:30 2018 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25341
Thu Mar 15 14:32:30 2018 MANAGEMENT: CMD 'state on'
Thu Mar 15 14:32:30 2018 MANAGEMENT: CMD 'log all on'
Thu Mar 15 14:32:30 2018 MANAGEMENT: CMD 'echo all on'
Thu Mar 15 14:32:30 2018 MANAGEMENT: CMD 'bytecount 5'
Thu Mar 15 14:32:30 2018 MANAGEMENT: CMD 'hold off'
Thu Mar 15 14:32:30 2018 MANAGEMENT: CMD 'hold release'
Thu Mar 15 14:32:35 2018 MANAGEMENT: CMD 'username "Auth" "nazwausera"'
Thu Mar 15 14:32:35 2018 MANAGEMENT: CMD 'password [...]'
Thu Mar 15 14:32:35 2018 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Thu Mar 15 14:32:35 2018 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Thu Mar 15 14:32:35 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]XXX.YYY.ZZZ.VVV:1194
Thu Mar 15 14:32:35 2018 Socket Buffers: R=[65536->65536] S=[65536->65536]
Thu Mar 15 14:32:35 2018 UDP link local: (not bound)
Thu Mar 15 14:32:35 2018 UDP link remote: [AF_INET]XXX.YYY.ZZZ.VVV:1194
Thu Mar 15 14:32:35 2018 MANAGEMENT: >STATE:1521120755,WAIT,,,,,,
Thu Mar 15 14:32:37 2018 MANAGEMENT: >STATE:1521120757,AUTH,,,,,,
Thu Mar 15 14:32:37 2018 TLS: Initial packet from [AF_INET]XXX.YYY.ZZZ.VVV:1194, sid=3f0520b6 9fe98125
Thu Mar 15 14:32:37 2018 WARNING: this configuration may cache passwords in memory — use the auth-nocache option to prevent this
Thu Mar 15 14:32:37 2018 VERIFY OK: depth=1, C=PL, ST=KW, L=jakiesmiasto, O=mojanaza, OU=mojanaza, CN=mojanaza CA, name=VPNServer, emailAddress=info@mojanaza
Thu Mar 15 14:32:37 2018 VERIFY KU OK
Thu Mar 15 14:32:37 2018 Validating certificate extended key usage
Thu Mar 15 14:32:37 2018 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Thu Mar 15 14:32:37 2018 VERIFY EKU OK
Thu Mar 15 14:32:37 2018 VERIFY OK: depth=0, C=PL, ST=KW, L=jakiesmiasto, O=mojanaza, OU=mojanaza, CN=server, name=VPNServer, emailAddress=info@mojanaza

W tym momencie staje po czym wypluwa:

Thu Mar 15 14:33:35 2018 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Thu Mar 15 14:33:35 2018 TLS Error: TLS handshake failed

Jak wspomniałem przy uwierzytelnieniu certyfikatem klienta nie ma problemu.

Plik konfiguracyjny klienta:

client
auth-user-pass
dev tun
proto udp
remote xxx.yyy.zzz.vvv 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
remote-cert-tls server
tls-auth ta.key 1
cipher AES-256-CBC
auth SHA512
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-256-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA:TLS-DHE-RSA-WITH-AES-128-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA
verb 3

Konfig serwera:

local xxx.yyy.zzz.vvv
port 1194
rroto udp
dev tun
ca /etc/openvpn/certs/keys/ca.crt
cert /etc/openvpn/certs/keys/server.crt
key /etc/openvpn/certs/keys/server.key
dh dh4096.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
client-to-client
keepalive 10 120
tls-auth /etc/openvpn/certs/keys/ta.key 0 # This file is secret
cipher AES-256-CBC
auth SHA512
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AE$
user openvpn
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log
log-append  /var/log/openvpn.log
verb 3
explicit-exit-notify 1
client-cert-not-required
username-as-common-name
plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so "/etc/pam.d/openvpn"
tmp-dir /tmp

próbowałem też dla kont systemowych parametr do pluginu pam-a /etc/pam.d/login ale też bez efektu

Jak ktoś będzie miał jakiś pomysł będę wdzięczny.

--- EDIT ---

Dobra doszedłem do tego że działa albo na certyfikatach albo na uwierzytelnianiu user/pass . Jednocześnie tak i tak póki co nie chce działać ,... ale jeszcze powalczę :)

Ostatnio edytowany przez life (2018-03-15 20:45:05)