Re: Importing OpenVPN. ovpn file in Fedora 25

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




On Feb 18, 2017 3:03 AM, "Ed Greshko" <ed.greshko@xxxxxxxxxxx> wrote:
On 02/18/17 14:38, InvalidPath wrote:
> Well thats just it.. on linux IDK where the correct location is.  I
> tried placing it and the ca.crt in the same folder, then specifying
> the entire path in the .ovpn and both times the gui prompted me, do I
> want to copy them to /home/user/etc/etc and I chose yes.  But the
> connection times out in either case.


First of all....  Many people on this list, myself included, would
appreciate it if you'd put your responses below the text is the reply.
It makes for easier reading

With Networkmanager it is best to put them under their own directory
under...

~/.local/share/networkmanagement/certificates

For example.....

[egreshko@meimei certificates]$ pwd
/home/egreshko/.local/share/networkmanagement/certificates

[egreshko@meimei certificates]$ ls
AU-Sydney-S1       US-Los-Angeles-S3    US-San-Jose-S1
US-Kansas-City-S1  US-New-York-City-S1  US-Seattle-S1

Showing I have 6 connections defined.

[egreshko@meimei certificates]$ ls -Z US-Kansas-City-S1
unconfined_u:object_r:home_cert_t:s0 ca.crt
unconfined_u:object_r:home_cert_t:s0 cert.crt
unconfined_u:object_r:home_cert_t:s0 private.key
unconfined_u:object_r:home_cert_t:s0 tls_auth.key

Shows the key files for that one connection and their selinux contents.

Do Not "move" the cert files to their new locations but copy them.  If
you move them they will not have the selinux context and you'll have to
take a second step to restore the context.

Then, when you try connecting you should check the journal (using
journalctl) to see if the connection is made and/or if there are any errors.

A successful connection would look like something similar to this....

[egreshko@meimei ~]$ cat openvpn
Feb 18 17:03:56 meimei.greshko.com nm-openvpn[32673]: OpenVPN 2.3.14
x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH]
[IPv6] built on Dec  7 2016
Feb 18 17:03:56 meimei.greshko.com nm-openvpn[32673]: library versions:
OpenSSL 1.0.2k-fips  26 Jan 2017, LZO 2.08
Feb 18 17:03:56 meimei.greshko.com nm-openvpn[32673]: WARNING: No server
certificate verification method has been enabled.  See
http://openvpn.net/howto.html#mitm for more info.
Feb 18 17:03:56 meimei.greshko.com nm-openvpn[32673]: NOTE: the current
--script-security setting may allow this configuration to call
user-defined scripts
Feb 18 17:03:56 meimei.greshko.com nm-openvpn[32673]: Control Channel
Authentication: using
'/home/egreshko/.local/share/networkmanagement/certificates/US-Seattle-S1/tls_auth.key'
as a OpenVPN static key file
Feb 18 17:03:57 meimei.greshko.com nm-openvpn[32673]: NOTE: UID/GID
downgrade will be delayed because of --client, --pull, or --up-delay
Feb 18 17:03:57 meimei.greshko.com nm-openvpn[32673]: UDPv4 link local:
[undef]
Feb 18 17:03:57 meimei.greshko.com nm-openvpn[32673]: UDPv4 link remote:
[AF_INET]69.4.227.18:53
Feb 18 17:04:00 meimei.greshko.com nm-openvpn[32673]: [isvpn.net] Peer
Connection Initiated with [AF_INET]69.4.227.18:53
Feb 18 17:04:02 meimei.greshko.com nm-openvpn[32673]: Options error:
Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:2:
topology-subnet (2.3.14)
Feb 18 17:04:02 meimei.greshko.com nm-openvpn[32673]: Options error:
option 'mssfix' cannot be used in this context ([PUSH-OPTIONS])
Feb 18 17:04:02 meimei.greshko.com nm-openvpn[32673]: Options error:
Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:6:
dhcp-pre-release (2.3.14)
Feb 18 17:04:02 meimei.greshko.com nm-openvpn[32673]: Options error:
Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:7:
dhcp-renew (2.3.14)
Feb 18 17:04:02 meimei.greshko.com nm-openvpn[32673]: Options error:
Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:8:
dhcp-release (2.3.14)
Feb 18 17:04:02 meimei.greshko.com nm-openvpn[32673]: Options error:
Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:14:
register-dns (2.3.14)
Feb 18 17:04:02 meimei.greshko.com nm-openvpn[32673]: Options error:
Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:15:
block-ipv6 (2.3.14)
Feb 18 17:04:02 meimei.greshko.com nm-openvpn[32673]: TUN/TAP device
tun0 opened
Feb 18 17:04:02 meimei.greshko.com nm-openvpn[32673]:
/usr/libexec/nm-openvpn-service-openvpn-helper --debug 0 32667
--bus-name org.freedesktop.NetworkManager.openvpn.Connection_9 --tun --
tun0 1500 1570 25.0.8.4 255.255.255.0 init
Feb 18 17:04:07 meimei.greshko.com nm-openvpn[32673]: GID set to nm-openvpn
Feb 18 17:04:07 meimei.greshko.com nm-openvpn[32673]: UID set to nm-openvpn
Feb 18 17:04:07 meimei.greshko.com nm-openvpn[32673]: Initialization
Sequence Completed
Feb 18 17:04:12 meimei.greshko.com nm-openvpn[32673]: SIGTERM received,
sending exit notification to peer
Feb 18 17:04:13 meimei.greshko.com nm-openvpn[32673]:
SIGTERM[soft,exit-with-notification] received, process exiting



