[Soci SLIP] problemino con openvpn

[Enrico Agliotti]

Il 23 dicembre 2010 12:59, Lucio Crusca <lucio a sulweb.org> ha scritto:
> In data giovedì 23 dicembre 2010 12:54:18, Lucio Crusca ha scritto:
>
>> 3.  faccio un restart di openvpn con /etc/init.d/openvpn restart e mi
>> chiede la password del certificato (il nome utente non me lo chiede mai,
>> come dicevo non mi è chiaro a cosa serva il nome utente con i
>> certificati).
>
> Mi correggo, mi chiede la password della chiave privata, il certificato
> ovviamente non ha password.

nel mio file di configurazione (quello che funziona con win + putty) c'è:
ca xxx.cer
auth-user-pass

mentre è commentato:
;cert client.crt
;key client.key

ad intuizione è impostato per chiedermi nome utente e password
dell'utente con cui voglio connettermi e infatti me lo chiede ma poi
non mi fa entrare.

questo è l'output del tentativo di connessione (ho cancellato i
riferimenti al server):

$ openvpn acsa.ovpn
Thu Dec 23 14:51:23 2010 OpenVPN 2.1.3 x86_64-pc-linux-gnu [SSL]
[LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Oct 22
2010
Enter Auth Username:root
Enter Auth Password:
Thu Dec 23 14:51:29 2010 WARNING: No server certificate verification
method has been enabled.  See http://openvpn.net/howto.html#mitm for
more info.
Thu Dec 23 14:51:29 2010 NOTE: OpenVPN 2.1 requires '--script-security
2' or higher to call user-defined scripts or executables
Thu Dec 23 14:51:29 2010 LZO compression initialized
Thu Dec 23 14:51:29 2010 Control Channel MTU parms [ L:1574 D:138
EF:38 EB:0 ET:0 EL:0 ]
Thu Dec 23 14:51:29 2010 Socket Buffers: R=[124928->131072] S=[124928->131072]
Thu Dec 23 14:51:29 2010 Data Channel MTU parms [ L:1574 D:1450 EF:42
EB:135 ET:32 EL:0 AF:3/1 ]
Thu Dec 23 14:51:29 2010 Local Options hash (VER=V4): 'xxx'
Thu Dec 23 14:51:29 2010 Expected Remote Options hash (VER=V4): 'f7df56b8'
Thu Dec 23 14:51:29 2010 UDPv4 link local: [undef]
Thu Dec 23 14:51:29 2010 UDPv4 link remote: [AF_INET]151.58.232.110:1194
Thu Dec 23 14:51:30 2010 TLS: Initial packet from [AF_INET]a.b.c.d:p,
sid=xxx yyy
Thu Dec 23 14:51:30 2010 WARNING: this configuration may cache
passwords in memory -- use the auth-nocache option to prevent this
Thu Dec 23 14:51:31 2010 VERIFY OK: depth=1, /C=IT/O=efw/CN=efw_CA
Thu Dec 23 14:51:31 2010 VERIFY OK: depth=0, /C=IT/O=efw/CN=127.0.0.1
Thu Dec 23 14:51:31 2010 Data Channel Encrypt: Cipher 'BF-CBC'
initialized with 128 bit key
Thu Dec 23 14:51:31 2010 Data Channel Encrypt: Using 160 bit message
hash 'SHA1' for HMAC authentication
Thu Dec 23 14:51:31 2010 Data Channel Decrypt: Cipher 'BF-CBC'
initialized with 128 bit key
Thu Dec 23 14:51:31 2010 Data Channel Decrypt: Using 160 bit message
hash 'SHA1' for HMAC authentication
Thu Dec 23 14:51:31 2010 Control Channel: TLSv1, cipher TLSv1/SSLv3
DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Dec 23 14:51:31 2010 [127.0.0.1] Peer Connection Initiated with
[AF_INET]a.b.c.d:p
Thu Dec 23 14:51:34 2010 SENT CONTROL [127.0.0.1]: 'PUSH_REQUEST'
(status=1)
Thu Dec 23 14:51:34 2010 AUTH: Received AUTH_FAILED control message
Thu Dec 23 14:51:34 2010 TCP/UDP: Closing socket
Thu Dec 23 14:51:34 2010 SIGTERM[soft,auth-failure] received, process exiting





-- 
Enrico Agliotti
cell. +39-328-0517312
tel. con segreteria: +39-011-23415553