Infrastructure » sepia

Username:
xiaoxichen

SSH key:
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDO00mus2XPX/EfUZ/YsKI84TnWj5TbZP7Fs01EkoOTPgNoYysVdf0PwhAooz1qPrv+HUsUMpQT6uNYfCHyqx9rScR+XUlyQuFe7Sjp/dn3y+b1PKa6G4HX7f1eejR3ZaLZXA4R/8oucAXqQS5pDr3Y7prwkrp9cyk8uawBXoDcAlA1SMIPZPrtO1+iZw20NDhixsG7NE5jMFfw3q8xTckZEqBbteybci7X1v4lEYXCVlbSbUhyZ2Af8HEj09JBDOL2bI3yLvj9a5Oj/HtKubyApzZpA7rgeoii2UZQGuSRI1VJktp9YC0zGk5S843xYW92utbALKyQ6DdB2F5gc0DX xiaoxchen@LM-SHC-16501223

Hashed pass:

xiaoxichen@ebay RvJJ7BhIehpoPtggrwnskQ 862ecfe7e15dfab86d61df86856bfe06cbb99f240f6f03851f7f9e1a255327d6

Hi David,

I cannot connect the OpenVPN due to auth error,

2016-02-27 22:25:02 VERIFY EKU OK
2016-02-27 22:25:02 VERIFY OK: depth=0, O=Redhat, CN=openvpn-sepia
2016-02-27 22:25:05 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
2016-02-27 22:25:05 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2016-02-27 22:25:05 NOTE: --mute triggered...
2016-02-27 22:25:05 3 variation(s) on previous 10 message(s) suppressed by --mute
2016-02-27 22:25:05 [openvpn-sepia] Peer Connection Initiated with [AF_INET]8.43.84.129:1194
2016-02-27 22:25:08 AUTH: Received control message: AUTH_FAILED
2016-02-27 22:25:08 SIGTERM[soft,auth-failure] received, process exiting
2016-02-27 22:25:08 *Tunnelblick: Disconnecting; user cancelled authorization or there was an error obtaining authorization
2016-02-27 22:25:08 *Tunnelblick: Disconnecting using 'kill'
2016-02-27 22:25:10 *Tunnelblick: No 'post-disconnect.sh' script to execute
2016-02-27 22:25:10 *Tunnelblick: Expected disconnection occurred.

Can you enable more verbose output and provide the IP you're attempting to connect from please? I don't even see your username attempting to auth on the server.

*Tunnelblick: OS X 10.11.3; Tunnelblick 3.5.7 (build 4270.4517); Admin user

Configuration client

"Sanitized" condensed configuration file for /Users/xiaoxchen/Library/Application Support/Tunnelblick/Configurations/client.tblk:

script-security 1
client
remote vpn.sepia.ceph.com 1194
dev tun
remote-random
resolv-retry infinite
nobind
user nobody
group nogroup
persist-tun
persist-key
comp-lzo
verb 2
mute 10
remote-cert-tls server
tls-auth tlsauth.key 1
ca ca.crt
auth-user-pass

================================================================================

"Sanitized" full configuration file

script-security 1
client
remote vpn.sepia.ceph.com 1194
dev tun
remote-random
resolv-retry infinite
nobind
user nobody
group nogroup
persist-tun
persist-key
comp-lzo
verb 2
mute 10
remote-cert-tls server
tls-auth tlsauth.key 1
ca ca.crt
#auth-user-pass secret
auth-user-pass

================================================================================

There are no unusual files in client.tblk

================================================================================

Configuration preferences:

-useDownRootPlugin = 1
-keychainHasUsernameAndPassword = 1
-notOKToCheckThatIPAddressDidNotChangeAfterConnection = 1
-lastConnectionSucceeded = 0

================================================================================

Wildcard preferences:

-notOKToCheckThatIPAddressDidNotChangeAfterConnection = 1

================================================================================

Program preferences:

launchAtNextLogin = 1
notOKToCheckThatIPAddressDidNotChangeAfterConnection = 1
askedUserIfOKToCheckThatIPAddressDidNotChangeAfterConnection = 1
tunnelblickVersionHistory = (
"3.5.7 (build 4270.4517)"
)
lastLaunchTime = 479359657.472094
connectionWindowDisplayCriteria = showWhenConnecting
maxLogDisplaySize = 102400
keyboardShortcutIndex = 1
updateCheckAutomatically = 0
updateSendProfileInfo = 0
NSWindow Frame ConnectingWindow = 645 648 389 187 0 0 1680 1027
detailsWindowFrameVersion = 4270.4517
detailsWindowFrame = {{382, 437}, {912, 468}}
detailsWindowLeftFrame = {{0, 0}, {163.5, 350}}
leftNavSelectedDisplayName = client
haveDealtWithSparkle1dot5b6 = 1
haveDealtWithOldTunTapPreferences = 1
haveDealtWithOldLoginItem = 1
SUEnableAutomaticChecks = 0
SUFeedURL = https://www.tunnelblick.net/appcast-s.rss
SUScheduledCheckInterval = 86400
SUSendProfileInfo = 0
SULastCheckTime = 2016-02-25 05:18:21 +0000
SUHasLaunchedBefore = 1
WebKitDefaultFontSize = 16
WebKitStandardFont = Times

