Koozali.org: home of the SME Server

Obsolete Releases => SME 7.x Contribs => Topic started by: Teviot on October 18, 2006, 07:43:40 AM

Title: OpenVPN on SME 7.0 (SOLVED)
Post by: Teviot on October 18, 2006, 07:43:40 AM: I need some help. I have tried to install OpenVPN using the instructions found at http://sme.swerts-knudsen.dk/index.html?frame=http%3A//sme.swerts-knudsen.dk/howtos/howto_30.htm.

My problem is, I get an error at the client key stage
Quote
Certificate is to be certified until Oct 15 05:40:43 2016 GMT (3650 days)
Sign the certificate? [y/n]:y
failed to update database
TXT_DB error number 2

Can anyone help?

Adrian
Title: OpenVPN on SME 7.0 (SOLVED)
Post by: Happy on October 18, 2006, 08:44:47 AM: I got the same error.
The other steps worked fine though...
Title: OpenVPN on SME 7.0 (SOLVED)
Post by: william_syd on October 18, 2006, 09:59:43 AM: Are you creating a master certificate and a client certificate with the same domain names ?
Title: OpenVPN on SME 7.0 (SOLVED)
Post by: william_syd on October 18, 2006, 10:26:39 AM: Just ran through it no problem..

Info in Server certificate...
Code: [Select]
The Subject's Distinguished Name is as follows countryName :PRINTABLE:'AU' stateOrProvinceName :PRINTABLE:'New South Wales' localityName :PRINTABLE:'Sydney' organizationName :PRINTABLE:'MagicWilly' organizationalUnitName:PRINTABLE:'VPN' commonName :PRINTABLE:'Server' emailAddress :IA5STRING:'william@xxx.info' Certificate is to be certified until Oct 15 08:21:54 2016 GMT (3650 days)

and Client certificate...
Code: [Select]
The Subject's Distinguished Name is as follows countryName :PRINTABLE:'AU' stateOrProvinceName :PRINTABLE:'New South Wales' localityName :PRINTABLE:'Sydney' organizationName :PRINTABLE:'MagicWilly' organizationalUnitName:PRINTABLE:'VPN' commonName :PRINTABLE:'Client' emailAddress :IA5STRING:'william@xxx.info' Certificate is to be certified until Oct 15 08:23:13 2016 GMT (3650 days)

Note the organizationalUnitName and commonName. commonName has to be different.

You may have to delete these files to start again..
Code: [Select]
/etc/openvpn/easy-rsa/keys/index.txt /etc/openvpn/easy-rsa/keys/index.txt.old
Title: OpenVPN on SME 7.0 (SOLVED)
Post by: Teviot on October 18, 2006, 10:57:08 AM: William

Just followed the instructions again deleteing the files you suggested and came up with the same results.

Code: [Select]
[root@gateway easy-rsa]# rm /etc/openvpn/easy-rsa/keys/index.txt rm: remove regular file `/etc/openvpn/easy-rsa/keys/index.txt'? y [root@gateway easy-rsa]# rm /etc/openvpn/easy-rsa/keys/index.txt.old rm: remove regular empty file `/etc/openvpn/easy-rsa/keys/index.txt.old'? y [root@gateway easy-rsa]# pico vars UW PICO(tm) 4.10 File: vars Modified # Edit this variable to point to # the openssl.cnf file included # with easy-rsa. export KEY_CONFIG=/etc/openvpn/easy-rsa/openssl.cnf # Edit this variable to point to # your soon-to-be-created key # directory. # # WARNING: clean-all will do # a rm -rf on this directory # so make sure you define # it correctly! export KEY_DIR=/etc/openvpn/easy-rsa/keys # Increase this to 2048 if you # are paranoid. If you do increase, # make sure you build OpenVPN with # pthread support, so you don't incur # any performance penalty. export KEY_SIZE=1024 # These are the default values for fields # which will be placed in the certificate. export KEY_COUNTRY=AU export KEY_PROVINCE=NSW export KEY_CITY=xxxx export KEY_ORG=" xxxxxx xxxxxxxx " export KEY_EMAIL="netadmin@xxxxxx" [ Wrote 29 lines ] [root@gateway easy-rsa]# . vars [root@gateway easy-rsa]# ./clean-all [root@gateway easy-rsa]# ./build-ca Generating a 1024 bit RSA private key ...........++++++ ............................++++++ writing new private key to 'ca.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:AU State or Province Name (full name) [NSW]:NSW Locality Name (eg, city) [xxxx]:xxxx Organization Name (eg, company) [ xxxxxx xxxxxxxx ]: xxxxxx xxxxxxxx Organizational Unit Name (eg, section) []:VPN Common Name (eg, your name or your server's hostname) []:gateway Email Address [netadmin@teviot.net]:netadmin@xxxxxx [root@gateway easy-rsa]# ./build-key server Generating a 1024 bit RSA private key .........++++++ ..++++++ writing new private key to 'server.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:AU State or Province Name (full name) [NSW]:NSW Locality Name (eg, city) [xxxx]:xxxx Organization Name (eg, company) [ xxxxxx xxxxxxxx ]: xxxxxx xxxxxxxx Organizational Unit Name (eg, section) []:VPN Common Name (eg, your name or your server's hostname) []:gateway Email Address [netadmin@xxxxxx]:netadmin@xxxxxx Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Using configuration from /etc/openvpn/easy-rsa/openssl.cnf Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows countryName :PRINTABLE:'AU' stateOrProvinceName :PRINTABLE:'NSW' localityName :PRINTABLE:'xxxx' organizationName :PRINTABLE: xxxxxx xxxxxxxx ' organizationalUnitName:PRINTABLE:'VPN' commonName :PRINTABLE:'gateway' emailAddress :IA5STRING:'netadmin@xxxxxx' Certificate is to be certified until Oct 15 08:43:42 2016 GMT (3650 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated [root@gateway easy-rsa]# ./build-key client Generating a 1024 bit RSA private key .....................................................................++++++ .......++++++ writing new private key to 'client.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:AU State or Province Name (full name) [NSW]:NSW Locality Name (eg, city) [xxxx]:xxxx Organization Name (eg, company) [ xxxxxx xxxxxxxx ]: xxxxxx xxxxxxxx Organizational Unit Name (eg, section) []:VPN Common Name (eg, your name or your server's hostname) []:gateway Email Address [netadmin@xxxxxx]:netadmin@xxxxxx Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Using configuration from /etc/openvpn/easy-rsa/openssl.cnf Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows countryName :PRINTABLE:'AU' stateOrProvinceName :PRINTABLE:'NSW' localityName :PRINTABLE:'xxxx' organizationName :PRINTABLE: ' xxxxxx xxxxxxxx ' organizationalUnitName:PRINTABLE:'VPN' commonName :PRINTABLE:'gateway' emailAddress :IA5STRING:'netadmin@xxxxxx' Certificate is to be certified until Oct 15 08:45:15 2016 GMT (3650 days) Sign the certificate? [y/n]:y failed to update database TXT_DB error number 2 [root@gateway easy-rsa]#

