[RISOLTO] client OpenVPN: non riesco a collegarmi

[daniele50]

Ciao,
sto cercando di collegarmi alla vpn dell'ufficio con il client openVPN.
Ho provato sul portatile con Windows e dopo aver installato il client ed importato il file di configurazione di openVPN (già preparato dall'azienda) mi sono connesso senza problemi.
Allora ho provato sulla slackware-current: ho installato kvpnc, ho importato il file di configurazione di openVPN ma non si collegava, dopo un breve confronto ho notato che in windows il traffico viaggia sulla porta 443 mentre sulla slacky usava la 1197 (se non ricordo male), allora sono andato ad editare la configurazione forzando la porta 443 ma ancora non riesco a collegarmi.
Il log di openVPN è questo:

Codice: Seleziona tutto

debug: openvpn: /usr/sbin/openvpn
debug: Support for TUN/TAP found (compiled into kernel or kernel module already loaded).
debug: Default interface: "eth0".
debug: IP address of default interface: "192.168.1.2".
info: Trying to connect to server "xxx.xxx.xxx.xxx" with ... 
debug: Setting DNS_UPDATE "NO".
debug: Starting Openvpn management handler...
debug: [openvpn] Fri Oct 1 20:46:57 2010 OpenVPN 2.1.1 i486-slackware-linux-gnu [SSL] [LZO2] [EPOLL] built on May 3 2010
debug: [openvpn] 
info: Send username...
info: Send password...
debug: [openvpn] Fri Oct 1 20:46:57 2010 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
debug: [openvpn] Fri Oct 1 20:46:57 2010 WARNING: file '/root/.kde/share/apps/kvpnc/openvpn_privatekey__home_daniele50_pkg_kvpnc_client.pem' is group or others accessible
debug: [openvpn] Fri Oct 1 20:46:57 2010 WARNING: file '/root/.kde/share/apps/kvpnc/openvpn_tlsauth__home_daniele50_pkg_kvpnc_client.pem' is group or others accessible
debug: [openvpn] Fri Oct 1 20:46:57 2010 Control Channel Authentication: using '/root/.kde/share/apps/kvpnc/openvpn_tlsauth__home_daniele50_pkg_kvpnc_client.pem' as a OpenVPN static key file
debug: [openvpn] Fri Oct 1 20:46:57 2010 LZO compression initialized
debug: [openvpn] Fri Oct 1 20:46:57 2010 Attempting to establish TCP connection with xxx.xxx.xxx.xxx:443 [nonblock]
debug: [openvpn] 
debug: [openvpn] Fri Oct 1 20:46:58 2010 TCP connection established with xxx.xxx.xxx.xxx:443
info: [openvpn]: Low level connection to xxx.xxx.xxx.xxx established.
debug: [openvpn] Fri Oct 1 20:46:58 2010 TCPv4_CLIENT link local: [undef]
debug: [openvpn] Fri Oct 1 20:46:58 2010 TCPv4_CLIENT link remote: xxx.xxx.xxx.xxx:443
debug: [openvpn] 
debug: [openvpn] Fri Oct 1 20:46:58 2010 Connection reset, restarting [0]
debug: [openvpn] Fri Oct 1 20:46:58 2010 SIGUSR1[soft,connection-reset] received, process restarting
debug: [openvpn] 
debug: [openvpn] 
debug: [openvpn] Fri Oct 1 20:47:03 2010 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
debug: [openvpn] Fri Oct 1 20:47:03 2010 Re-using SSL/TLS context
debug: [openvpn] Fri Oct 1 20:47:03 2010 LZO compression initialized
debug: [openvpn] Fri Oct 1 20:47:03 2010 Attempting to establish TCP connection with xxx.xxx.xxx.xxx:443 [nonblock]
debug: [openvpn] 
debug: [openvpn] Fri Oct 1 20:47:04 2010 TCP connection established with xxx.xxx.xxx.xxx:443
info: [openvpn]: Low level connection to xxx.xxx.xxx.xxx established.
debug: [openvpn] Fri Oct 1 20:47:04 2010 TCPv4_CLIENT link local: [undef]
debug: [openvpn] Fri Oct 1 20:47:04 2010 TCPv4_CLIENT link remote: xxx.xxx.xxx.xxx:443
debug: [openvpn] Fri Oct 1 20:47:04 2010 Connection reset, restarting [0]
debug: [openvpn] Fri Oct 1 20:47:04 2010 SIGUSR1[soft,connection-reset] received, process restarting
debug: [openvpn] 
debug: [openvpn] 
debug: [openvpn] Fri Oct 1 20:47:09 2010 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
debug: [openvpn] Fri Oct 1 20:47:09 2010 Attempting to establish TCP connection with xxx.xxx.xxx.xxx:443 [nonblock]
debug: [openvpn] 
debug: [openvpn] Fri Oct 1 20:47:09 2010 Re-using SSL/TLS context
debug: [openvpn] Fri Oct 1 20:47:09 2010 LZO compression initialized
debug: [openvpn] 
debug: [openvpn] Fri Oct 1 20:47:10 2010 TCP connection established with xxx.xxx.xxx.xxx:443
info: [openvpn]: Low level connection to xxx.xxx.xxx.xxx established.
debug: [openvpn] Fri Oct 1 20:47:10 2010 TCPv4_CLIENT link local: [undef]
debug: [openvpn] Fri Oct 1 20:47:10 2010 TCPv4_CLIENT link remote: xxx.xxx.xxx.xxx:443
debug: [openvpn] Fri Oct 1 20:47:10 2010 Connection reset, restarting [0]
debug: [openvpn] Fri Oct 1 20:47:10 2010 SIGUSR1[soft,connection-reset] received, process restarting
debug: [openvpn] 
debug: [openvpn] 
debug: Disconnect requested
debug: Disconnect requested, status connecting
debug: Killing process while connecting. 
success: Successful connect try canceled.
debug: Disconnected.