================================================================================

Tunnelblick Log:

2016-03-11 11:28:48 *Tunnelblick: OS X 10.11.3; Tunnelblick 3.5.7 (build 4270.4517)
2016-03-11 11:28:49 *Tunnelblick: Attempting connection with client using shadow copy; Set nameserver = 3; monitoring connection
2016-03-11 11:28:49 *Tunnelblick: openvpnstart start client.tblk 1337 3 0 1 0 16688 -ptADGNWradsgnw 2.3.6
2016-03-11 11:28:51 *Tunnelblick: openvpnstart log:
Warning: Tunnelblick is using 'openvpn-down-root.so', so the route-pre-down script will not be used. You can override this by providing a custom route-pre-down script (which may be a copy of Tunnelblick's standard route-pre-down script) in a Tunnelblick VPN Configuration. However, that script will not be executed as root unless the 'user' and 'group' options are removed from the OpenVPN configuration file. If the 'user' and 'group' options are removed, then you don't need to use a custom route-pre-down script.OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line):

/Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.3.6/openvpn
          --daemon
          --log
          /Library/Application Support/Tunnelblick/Logs/-SUsers-Sxiaoxchen-SLibrary-SApplication Support-STunnelblick-SConfigurations-Sclient.tblk-SContents-SResources-Sconfig.ovpn.3_0_1_0_16688.1337.openvpn.log
          --cd
          /Library/Application Support/Tunnelblick/Users/xiaoxchen/client.tblk/Contents/Resources
          --config
          /Library/Application Support/Tunnelblick/Users/xiaoxchen/client.tblk/Contents/Resources/config.ovpn
          --cd
          /Library/Application Support/Tunnelblick/Users/xiaoxchen/client.tblk/Contents/Resources
          --management
          127.0.0.1
          1337
          --management-query-passwords
          --management-hold
          --script-security
          2
          --up
          /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -d -f -m -w -ptADGNWradsgnw
          --plugin
          /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.3.6/openvpn-down-root.so
          /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -d -f -m -w -ptADGNWradsgnw

2016-03-11 11:28:49 *Tunnelblick: openvpnstart starting OpenVPN
2016-03-11 11:28:50 OpenVPN 2.3.6 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [PKCS11] [MH] [IPv6] built on Feb 18 2016
2016-03-11 11:28:50 library versions: OpenSSL 1.0.1r 28 Jan 2016, LZO 2.08
2016-03-11 11:28:51 *Tunnelblick: Established communication with OpenVPN
2016-03-11 11:28:51 *Tunnelblick: Obtained VPN username and password from the Keychain
2016-03-11 11:28:51 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2016-03-11 11:28:51 Control Channel Authentication: using 'tlsauth.key' as a OpenVPN static key file
2016-03-11 11:28:51 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2016-03-11 11:28:51 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2016-03-11 11:28:52 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
2016-03-11 11:28:52 UDPv4 link local: [undef]
2016-03-11 11:28:52 UDPv4 link remote: [AF_INET]8.43.84.129:1194
2016-03-11 11:28:52 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2016-03-11 11:28:54 VERIFY OK: depth=1, O=Redhat, CN=openvpnca-sepia
2016-03-11 11:28:54 Validating certificate key usage
2016-03-11 11:28:54 + Certificate has key usage 00a0, expects 00a0
2016-03-11 11:28:54 VERIFY KU OK
2016-03-11 11:28:54 Validating certificate extended key usage
2016-03-11 11:28:54 + Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2016-03-11 11:28:54 VERIFY EKU OK
2016-03-11 11:28:54 VERIFY OK: depth=0, O=Redhat, CN=openvpn-sepia
2016-03-11 11:28:59 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
2016-03-11 11:28:59 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2016-03-11 11:28:59 NOTE: --mute triggered...
2016-03-11 11:28:59 3 variation(s) on previous 10 message(s) suppressed by --mute
2016-03-11 11:28:59 [openvpn-sepia] Peer Connection Initiated with [AF_INET]8.43.84.129:1194
2016-03-11 11:29:02 AUTH: Received control message: AUTH_FAILED
2016-03-11 11:29:02 SIGTERM[soft,auth-failure] received, process exiting
2016-03-11 11:29:13 *Tunnelblick: Disconnecting; user cancelled authorization or there was an error obtaining authorization
2016-03-11 11:29:13 *Tunnelblick: Disconnecting using 'kill'
2016-03-11 11:29:15 *Tunnelblick: No 'post-disconnect.sh' script to execute
2016-03-11 11:29:15 *Tunnelblick: Expected disconnection occurred.

