Open kosli opened 1 year ago
Thanks to the OpenWRT community I found the problem: if the management interface is not compiled (which is the default for the OpenWRT OpenVPN packages), then the client does not receive the auth failed feedback.
I have recompiled the same package with the --enable-management
enabled and the client receives the auth failed, even if the management interface in the OpenVPN server config is not configured.
This should be added into the reference manual as there is no hint that the management interface needs to be enabled for the auth-user-pass-verify
option to work properly.
I have the same problem in OpenWRT。But I don't know how to compile, so the problem wasn't solved.
Describe the bug I am using a OpenVPN 2.5.7 server (OpenWRT openvpn-openssl package) with an external
auth-user-pass-verify via-env
script. When the script returns a success of user/pass authentication, everything works as expected. If the script returns a exit code of 1, the server logs it correctly, but the clients do not get a feedback and are waiting forever for a response. OpenVPN 2.5.7 server log show the following:OpenVPN 2.6.5 client log shows the following:
To Reproduce Use the OpenVPN 2.5.7 server with a
`auth-user-pass-verify via-env
script that exits with 1 and see what a client with a auth-user-pass will do.Expected behavior If the auth script exists with an exit code 1 the client should get informed and do the appropriate action, like the default
auth-retry none
Version information (please complete the following information):
Additional context I haven't tested with another OpenVPN server version as the version is given by the OpenWRT release. I never had any issues with the auth-user-pass-verify on older OpenVPN server versions, so I am not sure if I missed any new configuration option (e.g. does the tls-crypt instead of tls-auth option would have any impact on that) or if it really is a problem with that specific OpenVPN version. I haven't found any references on regards of such an error on that version.