AUTH_FAILED with Windscribe #87

DrissiReda · 2022-02-18T17:57:48Z

DrissiReda
Feb 18, 2022

Is there a pinned issue for this?

I have read the pinned issues

Is there an existing or similar issue for this?

I have searched the existing issues

Is there any comment in the documentation for this?

I have read the documentation, especially the FAQ and Troubleshooting parts

Is this related to the container/transmission?

I have checked the container repo for issues

Are you using the latest release?

I am using the latest release

Have you tried using the dev branch latest?

I have tried using dev branch

Config used

I'm using Kubernetes, here is my deployment:

deployment.yaml

kind: Deployment
apiVersion: apps/v1
metadata:
  name: torrent-transmission-openvpn
  namespace: media
spec:
  replicas: 1
  selector:
    matchLabels:
      app: transmission-openvpn
      release: torrent
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: transmission-openvpn
        release: torrent
    spec:
      volumes:
        - name: downloads
          persistentVolumeClaim:
            claimName: torrent-pvc
        - name: config
          secret:
            secretName: windscribe-uk-udp-1194
            defaultMode: 420
        - name: auth-user-pass
          secret:
            secretName: windscribe-user-pass
            defaultMode: 420
        - name: dev-tun
          hostPath:
            path: /dev/net/tun
            type: ''
      containers:
        - name: transmission-openvpn
          image: haugene/transmission-openvpn:latest
          ports:
            - name: http
              containerPort: 9091
              protocol: TCP
          env:
            - name: OPENVPN_PROVIDER
              value: WINDSCRIBE
            - name: OPENVPN_USERNAME
              valueFrom:
                secretKeyRef:
                  name: windscribe-credentials
                  key: username
            - name: OPENVPN_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: windscribe-credentials
                  key: password
            - name: TRANSMISSION_RPC_USERNAME
              value: foo
            - name: TRANSMISSION_RPC_PASSWORD
              value: foo
            - name: TRANSMISSION_PEER_PORT
              value: '47444'
            - name: TRANSMISSION_RPC_AUTHENTICATION_REQUIRED
              value: 'true'
            - name: TRANSMISSION_DOWNLOAD_DIR
              value: /downloads/transmission
            - name: PUID
              value: '1000'
            - name: PGID
              value: '1000'
          resources: {}
          volumeMounts:
            - name: downloads
              mountPath: /data
              subPath: configs/transmission-data
            - name: downloads
              mountPath: /downloads/transmission
              subPath: downloads/transmission
            - name: config
              mountPath: /etc/openvpn/custom/default.ovpn
              subPath: openvpn.conf
            - name: dev-tun
              mountPath: /dev/net/tun
            - name: auth-user-pass
              mountPath: /config/openvpn-credentials.txt
              subPath: openvpn-credentials.txt
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          imagePullPolicy: IfNotPresent
          securityContext:
            capabilities:
              add:
                - NET_ADMIN
      restartPolicy: Always
      terminationGracePeriodSeconds: 30
      dnsPolicy: None
      securityContext: {}
      schedulerName: default-scheduler
      dnsConfig:
        nameservers:
          - 8.8.8.8
          - 8.8.4.4

Here is the config file I'm using from the secret windscribe-uk-udp-1194 :
I obtained it from windscribe website directly, generated for openvpn version 2.6+

openvpn.conf

client
dev tun
proto udp
remote lhr-171.whiskergalaxy.com 1194
verify-x509-name lhr-171.windscribe.com name