================================================================================

ifconfig output:

lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
options=3<RXCSUM,TXCSUM>
inet6 ::1 prefixlen 128
inet 127.0.0.1 netmask 0xff000000
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1
nd6 options=1<PERFORMNUD>
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
stf0: flags=0<> mtu 1280
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
ether ac:bc:32:c9:a7:7d
inet 192.168.43.103 netmask 0xffffff00 broadcast 192.168.43.255
media: autoselect
status: active
en1: flags=963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX> mtu 1500
options=60<TSO4,TSO6>
ether 6a:00:01:58:0e:e0
media: autoselect <full-duplex>
status: inactive
en2: flags=963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX> mtu 1500
options=60<TSO4,TSO6>
ether 6a:00:01:58:0e:e1
media: autoselect <full-duplex>
status: inactive
bridge0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
options=63<RXCSUM,TXCSUM,TSO4,TSO6>
ether ae:bc:32:9c:07:00
Configuration:
id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
ipfilter disabled flags 0x2
member: en1 flags=3<LEARNING,DISCOVER>
ifmaxaddr 0 port 5 priority 0 path cost 0
member: en2 flags=3<LEARNING,DISCOVER>
ifmaxaddr 0 port 6 priority 0 path cost 0
media: <unknown type>
status: inactive
p2p0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 2304
ether 0e:bc:32:c9:a7:7d
media: autoselect
status: inactive
awdl0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1484
ether 22:a1:70:0c:2a:48
inet6 fe80::20a1:70ff:fe0c:2a48%awdl0 prefixlen 64 scopeid 0x9
nd6 options=1<PERFORMNUD>
media: autoselect
status: active
vnic0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
options=3<RXCSUM,TXCSUM>
ether 00:1c:42:00:00:08
inet 10.211.55.2 netmask 0xffffff00 broadcast 10.211.55.255
media: autoselect
status: active
vnic1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
options=3<RXCSUM,TXCSUM>
ether 00:1c:42:00:00:09
inet 10.37.129.2 netmask 0xffffff00 broadcast 10.37.129.255
media: autoselect
status: active

================================================================================

Console Log:

