Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

auth-ldap - problem connecting to server #4

Open
GoogleCodeExporter opened this issue Jun 21, 2015 · 9 comments · May be fixed by #75
Open

auth-ldap - problem connecting to server #4

GoogleCodeExporter opened this issue Jun 21, 2015 · 9 comments · May be fixed by #75
Labels
auto-migrated Priority-Medium Type-Enhancement

Comments

@GoogleCodeExporter
Copy link 

What steps will reproduce the problem?
1. at my windows client, right click on client.ovpn
2. start openvpn on this config file
3. insert user and pass

What is the expected output? What do you see instead?
I see: No remote address supplied to OpenVPN LDAP Plugin
(OPENVPN_PLUGIN_CLIENT_CONNECT).
Instead of: Connected.

What version of the product are you using? On what operating system?
openvpn 2.0.9 and auth-ldap-2.0.3 in FreeBSD 6.2

Please provide any additional information below.
When i try to connect with my openvpn windows client i get this on my log
of openvpn server:

Fri Aug 22 05:33:46 2008 us=707255 MULTI: multi_create_instance called
Fri Aug 22 05:33:46 2008 us=707378 172.16.0.12:4901 Re-using SSL/TLS context
Fri Aug 22 05:33:46 2008 us=707629 172.16.0.12:4901 Control Channel MTU
parms [ L:1577 D:138 EF:38 EB:0 ET:0 EL:0 ]
Fri Aug 22 05:33:46 2008 us=707678 172.16.0.12:4901 Data Channel MTU parms
[ L:1577 D:1300 EF:45 EB:4 ET:32 EL:0 ]
Fri Aug 22 05:33:46 2008 us=707771 172.16.0.12:4901 Fragmentation MTU parms
[ L:1577 D:1300 EF:45 EB:4 ET:32 EL:0 ]
Fri Aug 22 05:33:46 2008 us=707863 172.16.0.12:4901 Local Options String:
'V4,dev-type tap,link-mtu 1577,tun-mtu 1532,proto UDPv4,mtu-dynamic,cipher
BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Fri Aug 22 05:33:46 2008 us=707957 172.16.0.12:4901 Expected Remote Options
String: 'V4,dev-type tap,link-mtu 1577,tun-mtu 1532,proto
UDPv4,mtu-dynamic,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Fri Aug 22 05:33:46 2008 us=708019 172.16.0.12:4901 Local Options hash
(VER=V4): '002d8bc3'
Fri Aug 22 05:33:46 2008 us=708116 172.16.0.12:4901 Expected Remote Options
hash (VER=V4): 'cb29316b'
Fri Aug 22 05:33:46 2008 us=708214 172.16.0.12:4901 TLS: Initial packet
from 172.16.0.12:4901, sid=84f43e9e dccd5cf2
Fri Aug 22 05:33:46 2008 us=788470 172.16.0.12:4901 VERIFY OK: depth=1,
/C=PT/ST=LX/L=LISBOA/O=P_P/OU=IF/CN=syndrome.onsite.pt/emailAddress=pedro@pessoa
seprocessos.com
Fri Aug 22 05:33:46 2008 us=788834 172.16.0.12:4901 VERIFY OK: depth=0,
/C=PT/ST=LX/O=P_P/OU=IF/CN=syndrome.onsite.pt/emailAddress=pedro@pessoaseprocess
os.com
Fri Aug 22 05:33:46 2008 us=804979 172.16.0.12:4901 PLUGIN_CALL: POST
/usr/local/lib/openvpn-auth-ldap.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Fri Aug 22 05:33:46 2008 us=805218 172.16.0.12:4901 TLS: Username/Password
authentication succeeded for username 'pedro'
Fri Aug 22 05:33:46 2008 us=805773 172.16.0.12:4901 Data Channel Encrypt:
Cipher 'BF-CBC' initialized with 128 bit key
Fri Aug 22 05:33:46 2008 us=805850 172.16.0.12:4901 Data Channel Encrypt:
Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Aug 22 05:33:46 2008 us=806047 172.16.0.12:4901 Data Channel Decrypt:
Cipher 'BF-CBC' initialized with 128 bit key
Fri Aug 22 05:33:46 2008 us=806102 172.16.0.12:4901 Data Channel Decrypt:
Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Aug 22 05:33:46 2008 us=810544 172.16.0.12:4901 Control Channel: TLSv1,
cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Fri Aug 22 05:33:46 2008 us=810621 172.16.0.12:4901 [syndrome.onsite.pt]
Peer Connection Initiated with 172.16.0.12:4901
No remote address supplied to OpenVPN LDAP Plugin
(OPENVPN_PLUGIN_CLIENT_CONNECT).
Fri Aug 22 05:33:46 2008 us=813079 syndrome.onsite.pt/172.16.0.12:4901
PLUGIN_CALL: POST /usr/local/lib/openvpn-auth-ldap.so/PLUGIN_CLIENT_CONNECT
status=1
Fri Aug 22 05:33:46 2008 us=813213 syndrome.onsite.pt/172.16.0.12:4901
PLUGIN_CALL: plugin function PLUGIN_CLIENT_CONNECT failed with status 1:
/usr/local/lib/openvpn-auth-ldap.so
Fri Aug 22 05:33:46 2008 us=813377 syndrome.onsite.pt/172.16.0.12:4901
WARNING: client-connect plugin call failed
Fri Aug 22 05:33:47 2008 us=694000 syndrome.onsite.pt/172.16.0.12:4901
PUSH: Received control message: 'PUSH_REQUEST'
Fri Aug 22 05:33:47 2008 us=694127 syndrome.onsite.pt/172.16.0.12:4901 SENT
CONTROL [syndrome.onsite.pt]: 'AUTH_FAILED' (status=1)
Fri Aug 22 05:33:47 2008 us=694255 syndrome.onsite.pt/172.16.0.12:4901
Delayed exit in 5 seconds