nobind
auth-user-pass /config/openvpn-credentials.txt

resolv-retry infinite

cipher AES-256-GCM
ncp-ciphers AES-256-GCM:AES-256-CBC:AES-128-GCM
auth SHA512

verb 2
mute-replay-warnings
remote-cert-tls server
persist-key
persist-tun

key-direction 1
<ca>
-----BEGIN CERTIFICATE-----
MIIF5zCCA8+gAwIBAgIUXKzAwOtQBNDoTXcnwR7GxbVkRqAwDQYJKoZIhvcNAQEL
BQAwezELMAkGA1UEBhMCQ0ExCzAJBgNVBAgMAk9OMRAwDgYDVQQHDAdUb3JvbnRv
MRswGQYDVQQKDBJXaW5kc2NyaWJlIExpbWl0ZWQxEDAOBgNVBAsMB1N5c3RlbXMx
HjAcBgNVBAMMFVdpbmRzY3JpYmUgTm9kZSBDQSBYMTAeFw0yMTA3MDYyMTM5NDNa
Fw0zNzA3MDIyMTM5NDNaMHsxCzAJBgNVBAYTAkNBMQswCQYDVQQIDAJPTjEQMA4G
A1UEBwwHVG9yb250bzEbMBkGA1UECgwSV2luZHNjcmliZSBMaW1pdGVkMRAwDgYD
VQQLDAdTeXN0ZW1zMR4wHAYDVQQDDBVXaW5kc2NyaWJlIE5vZGUgQ0EgWDEwggIi
MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDg/79XeOvthNbhtocxaJ6raIsr
lSrnUJ9xAyYHJV+auT4ZlACNE54NVhrGPBEVdNttUdezHaPUlQA+XTWUPlHMayIg
9dsQEFdHH3StnFrjYBzeCO76trPZ8McU6PzW+LqNEvFAwtdKjYMgHISkt0YPUPdB
7vED6yqbyiIAlmN5u/uLG441ImnEq5kjIQxVB+IHhkV4O7EuiKOEXvsKdFzdRACi
4rFOq9Z6zK2Yscdg89JvFOwIm1nY5PMYpZgUKkvdYMcvZQ8aFDaArniu+kUZiVyU
tcKRaCUCyyMM7iiN+5YV0vQ0Etv59ldOYPqL9aJ6QeRG9Plq5rP8ltbmXJRBO/kd
jQTBrP4gYddt5W0uv5rcMclZ9te0/JGl3Os3Gps5w7bYHeVdYb3j0PfsJAQ5WrM+
hS5/GaX3ltiJKXOA9kwtDG3YpPqvpMVAqpM6PFdRwTH62lOemVAOHRrThOVbclqp
Ebe3zH59jwSML5WXgVIfwrpcpndj2uEyKS50y30GzVBIn5M1pcQJJplYuBp8nVGC
qA9AVV+JHffVP/JrkvEJzhui8M5SVnkzmAK3i+rwL0NMRJKwKaSm1uJVvJyoXMMN
TEcu1lqnSl+i2UlIYAgeqeT//D9zcNgcOdP8ix6NhFChjE1dvNFv8mXxkezmu+et
PpQZTpgc1eBZvAAojwIDAQABo2MwYTAdBgNVHQ4EFgQUVLNKLT/c9fTG4BJ+6rTZ
kPjS4RgwHwYDVR0jBBgwFoAUVLNKLT/c9fTG4BJ+6rTZkPjS4RgwDwYDVR0TAQH/
BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQADggIBAF4Bpc0X
dBsgF3WSeRLJ6t2J7vOjjMXBePwSL0g6GDjLpKW9sz9F3wfXaK5cKjY5tj5NEwmk
Vbqa+BXg4FWic0uLinI7tx7sLtvqHrKUFke35L8gjgIEpErg8nmBPokEVsmCcfYY
utwOi2IGikurpY29O4HniDY9baXp8kvwn1T92ZwF9G5SGzxc9Y0rGs+BwmDZu58I
hID3aqAJ16aHw5FHQWGUxje5uNbEUFdVaj7ODvznM6ef/5sAFVL15mftsRokLhCn
DdEjI/9QOYQoPrKJAudZzbWeOux3k93SehS7UWDZW4AFz/7XTaWL79tLqqtTI6Li
uHn73enHgH6BlsH3ESB+Has6Rn7aH0wBByLQ9+NYIfAwXUCd4nevUXeJ3r/aORi3
67ATj1yb3J8llFCsoc/PT7a+PxDT8co2m6TtcRK3mFT/71svWB0zy7qAtSWT1C82
W5JFkhkP44UMLwGUuJsrYy2qAZVru6Jp6vU/zOghLp5kwa1cO1GEbYinvoyTw4Xk
OuaIfEMUZA10QCCW8uocxqIZXTzvF7LaqqsTCcAMcviKGXS5lvxLtqTEDO5rYbf8
n71J2qUyUQ5yYTE0UFQYiYTuvCbtRg2TJdQy05nisw1O8Hm2erAmUveSTr3CWZ/a
v7Dtup352gRS6qxW4w0jRN3NLfLyazK/JjTX
-----END CERTIFICATE-----
</ca>
<tls-auth>
-----BEGIN OpenVPN Static key V1-----
5801926a57ac2ce27e3dfd1dd6ef8204
2d82bd4f3f0021296f57734f6f1ea714
a6623845541c4b0c3dea0a050fe6746c
b66dfab14cda27e5ae09d7c155aa554f
399fa4a863f0e8c1af787e5c602a801d
3a2ec41e395a978d56729457fe6102d7
d9e9119aa83643210b33c678f9d4109e
3154ac9c759e490cb309b319cf708cae
83ddadc3060a7a26564d1a24411cd552
fe6620ea16b755697a4fc5e6e9d0cfc0
c5c4a1874685429046a424c026db672e
4c2c492898052ba59128d46200b40f88
0027a8b6610a4d559bdc9346d33a0a6b
08e75c7fd43192b162bfd0aef0c716b3
1584827693f676f9a5047123466f0654
eade34972586b31c6ce7e395f4b478cb
-----END OpenVPN Static key V1-----
</tls-auth>