--
Fedora Users List - The place to go to get others to do the work for you
_______________________________________________
users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to users-leave@lists.fedoraproject.org


Sorry Ed.. with the default being at the top for so many devices and apps it didn't even cross my mind.


~/.local/share/networkmanagement/certificates this is exactly where Network Manager prompts me to copy the cert to.  So with that in mine that's when I tried removing the full path, here's an example:

dev tun
persist-tun
persist-key
cipher BF-CBC
auth SHA1
tls-client
client
resolv-retry infinite
remote x.x.x.x.x 34447 udp
lport 0
auth-user-pass
ca /home/bhart/Documents/VPN_CONFIG/config/xxxx-fw-1-udp-34447-ca.crt
tls-auth /home/bhart/Documents/VPN_CONFIG/config/xxxx-fw-1-udp-34447-tls.key 1
ns-cert-type server
comp-lzo adaptive
 

But then once they're copied to that other location I decided that maybe I should remove those paths.  It didn't change things.

➜  certificates ll
total 8.0K
-rw-r--r-- 1 bhart bhart 1.4K Feb 17 07:12 xxxx-fw-1-udp-34447-config_gntc-fw-1-udp-34447-ca.crt
-rw-r--r-- 1 bhart bhart  657 Feb 17 07:12 xxxx-fw-1-udp-34447-config_gntc-fw-1-udp-34447-tls.key


So journalctl -xe right now shows  :

Feb 18 08:23:27 localhost.localdomain NetworkManager[1297]: <info>  [1487431407.9972] keyfile: update /etc/NetworkManager/system-connections/xxxx-fw-1-udp-34447-config (d550859
Feb 18 08:23:27 localhost.localdomain NetworkManager[1297]: <info>  [1487431407.9976] audit: op="connection-update" uuid="d550859e-f14a-40b5-8ab0-64b3a13d8ef3" name="xxxx-fw-1-
Feb 18 08:23:29 localhost.localdomain kde5-nm-connection-editor[5001]: QDBusObjectPath: invalid path ""
Feb 18 08:23:29 localhost.localdomain NetworkManager[1297]: <info>  [1487431409.6901] audit: op="connection-activate" uuid="d550859e-f14a-40b5-8ab0-64b3a13d8ef3" name="xxxx-fw-
Feb 18 08:23:29 localhost.localdomain NetworkManager[1297]: <info>  [1487431409.6927] vpn-connection[0x55ade43bb2f0,d550859e-f14a-40b5-8ab0-64b3a13d8ef3,"xxxx-fw-1-udp-34447-co
Feb 18 08:23:29 localhost.localdomain NetworkManager[1297]: <info>  [1487431409.6990] vpn-connection[0x55ade43bb2f0,d550859e-f14a-40b5-8ab0-64b3a13d8ef3,"xxxx-fw-1-udp-34447-co
Feb 18 08:23:29 localhost.localdomain kdeinit5[2289]: plasma-nm: Unhandled VPN connection state change:  2
Feb 18 08:23:29 localhost.localdomain kdeinit5[2289]: plasma-nm: Unhandled VPN connection state change:  3
Feb 18 08:23:29 localhost.localdomain NetworkManager[1297]: <info>  [1487431409.7264] vpn-connection[0x55ade43bb2f0,d550859e-f14a-40b5-8ab0-64b3a13d8ef3,"xxxx-fw-1-udp-34447-co
Feb 18 08:23:29 localhost.localdomain nm-openvpn[5401]: Options error: If you use one of --cert or --key, you must use them both


