1

I tried several time to connect to my office through the vpn, but no success. I received from the company:

  1. the client.ovpn

    #OpenVPN Server conf
    tls-client
    client
    dev tun
    proto udp
    tun-mtu 1400
    remote server.net 1194
    pkcs12 client.p12
    cipher BF-CBC
    comp-lzo
    verb 3
    ns-cert-type server
    
  2. pcks 12 key. I used openssl to extract

  3. the ca certificate

  4. the user certificate
  5. the user key

the company run openvpn through IPcop

In ubuntu 16.04 I created file in my Home Directory named "Clesopenvpn" Connexion 100% fine and no interruption.

Actually I am using Ubuntu 18.04 I have installed openvpn and network manager gnome. I did the same steps but cannot connect to the VPN When I try to start the openvpn I receive this message: "Connection Failure Enabling network connection failed"

Kindly help me to resolve the problem.

This is the syslog errors

Jun  5 22:05:53 dusty-Lenovo-B50-30 systemd-resolved[819]: Grace period over, resuming full feature set (UDP+EDNS0) for DNS server 192.168.3.1.
Jun  5 22:10:06 dusty-Lenovo-B50-30 NetworkManager[1007]: <info>  [1528229406.2474] audit: op="connection-activate" uuid="e1671165-1347-48cc-ab1e-0f5dd841f1fb" name="MUSTAPHA-TO-IPCop" pid=2093 uid=1000 result="success"
Jun  5 22:10:06 dusty-Lenovo-B50-30 NetworkManager[1007]: <info>  [1528229406.2573] vpn-connection[0x55ca9c864560,e1671165-1347-48cc-ab1e-0f5dd841f1fb,"MUSTAPHA-TO-IPCop",0]: Started the VPN service, PID 4605
Jun  5 22:10:06 dusty-Lenovo-B50-30 NetworkManager[1007]: <info>  [1528229406.2597] vpn-connection[0x55ca9c864560,e1671165-1347-48cc-ab1e-0f5dd841f1fb,"MUSTAPHA-TO-IPCop",0]: Saw the service appear; activating connection
Jun  5 22:10:06 dusty-Lenovo-B50-30 nm-openvpn[4611]: WARNING: file '/home/dusty/Clesopenvpn/MUSTAPHA.key' is group or others accessible
Jun  5 22:10:06 dusty-Lenovo-B50-30 nm-openvpn[4611]: OpenVPN 2.4.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 10 2018
Jun  5 22:10:06 dusty-Lenovo-B50-30 nm-openvpn[4611]: library versions: OpenSSL 1.1.0g  2 Nov 2017, LZO 2.08
Jun  5 22:10:06 dusty-Lenovo-B50-30 nm-openvpn[4611]: WARNING: --ns-cert-type is DEPRECATED.  Use --remote-cert-tls instead.
Jun  5 22:10:06 dusty-Lenovo-B50-30 nm-openvpn[4611]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jun  5 22:10:06 dusty-Lenovo-B50-30 nm-openvpn[4611]: OpenSSL: error:140AB18E:SSL routines:SSL_CTX_use_certificate:ca md too weak
Jun  5 22:10:06 dusty-Lenovo-B50-30 nm-openvpn[4611]: Cannot load certificate file /home/dusty/Clesopenvpn/MUSTAPHA.crt
Jun  5 22:10:06 dusty-Lenovo-B50-30 nm-openvpn[4611]: Exiting due to fatal error
Jun  5 22:10:06 dusty-Lenovo-B50-30 NetworkManager[1007]: <info>  [1528229406.3673] vpn-connection[0x55ca9c864560,e1671165-1347-48cc-ab1e-0f5dd841f1fb,"MUSTAPHA-TO-IPCop",0]: VPN plugin: state changed: starting (3)
Jun  5 22:10:06 dusty-Lenovo-B50-30 NetworkManager[1007]: <info>  [1528229406.3675] vpn-connection[0x55ca9c864560,e1671165-1347-48cc-ab1e-0f5dd841f1fb,"MUSTAPHA-TO-IPCop",0]: VPN connection: (ConnectInteractive) reply received
Jun  5 22:10:06 dusty-Lenovo-B50-30 NetworkManager[1007]: <info>  [1528229406.3699] vpn-connection[0x55ca9c864560,e1671165-1347-48cc-ab1e-0f5dd841f1fb,"MUSTAPHA-TO-IPCop",0]: VPN service disappeared

