azureusnation Posted April 10, 2019 Posted April 10, 2019 Evening All, Just moved to Smoothwall and trying to setup the SSL VPN for access when I'm at home. However no matter what I try to login with credential wise I always get a AUTH_FAILED. All of the directory services are ticked and green so I'm stuck. Client Log: Try to start OpenVPN connection Connection Wed Apr 10 18:44:10 2019 OpenVPN 2.2.2 Win32-MSVC++ [sSL] [LZO2] [PKCS11] built on Dec 15 2011 Wed Apr 10 18:44:16 2019 WARNING: Make sure you understand the semantics of --tls-remote before using it (see the man page). Wed Apr 10 18:44:16 2019 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables Wed Apr 10 18:44:16 2019 Control Channel Authentication: tls-auth using INLINE static key file Wed Apr 10 18:44:16 2019 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Wed Apr 10 18:44:16 2019 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Wed Apr 10 18:44:16 2019 LZO compression initialized Wed Apr 10 18:44:16 2019 Control Channel MTU parms [ L:1560 D:168 EF:68 EB:0 ET:0 EL:0 ] Wed Apr 10 18:44:16 2019 Socket Buffers: R=[65536->65536] S=[65536->65536] Wed Apr 10 18:44:16 2019 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:135 ET:0 EL:0 AF:3/1 ] Wed Apr 10 18:44:16 2019 Local Options hash (VER=V4): '2f2c6498' Wed Apr 10 18:44:16 2019 Expected Remote Options hash (VER=V4): '9915e4a2' Wed Apr 10 18:44:16 2019 Attempting to establish TCP connection with x.x.x.x:443 Wed Apr 10 18:44:16 2019 TCP connection established with x.x.x.x:443 Wed Apr 10 18:44:16 2019 TCPv4_CLIENT link local: [undef] Wed Apr 10 18:44:16 2019 TCPv4_CLIENT link remote: x.x.x.x:443 Wed Apr 10 18:44:16 2019 TLS: Initial packet from x.x.x.x:443, sid=fd0d2f9b 5a7afb19 Wed Apr 10 18:44:16 2019 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this Wed Apr 10 18:44:16 2019 VERIFY OK: depth=1, certificate Wed Apr 10 18:44:16 2019 VERIFY X509NAME OK: certificate Wed Apr 10 18:44:16 2019 VERIFY OK: depth=0, certificate Wed Apr 10 18:44:17 2019 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key Wed Apr 10 18:44:17 2019 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Wed Apr 10 18:44:17 2019 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key Wed Apr 10 18:44:17 2019 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Wed Apr 10 18:44:17 2019 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA Wed Apr 10 18:44:17 2019 [VPN] Peer Connection Initiated with x.x.x.x:443 ERROR: Received AUTH_FAILED control message Wed Apr 10 18:44:19 2019 SENT CONTROL [VPN]: 'PUSH_REQUEST' (status=1) Wed Apr 10 18:44:19 2019 AUTH: Received AUTH_FAILED control message Wed Apr 10 18:44:19 2019 TCP/UDP: Closing socket Wed Apr 10 18:44:19 2019 SIGTERM[soft,auth-failure] received, process exiting Smoothwall: 18:58:45 SSL VPN TCP connection established with [AF_INET]x.x.x.x:60741 18:58:46 Authentication service Authentication failed (user unknown); username: ajtaylor 18:58:46 SSL VPN 2.127.65.34:60741 WARNING: Failed running command (--auth-user-pass-verify): external program exited with error status: 1 18:58:46 SSL VPN 2.127.65.34:60741 TLS Auth Error: Auth Username/Password verification failed for peer 18:58:46 SSL VPN 2.127.65.34:60741 Peer Connection Initiated with [AF_INET]x.x.x.x:60741 18:58:48 SSL VPN 2.127.65.34:60741 Connection reset, restarting [0] Please help
ibpalle Posted April 11, 2019 Posted April 11, 2019 Auth Username/Password verification failed for peer Would seem to be the kicker here. Check that they entred username and password correctly. Does it work for other users?
azureusnation Posted April 11, 2019 Author Posted April 11, 2019 yep, im putting in my info correctly. I've tried sAM username, upn username, domain\username, username@domain. all the same outcome. logged a case today and just waiting for a response.
ibpalle Posted April 12, 2019 Posted April 12, 2019 Can other users login and what's the result if you test a login on the ssl login page? (https://smoothwall.ip:442/login)
azureusnation Posted April 12, 2019 Author Posted April 12, 2019 No other users can login and when I do the link you have suggested it works as expected. Also I think I should mention I have multi tenancy enabled for our 4 schools currently. Also the representative ive been talking to says that this is related to multi tenancy.
dobsonl Posted April 12, 2019 Posted April 12, 2019 Hi Azureusnation, we had the same issue with smoothwall when we setup the multi tenancy settings... The VPN software on the boxes does not understand multi tenancy authentication sources out of the box, Smoothwall support had to apply a hotfix (PM me if you need the number and I can locate it!) to the box that we wanted SSL connectivity to. 1
ibpalle Posted April 15, 2019 Posted April 15, 2019 The issue with Multi tenant and SSL is that requests are directed to auth via a domain based on the ip address ranges in the multi tenant config. Given that the SSL VPN connections can be coming in from any external IP address which will not, by default, be in the tenant ranges, auth fails. If you only have a number of users coming in from known external IP addresses, then no hotfix should be needed. Just add the external IP to the tenant for that auth directory connection.
azureusnation Posted April 15, 2019 Author Posted April 15, 2019 its a bit difficult when most people have dynamic ip addresses at home or they are on the move. I've spoken to the guys on the helpdesk and they have applied a hotfix that now works flawlessly. However I think ive now found a funny issue with the policy tester with a Perl error on line 251.
ibpalle Posted April 16, 2019 Posted April 16, 2019 The policy tester sometimes have issues when used on a multi tenant systyem as well. I thinks it's down to location. Try selecting a location other than everywhere.
Dianalv Posted May 3, 2019 Posted May 3, 2019 I also have the dynamic ip address at home and have faced some issues connected to VPN processing. Now I have not professional needs and I am using just free VeePN for my personal needs. Next week will move to the new office with my team and we will set up all the network.
azureusnation Posted May 5, 2019 Author Posted May 5, 2019 I don't think I replied back regarding this but I have a solution and Smoothwall have now posted a KB on the issue so ill like that instead of trying o explain enjoy https://kb.smoothwall.com/hc/en-us/articles/360004357100-Using-SSL-VPN-on-a-multitenant-Smoothwall 2
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now