Original issue reported on code.google.com by pedroam...@gmail.com on 22 Aug 2008 at 1:48
@GoogleCodeExporter
Copy link
Author 

Please anyone

Original comment by pedroam...@gmail.com on 29 Aug 2008 at 10:14

@GoogleCodeExporter
Copy link
Author 

The plugin currently does not work with OpenVPN using tap(4) bridging. This
functionality should be added.

Original comment by landon.j.fuller@gmail.com on 30 Nov 2008 at 9:12

  • Added labels: Type-Enhancement
  • Removed labels: Type-Defect

@GoogleCodeExporter
Copy link
Author 

I had the same problem, using OpenVPN in brigde mode, with custom client-connect
script and auth-ldap. In this situation, OpenVPN environmental viriable
ifconfig_pool_remote_ip (remoteAddress in auth-ldap) isn't set for
OPENVPN_PLUGIN_CLIENT_{CONNECT,DISCONNECT}, and auth-ldap fails.
Because I use OpenVPN on GNU/Linux, I don't use PFTable, and I wrote attached 
patch
to circumvent this problem.

Original comment by comel...@gmail.com on 29 Apr 2009 at 11:25

Attachments:

@GoogleCodeExporter
Copy link
Author 

thanks for this patch, I use the same configuration (tap bridging and linux)...

Original comment by dro...@gmail.com on 20 Jul 2010 at 6:15

@GoogleCodeExporter
Copy link
Author 

That patch seems to not apply anymore, or maybe it's factored in, but anyways 
the code looks different.

I nevertheless still have this problem. After a while, this plugin just dies 
like this.

I have therefore made the following patch to work around this issue. It seems 
to work here.

I have also filed this in the Debian bugtrackers, in 
http://bugs.debian.org/692936

Original comment by theanar...@gmail.com on 11 Nov 2012 at 3:27

Attachments:

@GoogleCodeExporter
Copy link
Author 

hello,
I am using openvpn 2.3.2-2 on centos 6 (openvpn-auth-ldap 2.0.3-6 from the epel 
repo)
I have similar log files... 


