Open xvybihal opened 2 years ago
Have you tried with an empty password -p ""
?
Have you tried with an empty password
-p ""
?
Yeah, tried now. Also tried without user at all. But the result is exactly same.
I haven't written that code and don't have such a setup to test, but I seem to recall it had worked in the past. If you have time, I would recommend building and testing 1.16.0 and 1.15.0, just in case.
It's hard to understand what's wrong from the log:
ERROR: Could not authenticate to gateway. Please check the password, client certificate, etc.
DEBUG: No cookie given (-7)
You could also give openconnect a try. Fortinet support is still recent so you'll have to build from sources.
I just tried 1.15.0 (33789115c88a448b4194d76c955d145ca35330b7) and 1.16.0 (cde9d69dd44f83f00de38fe5bdb163fb3ee07913), the behavior is the same.
An observation - I have also tried linux version of FortiClient (7.0.0.0018) and it is also not able to connect (correct .pfx was provided, and properly loaded according to debug log) - ends with basically same thing [sslvpn:EROR] vpn_connection:1219 Error code [3]. Login failed: Insufficient credential(s). Please check the password, client certificate, etc.
I have build openconnect with openssl, and it works fine with the exact same certs and gateway:
$ sudo openconnect --protocol=fortinet -u User --certificate=/tmp/ssl-vpn/cert.pem --sslkey=/tmp/ssl-vpn/key.pem --server vpn.ACME.com
[sudo] password for jv:
GET https://vpn.ACME.com/
Connected to 1.2.3.4:443
Using client certificate '/CN=User'
SSL negotiation with vpn.ACME.com
Connected to HTTPS on vpn.ACME.com with ciphersuite TLSv1.3-TLS_AES_256_GCM_SHA384
Password:
POST https://vpn.ACME.com/remote/logincheck
GET https://vpn.ACME.com/remote/fortisslvpn_xml
DTLS is enabled on port 443
Reported platform is FG240D v6.00.10 build 0365 branch 0365
Got search domain ACME.com
Got IPv4 DNS server READCTED
Got IPv4 DNS server READCTED
Got Legacy IP address READCTED
Got IPv4 route READCTED
Got IPv4 route READCTED
Got IPv4 route READCTED
Got IPv4 route READCTED
Got IPv4 route READCTED
Got IPv4 route READCTED
Got IPv4 route READCTED
Got IPv4 route READCTED
Got IPv4 route READCTED
Got IPv4 route READCTED
Got IPv4 route READCTED
Got IPv4 route READCTED
Got IPv4 route READCTED
Got IPv4 route READCTED
Idle timeout is 960 minutes.
EPOLL_CTL_DEL: No such file or directory
Established DTLS connection (using OpenSSL). Ciphersuite DTLSv1.2-ECDHE-RSA-AES256-GCM-SHA384.
Requesting calculated MTU of 1351
Configured as 172.22.0.8, with SSL disconnected and DTLS established
Session authentication will expire at Wed Oct 6 15:32:25 2021
I remember we had this question a while ago https://github.com/adrienverge/openfortivpn/issues/602#issuecomment-604508959 and it should work with -u "" -p "" --user-cert=...cert.pem --user-key=...key.pem
I have just built 1.17.1 and verified that login with username+password+certificate works, but I don't have a device which allows to login with a certificate only.
I have just built 1.17.1 and verified that login with username+password+certificate works, but I don't have a device which allows to login with a certificate only.
In no way I want to dispute this, but unfortunately I can't get it to work for me. I have tested 3 different boxes (CentOS and 2x archlinux). I went with lower version, as low as 1.12.0 and the result is always the same. My goal is also to use username+password+certificate. As workaround I have to stick with openconnect, which works. It also works in combination with networkmanager-openconnect.
I can echo what xvybihal is stating. We also cannot connect with cert auth to a Fortigate running FortiOS v7.0.1 build0157 (GA) using openfortivpn from Ubuntu 20.04 focal with an SSL VPN portal that requires a client certificate. If we turn off the certificate requirement on the Fortigate openfortivpn works fine.
We have no issues if we use the same client certificate but with openconnect instead of openfortivpn and re-enable client certificate authentication in the Fortigate.