I have no idea where to go from here

Adrian
Title: OpenVPN on SME 7.0 (SOLVED)
Post by: william_syd on October 18, 2006, 11:02:45 AM: Did you use gateway as the commonname for the server and client certificates ?

And post as code not quote.. it formats better.
Title: OpenVPN on SME 7.0 (SOLVED)
Post by: Teviot on October 18, 2006, 11:11:25 AM: yes ... gateway was used the whole way though
Title: OpenVPN on SME 7.0 (SOLVED)
Post by: william_syd on October 18, 2006, 11:14:03 AM: Quote from: "teviot"
yes ... gateway was used the whole way though

Did you read and understand my previous post...?

Quote from: "William_Syd"
commonName has to be different.
Title: OpenVPN on SME 7.0 (SOLVED)
Post by: Teviot on October 18, 2006, 11:20:05 AM: I think I ubderstand now

i used the following

Code: [Select]
organizationalUnitName:PRINTABLE:'VPN' commonName :PRINTABLE:'gateway'
Title: OpenVPN on SME 7.0 (SOLVED)
Post by: william_syd on October 18, 2006, 11:22:53 AM: Quote from: "teviot"
I think I ubderstand now

i used the following

Code: [Select]
organizationalUnitName:PRINTABLE:'VPN' commonName :PRINTABLE:'gateway'

Nooo....

Read the howto.. at some stage you make a Server certificate and then a Client certificate.

The CommonName has to be different for each.
Title: OpenVPN on SME 7.0 (SOLVED)
Post by: byte on October 18, 2006, 11:24:50 AM: Moving this topic to the SME 7.x Contribs forum, it is more appropriate there. Thanks!
Title: OpenVPN on SME 7.0 (SOLVED)
Post by: Teviot on October 18, 2006, 11:27:28 AM: Thats what I've been doing and every time it fails on the client key part. I don't understand where i'm going wrong

Adrian
Title: OpenVPN on SME 7.0 (SOLVED)
Post by: william_syd on October 18, 2006, 11:48:44 AM: Quote from: "teviot"
Thats what I've been doing and every time it fails on the client key part. I don't understand where i'm going wrong

Adrian

Your example above shows you using 'gateway' for both.

Do
Code: [Select]
./clean-all and start again from
Code: [Select]
./build-ca

Your asked for CommonName 3 times. The first two are the same, the third one must be different.
Title: OpenVPN on SME 7.0 (SOLVED)
Post by: Teviot on October 18, 2006, 12:05:27 PM: Sorry for being so thick. I now realise AGAIN that to READ the instructions is always a good thing.

Install i now progressing well.
Title: OpenVPN on SME 7.0 (SOLVED)
Post by: william_syd on October 18, 2006, 12:14:20 PM: Quote from: "teviot"
Sorry for being so thick. I now realise AGAIN the to read the instructions is always a good thing.

Install i now progressing well.

No problems. Considering 2 people had this problem maybe you want to write the author of the how to and ask him to add this problem/solution to the bottom of his how to in the FAQ section.

Also add to the title - [solved].
Title: OpenVPN on SME 7.0 (SOLVED)
Post by: Happy on October 23, 2006, 10:41:36 PM: I was wandering if there are any special settings for a VPN in server only mode.
The adsl router has internal IP 192.168.1.254
The sme-server box has IP 192.168.1.221
The service only initialises when I set the gateway IP to that of the adsl router.
However I get TLS handshake error with a 60 second time out when I do that.
I have port 1194 forwarded on the adsl router, and on the client machine's router.
The best I can accomplish is the username/password box popping up. After that it appears to be doing something but always times out before the connection process finishes.

Any ideas as to what I could be doing wrong?
Title: Re: OpenVPN on SME 7.0 (SOLVED)
Post by: pcowley on January 21, 2008, 09:56:08 AM: Ohhh I too had this problem of the txt error when trying to create the client key - and I, too, see that I did not RTFM closely enough. I must have skipped the bit that said make the Common Name "Client" and not "Server".

Doh!!

Thanks William_syd for the heads-up

Cheers
Pete
Title: Re: OpenVPN on SME 7.0 (SOLVED)
Post by: CharlieBrady on January 21, 2008, 08:47:26 PM: Quote from: Happy on October 23, 2006, 10:41:36 PM
Any ideas as to what I could be doing wrong?

For a start, you are hijacking somebody else's forum thread. Your topic is new - you should open a new topic in the forum.