Tue Jan 21 10:11:49 2014 xxx.xxx.xxx.xxx:1194 VERIFY OK: depth=0, C=xxx, O=xxx, 
CN=client1
LDAP search failed: No such object
Tue Jan 21 10:11:49 2014 xxx.xxx.xxx.xxx:1194 PLUGIN_CALL: POST 
/usr/lib/openvpn/plugin/lib/openvpn-auth-ldap.so/PLUGIN_AUTH_USER_PASS_VERIFY 
status=0
Tue Jan 21 10:11:49 2014 xxx.xxx.xxx.xxx:1194 TLS: Username/Password 
authentication succeeded for username 'username' 
Tue Jan 21 10:11:49 2014 xxx.xxx.xxx.xxx:1194 Data Channel Encrypt: Cipher 
'BF-CBC' initialized with 128 bit key
Tue Jan 21 10:11:49 2014 xxx.xxx.xxx.xxx:1194 Data Channel Encrypt: Using 160 
bit message hash 'SHA1' for HMAC authentication
Tue Jan 21 10:11:49 2014 xxx.xxx.xxx.xxx:1194 Data Channel Decrypt: Cipher 
'BF-CBC' initialized with 128 bit key
Tue Jan 21 10:11:49 2014 xxx.xxx.xxx.xxx:1194 Data Channel Decrypt: Using 160 
bit message hash 'SHA1' for HMAC authentication
Tue Jan 21 10:11:49 2014 xxx.xxx.xxx.xxx:1194 Control Channel: TLSv1, cipher 
TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Jan 21 10:11:49 2014 xxx.xxx.xxx.xxx:1194 [client1] Peer Connection 
Initiated with [AF_INET]xxx.xxx.xxx.xxx:1194
No remote address supplied to OpenVPN LDAP Plugin 
(OPENVPN_PLUGIN_CLIENT_CONNECT).
Tue Jan 21 10:11:49 2014 client1/xxx.xxx.xxx.xxx:1194 PLUGIN_CALL: POST 
/usr/lib/openvpn/plugin/lib/openvpn-auth-ldap.so/PLUGIN_CLIENT_CONNECT status=1
Tue Jan 21 10:11:49 2014 client1/xxx.xxx.xxx.xxx:1194 PLUGIN_CALL: plugin 
function PLUGIN_CLIENT_CONNECT failed with status 1: 
/usr/lib/openvpn/plugin/lib/openvpn-auth-ldap.so
Tue Jan 21 10:11:49 2014 client1/xxx.xxx.xxx.xxx:1194 WARNING: client-connect 
plugin call failed


While I am almost sure the plugin's config is ok (ldapsearch with same params 
is ok), ldap responds "LDAP search failed: No such object" and then "No remote 
address supplied to OpenVPN LDAP Plugin (OPENVPN_PLUGIN_CLIENT_CONNECT)."
I this a similar error situation ?

thank you

Original comment by alextasi...@gmail.com on 22 Jan 2014 at 2:53

@GoogleCodeExporter
Copy link
Author 

I applied the patch provided in comment #5 (thanks theanar!!!) and the 
authentication on the ldap succeeded (the "OPENVPN_PLUGIN_CLIENT_CONNECT" 
disappeared).
The "LDAP search failed: No such object" exists but causing no problems (maybe 
the sun ldap I am using causes this).

Shouldn't this patch be factored in the code? (2.0.3 version comes from 2008 
and since then there are many fixes) This would be very convenient...
thank you

Original comment by alextasi...@gmail.com on 30 Jan 2014 at 8:33

@rarya1989
Copy link

How to apply the patches ?
can you please provide the steps.

@aniolm9 aniolm9 linked a pull request Aug 5, 2019 that will close this issue
Open
@aniolm9
Copy link

aniolm9 commented Aug 5, 2019

I've just added a pull request (#75) to close this issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
auto-migrated Priority-Medium Type-Enhancement
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Move address checks further down to avoid certain failures
3 participants
@GoogleCodeExporter @aniolm9 @rarya1989