VPN authentication failing

Luke_Ager 2017-02-17 11:10:58 UTC #1

Just tried to connect using the same VPN profile I had in version 1. The connection will not complete. I suspect either the VPN server is down or do we need new config to access the new version 2?

The New V2 CTF365 Is Here!

CTF servers down

Luke_Ager 2017-02-17 11:22:57 UTC #2

state changed: stopped (6)
Feb 17 11:16:39 XXX NetworkManager[433]: [1487330199.2223] vpn-connection[0x561a35da36e0,677b1e5f-96b3-480f-86c8-7f18881df05d,"config",0]: Started the VPN service, PID 2072
Feb 17 11:16:39 XXX NetworkManager[433]: [1487330199.2337] vpn-connection[0x561a35da36e0,677b1e5f-96b3-480f-86c8-7f18881df05d,"config",0]: Saw the service appear; activating connection
Feb 17 11:16:39 XXX NetworkManager[433]: [1487330199.4436] vpn-connection[0x561a35da36e0,677b1e5f-96b3-480f-86c8-7f18881df05d,"config",0]: VPN plugin: state changed: starting (3)
Feb 17 11:16:39 XXX NetworkManager[433]: [1487330199.4439] vpn-connection[0x561a35da36e0,677b1e5f-96b3-480f-86c8-7f18881df05d,"config",0]: VPN connection: (ConnectInteractive) reply received
Feb 17 11:16:39 XXX nm-openvpn2080: OpenVPN 2.4.0 [git:master/f5bf296bacce76a8+] x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Dec 29 2016
Feb 17 11:16:39 XXX nm-openvpn2080: library versions: OpenSSL 1.0.2j 26 Sep 2016, LZO 2.08
Feb 17 11:16:39 XXX nm-openvpn2080: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Feb 17 11:16:39 XXX nm-openvpn Preserving recently used remote address: [AF_INET]137.74.230.102:1194
Feb 17 11:16:39 XXX nm-openvpn2080: UDP link local: (not bound)
Feb 17 11:16:39 XXX nm-openvpn2080: UDP link remote: [AF_INET]137.74.230.102:1194
Feb 17 11:16:39 XXX nm-openvpn2080: NOTE: chroot will be delayed because of --client, --pull, or --up-delay
Feb 17 11:16:39 XXX nm-openvpn2080: NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Feb 17 11:16:39 XXX nm-openvpn2080: [server] Peer Connection Initiated with [AF_INET]137.74.230.102:1194
Feb 17 11:17:40 XXX NetworkManager[433]: [1487330260.0689] vpn-connection[0x561a35da36e0,677b1e5f-96b3-480f-86c8-7f18881df05d,"config",0]: VPN connection: connect timeout exceeded.
Feb 17 11:17:40 XXX nm-openvpn-serv[2072]: Connect timer expired, disconnecting.
Feb 17 11:17:40 XXX nm-openvpn2080: SIGTERM[hard,] received, process exiting
Feb 17 11:17:40 XXX [2072]: ((nm-vpn-service-plugin.c:199)): assertion '' failed
Feb 17 11:17:40 XXX NetworkManager[433]: [1487330260.0797] vpn-connection[0x561a35da36e0,677b1e5f-96b3-480f-86c8-7f18881df05d,"config",0]: VPN plugin: failed: connect-failed (1)
Feb 17 11:17:40 XXX NetworkManager[433]: [1487330260.0800] vpn-connection[0x561a35da36e0,677b1e5f-96b3-480f-86c8-7f18881df05d,"config",0]: VPN plugin: state changed: stopping (5)
Feb 17 11:17:40 XXX NetworkManager[433]: [1487330260.0802] vpn-connection[0x561a35da36e0,677b1e5f-96b3-480f-86c8-7f18881df05d,"config",0]: VPN plugin: state changed: stopped (6)
Feb 17 11:17:40 XXX NetworkManager[433]: [1487330260.0842] vpn-connection[0x561a35da36e0,677b1e5f-96b3-480f-86c8-7f18881df05d,"config",0]: VPN service disappeared

_g_s 2017-02-17 18:07:55 UTC #3

Hej Luke,

Can you try this configuration file and let us know if it works?

Best Regards,
Ahmed.

