This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to access my office Astaro SSG from an Ubuntu Lucid Lynx Desktop

I have switched to Ubuntu, and having a hard time setting up my vpn client to work. It was so easy in Windows, as there is already a Windows openvpn installer in the user portal.

I have downloaded the zip file from the portal, extracted ca.crt, user.crt, user.key, and the ovpn files.

Also managed to install in Ubuntu the open vpn connection type because out-of-the-box, it only came with PPTP. The debian packages I installed are:
1. openvpn
2. openvpn-blacklist (included by default when I select the openvpn package)
3. network-manager-openvpn, and
4. network-manager-openvpn-gnome (included also upon selected no. 3 package)

Configuring my openvpn is where I am at a loss.

For gateway, do I use https or simply type in the host's IP address?
For the authentication type do I choose TLS, Password, Password with Certificates (TLS) or Static?

This thread was automatically locked due to age.

0 Buggrit over 15 years ago

I've just set-up my first Astaro VPN under Lucid Lynx by doing these steps...
1.) I Installed the packages you mentioned in your post.
2.) I then opened the Network Manager (System->Preferences->Network Connections)
3.) I selected the VPN Tab and used the "Import" button.
4.) When asked, I browsed to the folder into which I had extracted the zipped config files. I found that one of the extracted files had an OVPN extension, so I chose that one and 'Bob's your aunty's husband....' it imported all the settings correctly.
5.) I then entered my Username but for security purposes I omitted my password.
6.) Back to the desktop and in the connection widget on the taskbar, I chose VPN Connections and hey presto...there was my vpn connector.

Easy-peasy I thought - Too premature though because when I try to connect unfortunately I now get the message "Failed because the connection attempt timed out"

Anyone else have any ideas? [:S]

It would be nice to get a status readout similar to the Windows "status" menu option so I could see where the problem lies. More info could help in troubleshooting this does anyone have a log viewer or does anyone know where the logs are located so we can take a closer look?
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 15 years ago

Hi, many linux distributions (including Fedora 9-11) are using a broken NetworkManager which is incompatible with the OpenVPN config for Astaro.

However, command-line works, so just put the config files in /etc/openvpn, and run sudo openvpn --config filename

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 Buggrit over 15 years ago in reply to BarryG

Thanks Barry,

That's a shame. The import seemed so seamless. I thought I had a result there. I was hoping to use my newly converted Ubuntu (gnome) laptop to connect to client ASGs.

Do we know of any projects or plans to properly fix this? Linux is after all the fastest growing OS in the world. I should imagine someone somewhere else will want this to be available with a fully functional GUI-based solution. With companies leaving Microsoft in droves, This will surely be needed on a corporate level for many machines soon.

Maybe the guys at Astaro could help out here...?

JB
Cancel
Vote Up 0 Vote Down

Cancel
0 Buggrit over 15 years ago in reply to Buggrit

Update on the latest attempt.

I did copy those files to the /etc/openvpn ditectory and then Sudo'd the Open VPN command. However this is the result.... (sanitised to protect the innocent!)
[SIZE="1"]

*********x@pcs-linux-lt2:/etc/openvpn$ ls
xx.xx.xx.xx.ca.crt xx.xx.xx.xx.user.key update-resolv-conf
xx.xx.xx.xx.user.crt *********x@xx.xx.xx.xx.ovpn
*********x@pcs-linux-lt2:/etc/openvpn$ sudo openvpn --config *********x@xx.xx.xx.xx.ovpn
Thu Jun 17 10:54:22 2010 OpenVPN 2.1.0 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Jan 26 2010
Enter Auth Username:*********x
Enter Auth Password:
Thu Jun 17 10:54:32 2010 WARNING: Make sure you understand the semantics of --tls-remote before using it (see the man page).
Thu Jun 17 10:54:32 2010 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu Jun 17 10:54:32 2010 /usr/bin/openssl-vulnkey -q -b 1024 -m
Thu Jun 17 10:54:33 2010 LZO compression initialized
Thu Jun 17 10:54:33 2010 Control Channel MTU parms [ L:1556 D:140 EF:40 EB:0 ET:0 EL:0 ]
Thu Jun 17 10:54:33 2010 Data Channel MTU parms [ L:1556 D:1450 EF:56 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Jun 17 10:54:33 2010 Local Options hash (VER=V4): '619088b2'
Thu Jun 17 10:54:33 2010 Expected Remote Options hash (VER=V4): 'a4f12474'
Thu Jun 17 10:54:33 2010 Attempting to establish TCP connection with [AF_INET]xx.xx.xx.xx:443 [nonblock]
Thu Jun 17 10:54:43 2010 TCP: connect to [AF_INET]xx.xx.xx.xx:443 failed, will try again in 5 seconds: Connection timed out
Thu Jun 17 10:54:58 2010 TCP: connect to [AF_INET]xx.xx.xx.xx:443 failed, will try again in 5 seconds: Connection timed out
Thu Jun 17 10:55:13 2010 TCP: connect to [AF_INET]xx.xx.xx.xx:443 failed, will try again in 5 seconds: Connection timed out
Thu Jun 17 10:55:28 2010 TCP: connect to [AF_INET]xx.xx.xx.xx:443 failed, will try again in 5 seconds: Connection timed out
^CThu Jun 17 10:55:30 2010 SIGINT[hard,init_instance] received, process exiting
*********x@pcs-linux-lt2:/etc/openvpn$ ^C
*********x@pcs-linux-lt2:/etc/openvpn$
[/SIZE]