And finally the secret windscribe-user-pass, using credentials supplied by windscribe in the same configuration page:

openvpn-credentials.txt

username
password

Current Behavior

When the pod starts I get the error AUTH_FAILED:

Expected Behavior

Authentication to work

How have you tried to solve the problem?

Tried different locations from Windscribe.
Tried tcp/udp.
Tried configuration files from: https://github.com/haugene/vpn-configs-contrib/blob/main/openvpn/windscribe/

Log output

Here is a complete log:

logs.txt

Starting container with revision: 8cc1870cc039201e0e2f8b7684a9f4e96ae03ab9
Creating TUN device /dev/net/tun
mknod: /dev/net/tun: File exists
Using OpenVPN provider: WINDSCRIBE
Running with VPN_CONFIG_SOURCE auto
No bundled config script found for WINDSCRIBE. Defaulting to external config
Downloading configs from https://github.com/haugene/vpn-configs-contrib/archive/main.zip into /tmp/tmp.Jr4ukIUBWb
Extracting configs to /tmp/tmp.Y2ALqRDBwC
Found configs for WINDSCRIBE in /tmp/tmp.Y2ALqRDBwC/vpn-configs-contrib-main/openvpn/windscribe, will replace current content in /etc/openvpn/windscribe
Cleanup: deleting /tmp/tmp.Jr4ukIUBWb and /tmp/tmp.Y2ALqRDBwC
No VPN configuration provided. Using default.
Modifying /etc/openvpn/windscribe/default.ovpn for best behaviour in this container
Modification: Point auth-user-pass option to the username/password file
Modification: Change ca certificate path
Modification: Change ping options
Modification: Update/set resolv-retry to 15 seconds
Modification: Change tls-crypt keyfile path
Modification: Set output verbosity to 3
Modification: Remap SIGUSR1 signal to SIGTERM, avoid OpenVPN restart loop
Setting OpenVPN credentials...
/etc/openvpn/start.sh: line 160: /config/openvpn-credentials.txt: Read-only file system
/etc/openvpn/start.sh: line 161: /config/openvpn-credentials.txt: Read-only file system
chmod: changing permissions of '/config/openvpn-credentials.txt': Read-only file system
Fri Feb 18 17:54:13 2022 WARNING: file '/config/openvpn-credentials.txt' is group or others accessible
Fri Feb 18 17:54:13 2022 OpenVPN 2.4.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jul 19 2021
Fri Feb 18 17:54:13 2022 library versions: OpenSSL 1.1.1f 31 Mar 2020, LZO 2.10
Fri Feb 18 17:54:13 2022 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Fri Feb 18 17:54:13 2022 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Fri Feb 18 17:54:13 2022 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Fri Feb 18 17:54:13 2022 TCP/UDP: Preserving recently used remote address: [AF_INET]103.108.92.83:1194
Fri Feb 18 17:54:13 2022 Socket Buffers: R=[212992->212992] S=[212992->212992]
Fri Feb 18 17:54:13 2022 UDP link local: (not bound)
Fri Feb 18 17:54:13 2022 UDP link remote: [AF_INET]103.108.92.83:1194
Fri Feb 18 17:54:13 2022 TLS: Initial packet from [AF_INET]103.108.92.83:1194, sid=09680171 36ec70dd
Fri Feb 18 17:54:13 2022 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Fri Feb 18 17:54:13 2022 VERIFY OK: depth=2, C=CA, ST=ON, L=Toronto, O=Windscribe Limited, OU=Systems, CN=Windscribe Node CA X1
Fri Feb 18 17:54:13 2022 VERIFY OK: depth=1, C=CA, ST=ON, L=Toronto, O=Windscribe Limited, OU=Systems, CN=Windscribe Node CA X2
Fri Feb 18 17:54:13 2022 VERIFY KU OK
Fri Feb 18 17:54:13 2022 Validating certificate extended key usage
Fri Feb 18 17:54:13 2022 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Fri Feb 18 17:54:13 2022 VERIFY EKU OK
Fri Feb 18 17:54:13 2022 VERIFY X509NAME OK: C=CA, ST=ON, L=Toronto, O=Windscribe Limited, OU=Systems, CN=adl-354.windscribe.com
Fri Feb 18 17:54:13 2022 VERIFY OK: depth=0, C=CA, ST=ON, L=Toronto, O=Windscribe Limited, OU=Systems, CN=adl-354.windscribe.com
Fri Feb 18 17:54:14 2022 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 4096 bit RSA
Fri Feb 18 17:54:14 2022 [adl-354.windscribe.com] Peer Connection Initiated with [AF_INET]103.108.92.83:1194
Fri Feb 18 17:54:15 2022 SENT CONTROL [adl-354.windscribe.com]: 'PUSH_REQUEST' (status=1)
Fri Feb 18 17:54:15 2022 AUTH: Received control message: AUTH_FAILED
Fri Feb 18 17:54:15 2022 SIGTERM[soft,auth-failure] received, process exiting