2016-03-11 11:27:37 Tunnelblick³³⁷⁹² Set the new '*-notOKToCheckThatIPAddressDidNotChangeAfterConnection' preference from the 'notOKToCheckThatIPAddressDidNotChangeAfterConnection' preference
2016-03-11 11:27:37 Tunnelblick³³⁷⁹² Set program update feedURL to https://www.tunnelblick.net/appcast-s.rss
2016-03-11 11:28:02 Tunnelblick³³⁷⁹² runTunnelblickd: no data available from tunnelblickd socket; sleeping 0.100000 seconds...
2016-03-11 11:28:02 Tunnelblick³³⁷⁹² runTunnelblickd: no data available from tunnelblickd socket; sleeping 0.200000 seconds...
2016-03-11 11:28:02 Tunnelblick³³⁷⁹² runTunnelblickd: no data available from tunnelblickd socket; sleeping 0.400000 seconds...
2016-03-11 11:28:02 tunnelblickd³³⁸¹⁰ Status = 0 from tunnelblick-helper command 'compareShadowCopy client'
2016-03-11 11:28:03 Tunnelblick³³⁷⁹² runTunnelblickd: no data available from tunnelblickd socket; sleeping 0.100000 seconds...
2016-03-11 11:28:03 Tunnelblick³³⁷⁹² runTunnelblickd: no data available from tunnelblickd socket; sleeping 0.200000 seconds...
2016-03-11 11:28:03 Tunnelblick³³⁷⁹² runTunnelblickd: no data available from tunnelblickd socket; sleeping 0.400000 seconds...
2016-03-11 11:28:03 tunnelblickd³³⁸¹⁰ Status = 0 from tunnelblick-helper command 'compareShadowCopy client'
2016-03-11 11:28:05 Tunnelblick³³⁷⁹² runTunnelblickd: no data available from tunnelblickd socket; sleeping 0.100000 seconds...
2016-03-11 11:28:05 Tunnelblick³³⁷⁹² runTunnelblickd: no data available from tunnelblickd socket; sleeping 0.200000 seconds...
2016-03-11 11:28:05 Tunnelblick³³⁷⁹² runTunnelblickd: no data available from tunnelblickd socket; sleeping 0.400000 seconds...
2016-03-11 11:28:05 tunnelblickd³³⁸¹⁰ Status = 0 from tunnelblick-helper command 'compareShadowCopy client'
2016-03-11 11:28:48 Tunnelblick³³⁷⁹² runTunnelblickd: no data available from tunnelblickd socket; sleeping 0.100000 seconds...
2016-03-11 11:28:48 Tunnelblick³³⁷⁹² runTunnelblickd: no data available from tunnelblickd socket; sleeping 0.200000 seconds...
2016-03-11 11:28:48 Tunnelblick³³⁷⁹² runTunnelblickd: no data available from tunnelblickd socket; sleeping 0.400000 seconds...
2016-03-11 11:28:48 tunnelblickd³³⁸²³ Status = 0 from tunnelblick-helper command 'compareShadowCopy client'
2016-03-11 11:28:48 Tunnelblick³³⁷⁹² runTunnelblickd: no data available from tunnelblickd socket; sleeping 0.100000 seconds...
2016-03-11 11:28:48 Tunnelblick³³⁷⁹² runTunnelblickd: no data available from tunnelblickd socket; sleeping 0.200000 seconds...
2016-03-11 11:28:49 Tunnelblick³³⁷⁹² runTunnelblickd: no data available from tunnelblickd socket; sleeping 0.400000 seconds...
2016-03-11 11:28:49 tunnelblickd³³⁸²³ Status = 0 from tunnelblick-helper command 'printSanitizedConfigurationFile client.tblk 0'
2016-03-11 11:28:49 Tunnelblick³³⁷⁹² runTunnelblickd: no data available from tunnelblickd socket; sleeping 0.100000 seconds...
2016-03-11 11:28:49 Tunnelblick³³⁷⁹² runTunnelblickd: no data available from tunnelblickd socket; sleeping 0.200000 seconds...
2016-03-11 11:28:49 Tunnelblick³³⁷⁹² runTunnelblickd: no data available from tunnelblickd socket; sleeping 0.400000 seconds...
2016-03-11 11:28:50 Tunnelblick³³⁷⁹² runTunnelblickd: no data available from tunnelblickd socket; sleeping 0.800000 seconds...
2016-03-11 11:28:50 tunnelblickd³³⁸²³ Status = 0 from tunnelblick-helper command 'start client.tblk 1337 3 0 1 0 16688 -ptADGNWradsgnw 2.3.6'
2016-03-11 11:28:51 Tunnelblick³³⁷⁹² Keychain item retrieved successfully for service = 'Tunnelblick-Auth-client' account = 'username'
2016-03-11 11:28:51 Tunnelblick³³⁷⁹² Keychain item retrieved successfully for service = 'Tunnelblick-Auth-client' account = 'password'
2016-03-11 11:29:13 Tunnelblick³³⁷⁹² runTunnelblickd: no data available from tunnelblickd socket; sleeping 0.100000 seconds...
2016-03-11 11:29:13 Tunnelblick³³⁷⁹² runTunnelblickd: no data available from tunnelblickd socket; sleeping 0.200000 seconds...
2016-03-11 11:29:13 Tunnelblick³³⁷⁹² runTunnelblickd: no data available from tunnelblickd socket; sleeping 0.400000 seconds...
2016-03-11 11:29:13 tunnelblickd³³⁸²³ Status = 248 from tunnelblick-helper command 'kill 33830'
2016-03-11 11:29:13 Tunnelblick³³⁷⁹² tunnelblickd status from kill: 248
tunnelblickd stderr:
'killOneOpenvpn(33830): Process does not exist
'
2016-03-11 11:29:14 Tunnelblick³³⁷⁹² runTunnelblickd: no data available from tunnelblickd socket; sleeping 0.100000 seconds...
2016-03-11 11:29:14 Tunnelblick³³⁷⁹² runTunnelblickd: no data available from tunnelblickd socket; sleeping 0.200000 seconds...
2016-03-11 11:29:14 Tunnelblick³³⁷⁹² runTunnelblickd: no data available from tunnelblickd socket; sleeping 0.400000 seconds...
2016-03-11 11:29:14 tunnelblickd³³⁸²³ Status = 0 from tunnelblick-helper command 'postDisconnect client.tblk 1'
2016-03-11 11:29:40 Tunnelblick³³⁷⁹² runTunnelblickd: no data available from tunnelblickd socket; sleeping 0.100000 seconds...
2016-03-11 11:29:40 Tunnelblick³³⁷⁹² runTunnelblickd: no data available from tunnelblickd socket; sleeping 0.200000 seconds...
2016-03-11 11:29:41 Tunnelblick³³⁷⁹² runTunnelblickd: no data available from tunnelblickd socket; sleeping 0.400000 seconds...
2016-03-11 11:29:41 tunnelblickd³³⁸²³ Status = 0 from tunnelblick-helper command 'printSanitizedConfigurationFile client.tblk 0'
2016-03-11 11:29:43 Tunnelblick³³⁷⁹² runTunnelblickd: no data available from tunnelblickd socket; sleeping 0.100000 seconds...
2016-03-11 11:29:43 Tunnelblick³³⁷⁹² runTunnelblickd: no data available from tunnelblickd socket; sleeping 0.200000 seconds...
2016-03-11 11:29:43 Tunnelblick³³⁷⁹² runTunnelblickd: no data available from tunnelblickd socket; sleeping 0.400000 seconds...
2016-03-11 11:29:43 tunnelblickd³³⁸²³ Status = 0 from tunnelblick-helper command 'printSanitizedConfigurationFile client.tblk 0'

