Infrastructure » sepia

approved!

Hi Michael,

You should have access to the Sepia lab now. Please verify you're able to connect to the vpn and ssh mgfritch@teuthology.front.sepia.ceph.com using the private key matching the pubkey you provided.

Be sure to check out the following links for final workstation setup steps:
https://wiki.sepia.ceph.com/doku.php?id=vpnaccess#vpn_client_access
https://wiki.sepia.ceph.com/doku.php?id=testnodeaccess#ssh_config

Most developers choose to schedule runs from the shared teuthology VM. For information on that, see http://docs.ceph.com/teuthology/docs/intro_testers.html

Thanks.

Hi,

Something appears incorrect with either the backend VPN config or my secret file.

When attempting this:
openvpn --config /etc/openvpn/sepia/client.conf --cd /etc/openvpn/ --verb 5

I see an auth failure:
Fri Dec 20 10:37:59 2019 us=223400 SENT CONTROL [openvpn-sepia]: 'PUSH_REQUEST' (status=1)
WRRFri Dec 20 10:37:59 2019 us=293490 AUTH: Received control message: AUTH_FAILED
Fri Dec 20 10:37:59 2019 us=293772 TCP/UDP: Closing socket

Should I regenerate a set of hashed VPN credentials? Or is there something else I should try?

Thanks!

Hi Michael,
Can you please paste the output of the following command:

sudo systemctl status openvpn-client@sepia

OR

sudo systemctl status openvpn@sepia

Thanks,

Adam

Hi Adam, please see the below. Thanks!

$ sudo systemctl status openvpn@sepia
 openvpn@sepia.service - OpenVPN tunneling daemon instance using /etc/openvpn/sepia.conf
   Loaded: loaded (/usr/lib/systemd/system/openvpn@.service; disabled; vendor preset: disabled)
   Active: inactive (dead)

Dec 22 08:13:14 foobaz openvpn@sepia[7628]: VERIFY KU OK
Dec 22 08:13:14 foobaz openvpn@sepia[7628]: Validating certificate extended key usage
Dec 22 08:13:14 foobaz openvpn@sepia[7628]: ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Dec 22 08:13:14 foobaz openvpn@sepia[7628]: VERIFY EKU OK
Dec 22 08:13:14 foobaz openvpn@sepia[7628]: VERIFY OK: depth=0, O=Redhat, CN=openvpn-sepia
Dec 22 08:13:16 foobaz openvpn@sepia[7628]: Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 2432 bit RSA 
Dec 22 08:13:16 foobaz openvpn@sepia[7628]: [openvpn-sepia] Peer Connection Initiated with [AF_INET]8.43.84.129:1194
Dec 22 08:13:17 foobaz openvpn@sepia[7628]: AUTH: Received control message: AUTH_FAILED
Dec 22 08:13:17 foobaz openvpn@sepia[7628]: SIGTERM[soft,auth-failure] received, process exiting
Dec 22 08:13:17 foobaz systemd[1]: openvpn@sepia.service: Succeeded.

$ sudo journalctl -u openvpn@sepia                                     
-- Logs begin at Sun 2019-11-10 15:29:25 MST, end at Sun 2019-12-22 08:37:13 MST. --
Dec 22 08:13:14 foobaz systemd[1]: Starting OpenVPN tunneling daemon instance using /etc/openvpn/sepia.conf...
Dec 22 08:13:14 foobaz openvpn@sepia[7628]: WARNING: file 'sepia/tlsauth' is group or others accessible
Dec 22 08:13:14 foobaz openvpn@sepia[7628]: OpenVPN 2.4.7 x86_64-suse-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 20 2019
Dec 22 08:13:14 foobaz openvpn@sepia[7628]: library versions: OpenSSL 1.1.1d  10 Sep 2019, LZO 2.10
Dec 22 08:13:14 foobaz systemd[1]: Started OpenVPN tunneling daemon instance using /etc/openvpn/sepia.conf.
Dec 22 08:13:14 foobaz openvpn@sepia[7628]: Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Dec 22 08:13:14 foobaz openvpn@sepia[7628]: Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Dec 22 08:13:14 foobaz openvpn@sepia[7628]: TCP/UDP: Preserving recently used remote address: [AF_INET]8.43.84.129:1194
Dec 22 08:13:14 foobaz openvpn@sepia[7628]: UDP link local: (not bound)
Dec 22 08:13:14 foobaz openvpn@sepia[7628]: UDP link remote: [AF_INET]8.43.84.129:1194
Dec 22 08:13:14 foobaz openvpn@sepia[7628]: NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Dec 22 08:13:14 foobaz openvpn@sepia[7628]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Dec 22 08:13:14 foobaz openvpn@sepia[7628]: VERIFY OK: depth=1, O=Redhat, CN=openvpnca-sepia
Dec 22 08:13:14 foobaz openvpn@sepia[7628]: VERIFY KU OK
Dec 22 08:13:14 foobaz openvpn@sepia[7628]: Validating certificate extended key usage
Dec 22 08:13:14 foobaz openvpn@sepia[7628]: ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Dec 22 08:13:14 foobaz openvpn@sepia[7628]: VERIFY EKU OK
Dec 22 08:13:14 foobaz openvpn@sepia[7628]: VERIFY OK: depth=0, O=Redhat, CN=openvpn-sepia
Dec 22 08:13:16 foobaz openvpn@sepia[7628]: Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 2432 bit RSA 
Dec 22 08:13:16 foobaz openvpn@sepia[7628]: [openvpn-sepia] Peer Connection Initiated with [AF_INET]8.43.84.129:1194
Dec 22 08:13:17 foobaz openvpn@sepia[7628]: AUTH: Received control message: AUTH_FAILED
Dec 22 08:13:17 foobaz openvpn@sepia[7628]: SIGTERM[soft,auth-failure] received, process exiting
Dec 22 08:13:17 foobaz systemd[1]: openvpn@sepia.service: Succeeded.

Thank you Michael, Can you also paste the output of "sudo cat /etc/openvpn/client/sepia/secret"
And also run "sudo systemctl restart openvpn@sepia" and see if the output of sudo systemctl status openvpn@sepia change to "running" ?

Hey Michael Fritch, I have updated your VPN credentials, Please try now

Hi Adam, VPN access appears to be working correctly now. Thanks!

You're welcome

Thank you Michael