I thought maybe a firewall but I have other computers on site connecting to the internet on port 443 without any hitches so I'm at a bit of a loss - Any thoughts would be appreciated.

I'm going to check it out with Wireshark to see if that can shed any light. I'll report back...

JB
Cancel
Vote Up 0 Vote Down

Cancel
0 Buggrit over 15 years ago in reply to Buggrit

This will make you laugh. It certainly had me insanely chucking for a while...

I was pointing the OVPN system at the wrong ASG. It was responding like an ASG, it had a portal I could log onto like an ASG, but it was the wrong ASG!!!

I appear to be a burk! I suppose someone has to be. Otherwise against whom would you very clever people measure your cleverness. Ho hum. :/

Just a failed techie crashed and in flames... As you were. There's nothing to see here... Move along now...

JB
Cancel
Vote Up 0 Vote Down

Cancel
0 Buggrit over 15 years ago in reply to Buggrit

Just for the record, I did finally get a successful connection to the remote network from my Ubuntu (Lucid Lynx) Linux Laptop. These were the steps I took.
1.) Logged onto the remote gateway portal with my Active Directory username and Password (you can just as easily use a local user with the appropriate permissions set up in the SSL and Portal sections in the ASG management console)
2.) On the portal, choose remote access and click to download the 3rd (lowest) button. Save those files to your desktop or somewhere.
3.) Extract the files
4.) Download and install the Open VPN extensions mentioned in @lavezarez's post above, using your package manager. I used the Ubuntu Software centre and searched for Openvpn.
Quoted Text:
[FONT="Times New Roman"]"....managed to install in Ubuntu the open vpn connection type because out-of-the-box, it only came with PPTP. The debian packages I installed are:
1. openvpn
2. openvpn-blacklist (included by default when I select the openvpn package)
3. network-manager-openvpn, and
4. network-manager-openvpn-gnome (included also upon selected no. 3 package)..."[/FONT]

5.) Open your connection manager and scroll down the menu to VPN Connections and select "Configure VPN"
6.) Use the Import button on the right to import your settings from the .ovpn file you extracted in action #3. Fill out any further credentials if you want to automate your login.
7.) Click OK to everything - You're done!
8.) Click the connection in the connection manager on the taskbar and enter your credentials an hey presto - SSL VPN achieved!

I hope this helps.

JB

P.S. Make sure you are working with the correct gateway - unlike me!

P.P.S If anyone can talk me through getting the DNS bit right I'd appreciate it. Unfortunately, VPN up means rest of network access down at present. It would be nice to be able to operate both at the same time.
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 15 years ago

Hi, you should use Astaro as the DNS (make sure the DNS server is allowing connections from the VPN pool), and you need to make sure you have Astaro's VPN settings configured to all ANY or Internet through the VPN.
Don't forget a MASQ for the VPN pool to the EXT interface.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 garnser over 15 years ago in reply to BarryG

Hi, many linux distributions (including Fedora 9-11) are using a broken NetworkManager which is incompatible with the OpenVPN config for Astaro.

Please let me know what flags etc are missing and I'll have this escalated within the network-manager project.
Cancel
Vote Up 0 Vote Down

Cancel
0 Buggrit over 15 years ago in reply to BarryG

Hi, you should use Astaro as the DNS (make sure the DNS server is allowing connections from the VPN pool), and you need to make sure you have Astaro's VPN settings configured to all ANY or Internet through the VPN.
Don't forget a MASQ for the VPN pool to the EXT interface.

Barry

Thanks Barry, I had been tearing my hair out about this for some time - what a result - all traffic is now running smoothly. For the record...You are a technical god!

JB
Cancel
Vote Up 0 Vote Down

Cancel
0 lavezarez over 14 years ago in reply to Buggrit

I just can't stop thinking about the irony of it all - Astaro written in Linux and yet SSL configuration much, much painless to do in Windows than Ubuntu!
Cancel
Vote Up 0 Vote Down

Cancel