@toy4two So if I understand you correctly, you too have tested openfortivpn -u "" -p "" --user-cert=...cert.pem --user-key=...key.pem
and it doesn't work. Also, I see it fails with both FortiOS v6.00.10 build 0365
and FortiOS v7.0.1 build 0157
.
Is perhaps a password required to use the user certificate? A password associated to the certificate itself?
It looks like the VPN gateway refuses the authentication, probably because openfortivpn does not send the proper sequence of HTTP requests. There's not much I can do without access to a device that fails. What I can do, and have done, is printing the HTTP requests, like openconnect does. It would be great f you could build and run the latest version from @master
so that we can compare the HTTP requests.
Is perhaps a password required to use the user certificate? A password associated to the certificate itself?
Not in my case. I have tested it. If password is required, I am correctly asked to provide additional password for the certificate key.
It looks like the VPN gateway refuses the authentication, probably because openfortivpn does not send the proper sequence of HTTP requests. There's not much I can do without access to a device that fails. What I can do, and have done, is printing the HTTP requests, like openconnect does. It would be great f you could build and run the latest version from
@master
so that we can compare the HTTP requests.
Attached logs. Hope they can help.
openconnect-dump-http.log openfortivpn-v1.17.1+git2.g1f692aa.log
i see openfortivpn
outputs only:
POST /remote/logincheck
while openconnect
outputs:
GET /vpn-acme
GET /remote/login?realm=vpn-acme
POST /remote/logincheck
GET /remote/fortisslvpn_xml
it does look like something goes wrong with POST /remote/logincheck
. Perhaps the missing GET
? I'll have a look at the HTTP logs.
@toy4two So if I understand you correctly, you too have tested
openfortivpn -u "" -p "" --user-cert=...cert.pem --user-key=...key.pem
and it doesn't work. Also, I see it fails with both FortiOSv6.00.10 build 0365
and FortiOSv7.0.1 build 0157
.Is perhaps a password required to use the user certificate? A password associated to the certificate itself?
It looks like the VPN gateway refuses the authentication, probably because openfortivpn does not send the proper sequence of HTTP requests. There's not much I can do without access to a device that fails. What I can do, and have done, is printing the HTTP requests, like openconnect does. It would be great f you could build and run the latest version from
@master
so that we can compare the HTTP requests.
@DimitriPapadopoulos I retested and believe I found the difference between openfortivpn and openconnect with client certs. I took the client cert which had the cert and private key in a single file and broke them into separate cert and key files. I re-ran using openfortivpn <hostname> -u "" -p "" --user-cert=...cert.pem --user-key=...key.pem
and I am connected.
Openconnect is more flexible in this regard.
@toy4two Indeed openfortivpn requires two distinct files as arguments to --user-cert
and --user-key
. Thank you for coming back to us with an explanation. I don't even know if it's feasible to pass the same file with both the cert and key twice - probably not. Perhaps I should add an example in README.md
.
Unfortunately that doesn't explain why it doesn't work for @xvybihal who does use --user-cert=/tmp/ssl-vpn/cert.pem --user-key=/tmp/ssl-vpn/key.pem
.
Perhaps it would help if you could both provide the version of FortiOS on both VPN gateways. For @xvybihal the information can be found in the openconnect log file, it's an FG240D
gateway running FortiOS 6.0.10
.
Unfortunately that doesn't explain why it doesn't work for @xvybihal who does use
--user-cert=/tmp/ssl-vpn/cert.pem --user-key=/tmp/ssl-vpn/key.pem
.
Yeah, I have key and public cert separated from the beginning :/
Perhaps it would help if you could both provide the version of FortiOS on both VPN gateways. For @xvybihal the information can be found in the openconnect log file, it's an
FG240D
gateway running FortiOS6.0.10
.
He mentioned FortiOS v7.0.1 build0157 (GA). Unfortunately, I was informed we can't go to version 7+ on our box.
I did not want to hijack #937, so I created this new issue. Is it possible, that the certificate auth is broken? I am not able to get it working in 1.17.1 (archilnux) or 1.17.0 (centos 8).
From what we have gathered, the openfortivpn client does never send the certificate to gateway. (assumed this from logs)
The cert and key are valid and in pem format (I also use them for 802.1x and login with them works in browser). Also the cert is working with Windows and official Forticlient.
Is my assumtion correct and there could be defect with this functionality of the openfortivpn client?