Ignis 2017-02-17 18:30:05 UTC #4

Similar challenge as well. Albeit different openvpn server response - Auth failed. Just created the user 20 minutes ago.

openvpn --config ./ctf365-2.0.ovpn
Fri Feb 17 13:28:20 2017 OpenVPN 2.4.0 [git:master/f5bf296bacce76a8+] x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Dec 29 2016
Fri Feb 17 13:28:20 2017 library versions: OpenSSL 1.0.2k 26 Jan 2017, LZO 2.08
Fri Feb 17 13:28:20 2017 TCP/UDP: Preserving recently used remote address: [AF_INET]137.74.230.102:1194
Fri Feb 17 13:28:20 2017 UDP link local: (not bound)
Fri Feb 17 13:28:20 2017 UDP link remote: [AF_INET]137.74.230.102:1194
Fri Feb 17 13:28:20 2017 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Fri Feb 17 13:28:22 2017 [server] Peer Connection Initiated with [AF_INET]137.74.230.102:1194
Fri Feb 17 13:28:23 2017 AUTH: Received control message: AUTH_FAILED
Fri Feb 17 13:28:23 2017 SIGTERM[soft,auth-failure] received, process exiting

_g_s 2017-02-17 18:45:27 UTC #5

Hi Ignis,

Did you try the VPN configuration file I linked to in my previous reply?

Best Regards,
Ahmed.

Ignis 2017-02-17 18:57:59 UTC #6

Both. First with the "download config..." option. Then later with your config linked above in the reply. Neither works. Hence replying to this thread instead of creating a new one. I would assume my new v2 user is not propagating to the backend authentication scheme?

_g_s 2017-02-17 19:29:25 UTC #7

Thanks for the update, I will check and reply to you shortly. Sorry for any inconvenience this might have cause.

Best Regards,
Ahmed.

orfeus 2017-02-17 19:31:21 UTC #8

Hi I am also unable to connect with openvpn from Kali. I downloaded the connection files but get the error "No reply from server"

ShutDown 2017-02-17 20:23:05 UTC #9

I have this error:

Fri Feb 17 21:17:56 2017 AUTH: Received control message: AUTH_FAILED
Fri Feb 17 21:17:56 2017 SIGTERM[soft,auth-failure] received, process exiting

jweather42 2017-02-17 20:23:45 UTC #10

Windows with OpenVPN: Fri Feb 17 20:22:14 2017 AUTH: Received control message: AUTH_FAILED

awer 2017-02-17 22:15:49 UTC #11

I am also having issues. I do however look to be connected. Except I dont get any connection to http://10.194.0.11/

Fri Feb 17 22:10:33 2017 [server] Peer Connection Initiated with [AF_INET]137.74.230.102:1194
Fri Feb 17 22:10:38 2017 TUN/TAP device tun0 opened
Fri Feb 17 22:10:38 2017 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Feb 17 22:10:38 2017 /sbin/ip link set dev tun0 up mtu 1500
Fri Feb 17 22:10:38 2017 /sbin/ip addr add dev tun0 172.16.192.139/18 broadcast 172.16.255.255
Fri Feb 17 22:10:38 2017 Initialization Sequence Completed

Route -n
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.0.1 0.0.0.0 UG 1024 0 0 wlan0
10.192.0.0 172.16.192.1 255.192.0.0 UG 0 0 0 tun0
169.254.0.0 0.0.0.0 255.255.0.0 U 1000 0 0 wlan0
172.16.192.0 0.0.0.0 255.255.192.0 U 0 0 0 tun0

andrici_cezar 2017-02-17 22:20:39 UTC #12

Hello, we had some problems with the VPN. Sorry for that. Try again and tell us if it worked.

horac 2017-02-17 22:29:03 UTC #13

Hi I have still similar problems

Feb 17 23:28:45 xoth nm-openvpn[21674]: UDPv4 link local: [undef]
Feb 17 23:28:45 xoth nm-openvpn[21674]: UDPv4 link remote: [AF_INET]137.74.230.102:1194
Feb 17 23:28:46 xoth nm-openvpn[21674]: [server] Peer Connection Initiated with [AF_INET]137.74.230.102:1194
Feb 17 23:28:49 xoth nm-openvpn[21674]: AUTH: Received control message: AUTH_FAILED
Feb 17 23:28:49 xoth nm-openvpn[21674]: SIGUSR1[soft,auth-failure] received, process restarting
Feb 17 23:28:49 xoth NetworkManager[14824]: (nm-openvpn-service:21667): nm-openvpn-WARNING **: Password verification failed

awer 2017-02-17 22:50:56 UTC #14

Unfortunately not. I have also tried with the config file mentioned earlier from here : https://www.dropbox.com/s/sd9pedfcdabya7p/ctf365-2.0.ovpn?dl=0

Can you confirm if the dns entry in /etc/resolv.conf should be different?

currently set by Network manager dynamically to 8.8.8.8

when opening the openvpn i get the following...