This is confusing.. according to the .ovpn file this connection should be using auth-user-pass but then without specifying password with TLS how does the key file get used?  (I did attempt connection with just password set and it fails with:

Feb 18 08:32:16 localhost.localdomain nm-openvpn[7769]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more in
Feb 18 08:32:16 localhost.localdomain nm-openvpn[7769]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Feb 18 08:32:16 localhost.localdomain nm-openvpn[7769]: UDPv4 link local: [undef]
Feb 18 08:32:16 localhost.localdomain nm-openvpn[7769]: UDPv4 link remote: [AF_INET]72.174.102.34:34447
Feb 18 08:32:16 localhost.localdomain nm-openvpn[7769]: VERIFY ERROR: depth=0, error=certificate signature failure: C=US, ST=MT, O=$organization, OU=Operations, CN=xxxx-v
Feb 18 08:32:16 localhost.localdomain nm-openvpn[7769]: OpenSSL: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed
Feb 18 08:32:16 localhost.localdomain nm-openvpn[7769]: TLS_ERROR: BIO read tls_read_plaintext error
Feb 18 08:32:16 localhost.localdomain nm-openvpn[7769]: TLS Error: TLS object -> incoming plaintext read error
Feb 18 08:32:16 localhost.localdomain nm-openvpn[7769]: TLS Error: TLS handshake failed
Feb 18 08:32:16 localhost.localdomain nm-openvpn[7769]: SIGUSR1[soft,tls-error] received, process restarting

Which is even more confusing because this config file works perfectly with the Windows OpenVPN client. So there must be some difference in how the clients use this file because teh certificate is valid.  I did goto the link in this error log and it's really not much help since the server certificate and actually the entire config was generated from pfSense.

Thanks

_______________________________________________
users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx
[Index of Archives]     [Older Fedora Users]     [Fedora Announce]     [Fedora Package Announce]     [EPEL Announce]     [EPEL Devel]     [Fedora Magazine]     [Fedora Summer Coding]     [Fedora Laptop]     [Fedora Cloud]     [Fedora Advisory Board]     [Fedora Education]     [Fedora Security]     [Fedora Scitech]     [Fedora Robotics]     [Fedora Infrastructure]     [Fedora Websites]     [Anaconda Devel]     [Fedora Devel Java]     [Fedora Desktop]     [Fedora Fonts]     [Fedora Marketing]     [Fedora Management Tools]     [Fedora Mentors]     [Fedora Package Review]     [Fedora R Devel]     [Fedora PHP Devel]     [Kickstart]     [Fedora Music]     [Fedora Packaging]     [Fedora SELinux]     [Fedora Legal]     [Fedora Kernel]     [Fedora OCaml]     [Coolkey]     [Virtualization Tools]     [ET Management Tools]     [Yum Users]     [Yosemite News]     [Gnome Users]     [KDE Users]     [Fedora Art]     [Fedora Docs]     [Fedora Sparc]     [Libvirt Users]     [Fedora ARM]

  Powered by Linux