praticamente va in loop e continua a riprovare (ripetendo nel log le stesse righe), idee su cosa posso controllare?

[daniele50]

Dopo un po' di ricerche credo di aver capito che kvpnc sia solo un'interfaccia, per collegarsi ad una vpn openvpn devo installare openvpn con varie librerie... dato che non ho voglia di compilare per ora lo uso su win.

[NetNightmare]

si kvnp e' un interfaccia ... ma openvp e' installato di default su slackware ... inoltre il log che posti ... e' di openvpn , leggendo il log cosi a occhio senza vedere la conf del client o del server direi che c'e' un encription mismatch probabilmente sui settaggi di SSL\TLS , tieni inoltre a mente che la porta standard e' la 1197 per ipsec ... la 443 e' probabilmente una configurazione fatta lato server ....per concludere i file di configurazione client tra windows e nix non sono al 100% uguali per linux io spesso ho dovuto apportare qualche lieve modifica ...

[daniele50]

Ora sto provando da console direttamente lanciando (come root) openvpn e dandogli in pasto il file .ovnp, l'uotput è leggermente diverso ma la connessione non va a buon fine.
E se volessi a modificare il file .ovpn adattandolo per linux come dovrei fare?

Codice: Seleziona tutto

root@slacky:/home/daniele50# openvpn --config client.ovpn            
Sun Oct  3 13:15:12 2010 OpenVPN 2.1.1 i486-slackware-linux-gnu [SSL] [LZO2] [EPOLL] built on May  3 2010
Enter Auth Username:cindan
Enter Auth Password:
Sun Oct  3 13:15:21 2010 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sun Oct  3 13:15:21 2010 Control Channel Authentication: tls-auth using INLINE static key file
Sun Oct  3 13:15:21 2010 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Oct  3 13:15:21 2010 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Oct  3 13:15:21 2010 LZO compression initialized
Sun Oct  3 13:15:21 2010 Control Channel MTU parms [ L:1544 D:168 EF:68 EB:0 ET:0 EL:0 ]
Sun Oct  3 13:15:21 2010 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Oct  3 13:15:21 2010 Local Options hash (VER=V4): 'ee93268d'
Sun Oct  3 13:15:21 2010 Expected Remote Options hash (VER=V4): 'bd577cd1'
Sun Oct  3 13:15:21 2010 Attempting to establish TCP connection with xxx.xxx.xxx.xxx:443 [nonblock]
Sun Oct  3 13:15:22 2010 TCP connection established with xxx.xxx.xxx.xxx:443
Sun Oct  3 13:15:22 2010 Socket Buffers: R=[87380->200000] S=[16384->200000]
Sun Oct  3 13:15:22 2010 TCPv4_CLIENT link local: [undef]
Sun Oct  3 13:15:22 2010 TCPv4_CLIENT link remote: xxx.xxx.xxx.xxx:443
Sun Oct  3 13:15:22 2010 TLS: Initial packet from xxx.xxx.xxx.xxx:443, sid=531a4526 f3e1d6c4
Sun Oct  3 13:15:22 2010 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sun Oct  3 13:15:22 2010 VERIFY OK: depth=1, /CN=OpenVPN_CA
Sun Oct  3 13:15:22 2010 VERIFY OK: nsCertType=SERVER
Sun Oct  3 13:15:22 2010 VERIFY OK: depth=0, /CN=OpenVPN_Server
Sun Oct  3 13:15:22 2010 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Oct  3 13:15:22 2010 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Oct  3 13:15:22 2010 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Oct  3 13:15:22 2010 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Oct  3 13:15:22 2010 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sun Oct  3 13:15:22 2010 [OpenVPN_Server] Peer Connection Initiated with xxx.xxx.xxx.xxx:443
Sun Oct  3 13:15:24 2010 SENT CONTROL [OpenVPN_Server]: 'PUSH_REQUEST' (status=1)                                                                       
Sun Oct  3 13:15:24 2010 PUSH: Received control message: 'PUSH_REPLY,explicit-exit-notify,topology subnet,route-delay 5 30,dhcp-pre-release,dhcp-renew,dhcp-release,route-metric 101,route-delay 6,ping 5,ping-restart 40,socket-flags TCP_NODELAY,redirect-private local,redirect-private bypass-dhcp,route-gateway xxx.xxx.12.1,route xxx.xxx.10.151,route xxx.xxx.0.0 xxx.xxx.255.0,route xxx.xxx.0.0 xxx.xxx.255.0,route xxx.xxx.2.224,route xxx.xxx.2.236,dhcp-option DNS xxx.xxx.2.224,dhcp-option DNS xxx.xxx.2.236,dhcp-option DOMAIN intranet.azienda.it,comp-lzo yes,ifconfig xxx.xxx.12.218 xxx.xxx.255.0'                      