this is the message from syslog

Jun  5 21:26:24 dusty-Lenovo-B50-30 NetworkManager[1007]: <info>   [1528226784.5443] vpn-connection[0x55ca9c864360,e1671165-1347-48cc-ab1e-0f5dd841f1fb,"MUSTAPHA-TO-IPCop",0]: VPN connection: (ConnectInteractive) reply received
Jun  5 21:26:24 dusty-Lenovo-B50-30 nm-openvpn[4222]: library versions: OpenSSL 1.1.0g  2 Nov 2017, LZO 2.08
Jun  5 21:26:24 dusty-Lenovo-B50-30 nm-openvpn[4222]: WARNING: --ns-cert-type is DEPRECATED.  Use --remote-cert-tls instead.
Jun  5 21:26:24 dusty-Lenovo-B50-30 nm-openvpn[4222]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jun  5 21:26:24 dusty-Lenovo-B50-30 nm-openvpn[4222]: OpenSSL: error:140AB18E:SSL routines:SSL_CTX_use_certificate:ca md too weak
Jun  5 21:26:24 dusty-Lenovo-B50-30 nm-openvpn[4222]: Cannot load certificate file /home/dusty/Clesopenvpn/MUSTAPHA.crt
Jun  5 21:26:24 dusty-Lenovo-B50-30 nm-openvpn[4222]: Exiting due to fatal error
Jun  5 21:26:24 dusty-Lenovo-B50-30 NetworkManager[1007]: <warn>  [1528226784.5458] vpn-connection[0x55ca9c864360,e1671165-1347-48cc-ab1e-0f5dd841f1fb,"MUSTAPHA-TO-IPCop",0]: VPN plugin: failed: connect-failed (1)
Jun  5 21:26:24 dusty-Lenovo-B50-30 NetworkManager[1007]: <warn>  [1528226784.5459] vpn-connection[0x55ca9c864360,e1671165-1347-48cc-ab1e-0f5dd841f1fb,"MUSTAPHA-TO-IPCop",0]: VPN plugin: failed: connect-failed (1)
Jun  5 21:26:24 dusty-Lenovo-B50-30 NetworkManager[1007]: <info>  [1528226784.5468] vpn-connection[0x55ca9c864360,e1671165-1347-48cc-ab1e-0f5dd841f1fb,"MUSTAPHA-TO-IPCop",0]: VPN service disappeared
  • What have you done to correct this error: Cannot load certificate file /home/dusty/Clesopenvpn/MUSTAPHA.crt From that other warning, it sounds like the permissions on these files are messed up. – Organic Marble Jun 6 '18 at 0:12
2

I setup my own OpenVPN on a remote server following the instructions from https://openvpn.net/index.php/open-source/documentation/howto.html and are able to connect my machine running Ubuntu 18.04 to the remote server.

The .ovpn configuration I build consist of the client configuration followed by the ca, cert, key and tls-auth sections. VPN setting allows me to import the file and everthing is setup automatically.

Can you check your client.ovpn to see which sections are there? If it only has the configuration I suggest you add the following at the end of the file an try importing the entire file in the VPN setting.

(client.ovpn settings)
<ca>
(ca file content)
</ca>
<cert>
(certificate file content)
</cert>
<key>
(key file content)
</key>

call this combine.ovpn or something and try importing it to the VPN setting.

(edited) Also make sure you have openvpn package installed.

dpkg -l |grep openvpn
ii  network-manager-openvpn                    1.8.2-1                                     amd64        network management framework (OpenVPN plugin core)
ii  network-manager-openvpn-gnome              1.8.2-1                                     amd64        network management framework (OpenVPN plugin GNOME GUI)
ii  openvpn                                    2.4.4-2ubuntu1                              amd64        virtual private network daemon

Since the log shows that certificate is using old md5 and openssl is refusing to use it, This thread provide a way to by pass that, https://forums.openvpn.net/viewtopic.php?t=23979, the solution discussed that work for you is from mavron. And I quote his word here:

  • Find your Network Manager vpn configuration file (mine is in /etc/NetworkManager/system-connections; if you have a lot of them and filenames do not help much in finding the right one, use grep -i "id=yourmnemonicname" *)
  • Under the [vpn] section add the line: tls-cipher=DEFAULT:@SECLEVEL=0
  • Reload the configuration with the command: nmcli connection reload

I have not try this myself, but it suppose to disable openssl check for outdated hash use in certificate allowing the old certificate to be used.

  • Many thanks for your reply! The problem is not in importing the files. I did the modification on the .ovpn but got the same message "Connection Failure Enabling network connection failed" seems I cannot run at all openvpn on Ubuntu 18 – Rustyzone Jun 5 '18 at 18:48
  • I assume you have openvpn network manager support packages installed, can you post some error messages from the connection attempt? do a "tail -f /var/log/syslog", try enabling the vpn from the UI and see post the logs. – Bernard Wei Jun 5 '18 at 18:56
  • after doing [dpkg -l |grep openvpn] ireceived [ii network-manager-openvpn 1.8.2-1 amd64 network management framework (OpenVPN plugin core) ii network-manager-openvpn-gnome 1.8.2-1 amd64 network management framework (OpenVPN plugin GNOME GUI) ii openvpn 2.4.4-2ubuntu1 amd64 virtual private network daemon] – Rustyzone Jun 5 '18 at 18:59
  • Looks like you have the required packages. Can you post the errors report in /var/log/syslog when you attempt to enable vpn connection? That would tell us more about the problem, you can append the logs to your original question. – Bernard Wei Jun 5 '18 at 19:12
  • please check the syslog message in the answer – Rustyzone Jun 5 '18 at 19:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.