awer@logikz:/etc/openvpn sudo openvpn config.conf 1 ↵
Fri Feb 17 22:42:09 2017 OpenVPN 2.3.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Nov 12 2015
Fri Feb 17 22:42:09 2017 library versions: OpenSSL 1.0.2k 26 Jan 2017, LZO 2.08
Fri Feb 17 22:42:09 2017 WARNING: file 'user-pass.txt' is group or others accessible
Fri Feb 17 22:42:09 2017 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Fri Feb 17 22:42:09 2017 Control Channel Authentication: tls-auth using INLINE static key file
Fri Feb 17 22:42:09 2017 UDPv4 link local: [undef]
Fri Feb 17 22:42:09 2017 UDPv4 link remote: [AF_INET]137.74.230.102:1194
Fri Feb 17 22:42:09 2017 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Fri Feb 17 22:42:10 2017 [server] Peer Connection Initiated with [AF_INET]137.74.230.102:1194
Fri Feb 17 22:42:14 2017 TUN/TAP device tun0 opened
Fri Feb 17 22:42:14 2017 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Feb 17 22:42:14 2017 /sbin/ip link set dev tun0 up mtu 1500
Fri Feb 17 22:42:14 2017 /sbin/ip addr add dev tun0 172.16.192.139/18 broadcast 172.16.255.255
Fri Feb 17 22:42:14 2017 update-resolv-conf.bash tun0 1500 1542 172.16.192.139 255.255.192.0 init
Fri Feb 17 22:42:14 2017 Initialization Sequence Completed

Any suggestions?

K3r0sen 2017-02-17 22:54:35 UTC #15

Try do disconnect/stop VPN services and restart.

awer 2017-02-17 22:56:24 UTC #16

Just done that now.

Please confirm the DNS setup...

Fri Feb 17 22:53:08 2017 OpenVPN 2.3.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Nov 12 2015
Fri Feb 17 22:53:08 2017 library versions: OpenSSL 1.0.2k 26 Jan 2017, LZO 2.08
Fri Feb 17 22:53:08 2017 WARNING: file 'user-pass.txt' is group or others accessible
Fri Feb 17 22:53:08 2017 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Fri Feb 17 22:53:08 2017 Control Channel Authentication: tls-auth using INLINE static key file
Fri Feb 17 22:53:08 2017 UDPv4 link local: [undef]
Fri Feb 17 22:53:08 2017 UDPv4 link remote: [AF_INET]137.74.230.102:1194
Fri Feb 17 22:53:08 2017 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Fri Feb 17 22:53:08 2017 [server] Peer Connection Initiated with [AF_INET]137.74.230.102:1194
Fri Feb 17 22:53:12 2017 TUN/TAP device tun0 opened
Fri Feb 17 22:53:12 2017 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Feb 17 22:53:12 2017 /sbin/ip link set dev tun0 up mtu 1500
Fri Feb 17 22:53:12 2017 /sbin/ip addr add dev tun0 172.16.192.139/18 broadcast 172.16.255.255
Fri Feb 17 22:53:12 2017 update-resolv-conf.bash tun0 1500 1542 172.16.192.139 255.255.192.0 init
Fri Feb 17 22:53:12 2017 Initialization Sequence Completed

Is there another address in this cloud i check for testing? ie try to ping?

K3r0sen 2017-02-17 23:26:50 UTC #17

You can ping 10.194.0.0/24 IP range. Or 10.194.0.28, 10.194.0.16,3,,23,44, and so on.

Luke_Ager 2017-02-17 23:42:45 UTC #18

I'll try mine again tomorrow. I'm glad it wasn't just me.

awer 2017-02-18 00:25:35 UTC #19

I can only get a ping response from 10.194.0.1 out of all 254 IP address's
Can you please confirm the DNS settings

awer@logikz:~ nmap -sP 10.194.0.0/24 130 ↵

Starting Nmap 6.47SVN ( http://nmap.org ) at 2017-02-18 00:20 GMT
Nmap scan report for 10.194.0.1
Host is up (0.030s latency).
Nmap done: 256 IP addresses (1 host up) scanned in 3.30 seconds

awer@logikz:~ ping 10.194.0.1
PING 10.194.0.1 (10.194.0.1) 56(84) bytes of data.
64 bytes from 10.194.0.1: icmp_seq=1 ttl=63 time=45.3 ms
64 bytes from 10.194.0.1: icmp_seq=2 ttl=63 time=27.5 ms
64 bytes from 10.194.0.1: icmp_seq=3 ttl=63 time=27.0 ms

awer@logikz:~ cat /etc/resolv.conf 1 ↵

Generated by NetworkManager

nameserver 8.8.8.8

awer@logikz:~ route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.0.1 0.0.0.0 UG 1024 0 0 wlan0
10.192.0.0 172.16.192.1 255.192.0.0 UG 0 0 0 tun0
169.254.0.0 0.0.0.0 255.255.0.0 U 1000 0 0 wlan0
172.16.192.0 0.0.0.0 255.255.192.0 U 0 0 0 tun0
192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 wlan0

Devil_s_Grin 2017-02-18 07:08:21 UTC #20

I am facing this issue too AUTH: Received control message: AUTH_FAILED.
No idea how to correct this.