I've setup 2 servers with fwknop. They are both running the same OS and are configured in much the same way.
Despite this, one of them I cannot connect to, and I get this error in the log each time I try to connect:
Jan 30 15:11:04 sam-backups fwknopd[26565]: (stanza #1) SPA Packet from IP: xxxx received with access source match
Jan 30 15:11:04 sam-backups fwknopd[26565]: [xxxx] (stanza #1) Error creating fko context (before decryption): Args contain invalid data: FKO_ERROR_INVALID_DATA_HMAC_COMPAREFAIL
The error suggests there is something wrong with the HMAC, but I have checked the HMAC configuration several times and tried generating a new HMAC, but I still get this error every time.
Server config looks like:
SOURCE ANY
FW_ACCESS_TIMEOUT 3
GPG_REQUIRE_SIG Y
GPG_DECRYPT_ID [xxx]
GPG_ALLOW_NO_PW Y
GPG_IGNORE_SIG_VERIFY_ERROR N
GPG_FINGERPRINT_ID [xxx]
HMAC_DIGEST_TYPE sha3_256
HMAC_KEY_BASE64 [xxx]
MAX_FW_TIMEOUT 60
OPEN_PORTS tcp/22
REQUIRE_SOURCE_ADDRESS Y
Client config looks like:
[default]
ACCESS tcp/22
DIGEST_TYPE sha3_512
FW_TIMEOUT 3
GPG_SIGNER [xxx]
HMAC_DIGEST_TYPE sha3_256
RAND_PORT Y
USE_GPG Y
USE_GPG_AGENT Y
USE_HMAC Y
[backup]
GPG_RECIPIENT [xxx]
HMAC_KEY_BASE64 [xxx]
[sambull.org]
GPG_RECIPIENT [xxx]
HMAC_KEY_BASE64 [xxx]
The HMAC was created with fwknopd --key-gen --hmac-key-len=128 and copied to the client config as well.
I've setup 2 servers with fwknop. They are both running the same OS and are configured in much the same way.
Despite this, one of them I cannot connect to, and I get this error in the log each time I try to connect:
The error suggests there is something wrong with the HMAC, but I have checked the HMAC configuration several times and tried generating a new HMAC, but I still get this error every time.
Server config looks like:
Client config looks like:
The HMAC was created with
fwknopd --key-gen --hmac-key-len=128
and copied to the client config as well.