Smoothwall SSL VPN AUTH_FAILED Issue

[azureusnation]

Evening All,

 

Just moved to Smoothwall and trying to setup the SSL VPN for access when I'm at home. However no matter what I try to login with credential wise I always get a AUTH_FAILED. All of the directory services are ticked and green so I'm stuck.

 

Client Log:

Try to start OpenVPN connection Connection

Wed Apr 10 18:44:10 2019 OpenVPN 2.2.2 Win32-MSVC++ [sSL] [LZO2] [PKCS11] built on Dec 15 2011

Wed Apr 10 18:44:16 2019 WARNING: Make sure you understand the semantics of --tls-remote before using it (see the man page).

Wed Apr 10 18:44:16 2019 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables

Wed Apr 10 18:44:16 2019 Control Channel Authentication: tls-auth using INLINE static key file

Wed Apr 10 18:44:16 2019 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication

Wed Apr 10 18:44:16 2019 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication

Wed Apr 10 18:44:16 2019 LZO compression initialized

Wed Apr 10 18:44:16 2019 Control Channel MTU parms [ L:1560 D:168 EF:68 EB:0 ET:0 EL:0 ]

Wed Apr 10 18:44:16 2019 Socket Buffers: R=[65536->65536] S=[65536->65536]

Wed Apr 10 18:44:16 2019 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:135 ET:0 EL:0 AF:3/1 ]

Wed Apr 10 18:44:16 2019 Local Options hash (VER=V4): '2f2c6498'

Wed Apr 10 18:44:16 2019 Expected Remote Options hash (VER=V4): '9915e4a2'

Wed Apr 10 18:44:16 2019 Attempting to establish TCP connection with x.x.x.x:443

Wed Apr 10 18:44:16 2019 TCP connection established with x.x.x.x:443

Wed Apr 10 18:44:16 2019 TCPv4_CLIENT link local: [undef]

Wed Apr 10 18:44:16 2019 TCPv4_CLIENT link remote: x.x.x.x:443

Wed Apr 10 18:44:16 2019 TLS: Initial packet from x.x.x.x:443, sid=fd0d2f9b 5a7afb19

Wed Apr 10 18:44:16 2019 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this

Wed Apr 10 18:44:16 2019 VERIFY OK: depth=1, certificate

Wed Apr 10 18:44:16 2019 VERIFY X509NAME OK: certificate

Wed Apr 10 18:44:16 2019 VERIFY OK: depth=0, certificate

Wed Apr 10 18:44:17 2019 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key

Wed Apr 10 18:44:17 2019 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication

Wed Apr 10 18:44:17 2019 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key

Wed Apr 10 18:44:17 2019 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication

Wed Apr 10 18:44:17 2019 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA

Wed Apr 10 18:44:17 2019 [VPN] Peer Connection Initiated with x.x.x.x:443

ERROR: Received AUTH_FAILED control message

Wed Apr 10 18:44:19 2019 SENT CONTROL [VPN]: 'PUSH_REQUEST' (status=1)

Wed Apr 10 18:44:19 2019 AUTH: Received AUTH_FAILED control message

Wed Apr 10 18:44:19 2019 TCP/UDP: Closing socket

Wed Apr 10 18:44:19 2019 SIGTERM[soft,auth-failure] received, process exiting

 

Smoothwall:

18:58:45 SSL VPN TCP connection established with [AF_INET]x.x.x.x:60741

18:58:46 Authentication service Authentication failed (user unknown); username: ajtaylor

18:58:46 SSL VPN 2.127.65.34:60741 WARNING: Failed running command (--auth-user-pass-verify): external program exited with error status: 1

18:58:46 SSL VPN 2.127.65.34:60741 TLS Auth Error: Auth Username/Password verification failed for peer

18:58:46 SSL VPN 2.127.65.34:60741 Peer Connection Initiated with [AF_INET]x.x.x.x:60741

18:58:48 SSL VPN 2.127.65.34:60741 Connection reset, restarting [0]

 

Please help

[ibpalle]

Auth Username/Password verification failed for peer

 

Would seem to be the kicker here. Check that they entred username and password correctly. Does it work for other users?

[azureusnation]

yep, im putting in my info correctly.

 

I've tried sAM username, upn username, domain\username, username@domain. all the same outcome. logged a case today and just waiting for a response.

[ibpalle]

Can other users login and what's the result if you test a login on the ssl login page? (https://smoothwall.ip:442/login)

[azureusnation]

No other users can login and when I do the link you have suggested it works as expected. Also I think I should mention I have multi tenancy enabled for our 4 schools currently. Also the representative ive been talking to says that this is related to multi tenancy.

[dobsonl]

Hi Azureusnation, we had the same issue with smoothwall when we setup the multi tenancy settings... The VPN software on the boxes does not understand multi tenancy authentication sources out of the box, Smoothwall support had to apply a hotfix (PM me if you need the number and I can locate it!) to the box that we wanted SSL connectivity to.

[ibpalle]

The issue with Multi tenant and SSL is that requests are directed to auth via a domain based on the ip address ranges in the multi tenant config. Given that the SSL VPN connections can be coming in from any external IP address which will not, by default, be in the tenant ranges, auth fails.

 

If you only have a number of users coming in from known external IP addresses, then no hotfix should be needed. Just add the external IP to the tenant for that auth directory connection.

[azureusnation]

its a bit difficult when most people have dynamic ip addresses at home or they are on the move. I've spoken to the guys on the helpdesk and they have applied a hotfix that now works flawlessly. However I think ive now found a funny issue with the policy tester with a Perl error on line 251.

[ibpalle]

The policy tester sometimes have issues when used on a multi tenant systyem as well. I thinks it's down to location. Try selecting a location other than everywhere.

[Dianalv]

I also have the dynamic ip address at home and have faced some issues connected to VPN processing. Now I have not professional needs and I am using just free VeePN for my personal needs. Next week will move to the new office with my team and we will set up all the network.

[azureusnation]

I don't think I replied back regarding this but I have a solution and Smoothwall have now posted a KB on the issue so ill like that instead of trying o explain enjoy

 

https://kb.smoothwall.com/hc/en-us/articles/360004357100-Using-SSL-VPN-on-a-multitenant-Smoothwall