Sun Oct  3 13:15:24 2010 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:4: dhcp-pre-release (2.1.1)                       
Sun Oct  3 13:15:24 2010 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:5: dhcp-renew (2.1.1)                             
Sun Oct  3 13:15:24 2010 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:6: dhcp-release (2.1.1)                           
Sun Oct  3 13:15:24 2010 OPTIONS IMPORT: timers and/or timeouts modified                                                                                
Sun Oct  3 13:15:24 2010 OPTIONS IMPORT: --explicit-exit-notify can only be used with --proto udp                                                       
Sun Oct  3 13:15:24 2010 OPTIONS IMPORT: LZO parms modified                                                                                             
Sun Oct  3 13:15:24 2010 OPTIONS IMPORT: --socket-flags option modified                                                                                 
Sun Oct  3 13:15:24 2010 Socket flags: TCP_NODELAY=1 succeeded                                                                                          
Sun Oct  3 13:15:24 2010 OPTIONS IMPORT: --ifconfig/up options modified                                                                                 
Sun Oct  3 13:15:24 2010 OPTIONS IMPORT: route options modified                                                                                         
Sun Oct  3 13:15:24 2010 OPTIONS IMPORT: route-related options modified                                                                                 
Sun Oct  3 13:15:24 2010 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified                                                               
Sun Oct  3 13:15:24 2010 ROUTE default_gateway=192.168.1.1
Sun Oct  3 13:15:24 2010 Note: Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2)
Sun Oct  3 13:15:24 2010 Note: Attempting fallback to kernel 2.2 TUN/TAP interface
Sun Oct  3 13:15:24 2010 Cannot allocate TUN/TAP dev dynamically
Sun Oct  3 13:15:24 2010 Exiting
root@slacky:/home/daniele50# 

[NetNightmare]

per poter rispondere alla tua domanda dovrei vedere il file di config , tuttavia pare che il tuo problema sia altro ovvero

Codice: Seleziona tutto

Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2)

da questo errore sembrerebbe che il tuo kernel non abbia nella sezione

Codice: Seleziona tutto

Network device support

il seguente flag attivo

Codice: Seleziona tutto

<*> Universal TUN/TAP device driver" support 

che kernel stai utilizzando ? prova a partire con lo huge .... e riprova oppure verifica che il kernel attuale abbia questo flag attivo .....

[daniele50]

Nel kernel è impostato come modulo:

Codice: Seleziona tutto

<M> Universal TUN/TAP device driver support

Il kernel è generic

Codice: Seleziona tutto

Linux slacky 2.6.33.4-smp #1 SMP Sat May 22 16:11:10 CEST 2010 i686 AMD Athlon(tm) 64 X2 Dual Core Processor 5000+ AuthenticAMD GNU/Linux

Grazie a queste informazioni sono riuscito a collegarmi

Mi è bastato caricare il modulo

Codice: Seleziona tutto

modprobe tun

e lanciare openvpn con il file di configurazione

Codice: Seleziona tutto

openvpn --confi client.ovpn

Ora non mi resta che fare un script che, lanciato come root, carica il modulo, lancia la connessione vpn e fa partire un rdesktop.
Grazie NetNightmare

[daniele50]

Offtopic: Solo una piccola domanda offtopic:
vorrei fare questo script sh da lanciare come root del tipo:

modprobe tun &&
openvpn --config client.ovpn
rdesktop -rxxx.xxx.xxx.xxx &&
insmod tun

però il comando 'rdesktop...' deve partire come utente (e non come root) e dopo x secondi dal comando precedente 'openvpn...',
mentre il comando 'insmod tun' solo alla chiusure di rdesktop