================================================================================

Non-Apple kexts that are loaded:

Index Refs Address Size Wired Name (Version) UUID <Linked Against>
45 3 0xffffff7f80a3c000 0xf000 0xf000 com.symantec.kext.internetSecurity (5.2.1f12) A44C1F16-2C47-34DC-9C3E-A2BCEEAFD2A6 <5 4 3 1>
46 1 0xffffff7f80a4b000 0x70000 0x70000 com.symantec.kext.ndcengine (1.0f2) no UUID <45 4 1>
47 0 0xffffff7f80abb000 0xb000 0xb000 com.symantec.kext.ips (3.5.1f12) no UUID <46 45 5 4 3 1>
140 3 0xffffff7f83df9000 0x60000 0x60000 org.virtualbox.kext.VBoxDrv (5.0.12) 2C7E6228-04EC-3814-9A37-8A857BC13E01 <7 5 4 3 1>
142 0 0xffffff7f83e59000 0x8000 0x8000 org.virtualbox.kext.VBoxUSB (5.0.12) 79C39601-7691-33D7-A901-1BC872CD7190 <141 140 39 7 5 4 3 1>
143 0 0xffffff7f83e61000 0x5000 0x5000 org.virtualbox.kext.VBoxNetFlt (5.0.12) 0B96ECAD-586F-3D80-9EBD-87E1E240941E <140 7 5 4 3 1>
144 0 0xffffff7f83e66000 0x6000 0x6000 org.virtualbox.kext.VBoxNetAdp (5.0.12) 04C34324-1819-315F-B141-A9D4DF1B25F5 <140 5 4 1>
145 0 0xffffff7f83e6c000 0x4000 0x4000 com.symantec.kext.SymAPComm (100.1f12) 7145BF9D-FA39-36BB-980E-AEDE4C6E6E20 <45 7 5 4 1>
175 0 0xffffff7f83e79000 0x6000 0x6000 com.parallels.kext.usbconnect (10.0.2 27712) 4838A2E2-3629-36AC-A281-DBEA4DA5E863 <39 7 5 4 3 1>
177 1 0xffffff7f83e81000 0x4e000 0x4e000 com.parallels.kext.hypervisor (10.0.2 27712) 39406A4D-C607-3138-82A0-D152A88A1557 <12 11 7 5 4 3 1>
178 0 0xffffff7f83f33000 0xd000 0xd000 com.parallels.kext.netbridge (10.0.2 27712) E06F8E4D-F8AE-3DAD-805A-7EAB90098925 <177 5 4 3 1>
179 0 0xffffff7f83f40000 0x4000 0x4000 com.parallels.kext.vnic (10.0.2 27712) EC8C4BA2-5155-3FC7-A2A3-0DD5700C0922 <48 5 4 3 1>

My Public IP for this attemp is 211.97.128.224

@David, does that look bad ?

Sorry.. We had an issue with the OpenVPN service not logging properly so I don't have logs to examine.

Can you try again?

I have no experience with OSX, much less Tunnelblick, so I can't verify whether the config is correct on your end but can assure you the server config has your user and hashed password.

Would it also be possible to try with another OpenVPN client?

@Xiaoxi, is it better now ?