Environment

- OS: Debian 11
- Containerd: 1.4.9
- Kubernetes: 1.22.2

Anything else?

No response

pkishino · 2022-02-19T11:51:32Z

pkishino
Feb 19, 2022
Collaborator

check your log:

Setting OpenVPN credentials...
/etc/openvpn/start.sh: line 160: /config/openvpn-credentials.txt: Read-only file system
/etc/openvpn/start.sh: line 161: /config/openvpn-credentials.txt: Read-only file system
chmod: changing permissions of '/config/openvpn-credentials.txt': Read-only file system
Fri Feb 18 17:54:13 2022 WARNING: file '/config/openvpn-credentials.txt' is group or others accessible

you need to check your file permissions etc, the script cannot set the credentials, hence when it tries to authenticate it will have empty credentials and then the auth fails

8 replies

pkishino Feb 19, 2022
Collaborator

Sorry, checked again. You are right, that is ok, but in the end the AUTH fails due to bad user/password combo. Have you checked for special characters etc?

DrissiReda Feb 19, 2022
Author

I'm sure it works, because I tried directly with openvpn on my host.

pkishino Feb 19, 2022
Collaborator

Well, then you best check inside the container to make sure it can read the credentials correctly etc cause the auth failed is from the provider and nothing to do with the container really.
I’d open a shell to the container and verify the ovpn and credentials read as expected

DrissiReda Feb 19, 2022
Author

This is really weird, I didn't change anything, besides switching my custom windscribe provided conf with the one from:

  - name: OPENVPN_CONFIG
    value: London-Crumpets-udp

And it works perfectly, I compared the 2 configuration files and they seem identical...

pkishino Feb 19, 2022
Collaborator

Looked at your config again..
Why are you mounting a custom ovpn file? But then not using CUSTOM as provider? If you specify a provider it will look for this provider files and will never look at your custom mounted config (at least not in /custom/default.ovpn)

you could look at
Modifying /etc/openvpn/windscribe/default.ovpn for best behaviour in this container
Above file in the container and compare. That one could be outdated or wrong.

Please look through the documentation again.
You are trying to mix specifying provider with a custom config.. that’s not how it’s supposed to be used. Pick one or the other please.

jwwolff · 2022-07-30T08:02:08Z

jwwolff
Jul 30, 2022

Windscribe requires you to generate a different username and password from the site: https://windscribe.net/getconfig/openvpn.
Using the provided username and password at the above link will work as expected

0 replies

Uh oh!

AUTH_FAILED with Windscribe #87

Uh oh!

DrissiReda Feb 18, 2022

Is there a pinned issue for this?

Is there an existing or similar issue for this?

Is there any comment in the documentation for this?

Is this related to the container/transmission?

Are you using the latest release?

Have you tried using the dev branch latest?

Config used

Current Behavior

Expected Behavior

How have you tried to solve the problem?

Log output

Environment

Anything else?

Replies: 2 comments · 8 replies

Uh oh!

pkishino Feb 19, 2022 Collaborator

Uh oh!

pkishino Feb 19, 2022 Collaborator

Uh oh!

DrissiReda Feb 19, 2022 Author

Uh oh!

pkishino Feb 19, 2022 Collaborator

Uh oh!

DrissiReda Feb 19, 2022 Author

Uh oh!

Uh oh!

pkishino Feb 19, 2022 Collaborator

Uh oh!

Uh oh!

jwwolff Jul 30, 2022

DrissiReda
Feb 18, 2022

Replies: 2 comments 8 replies

pkishino
Feb 19, 2022
Collaborator

pkishino Feb 19, 2022
Collaborator

DrissiReda Feb 19, 2022
Author

pkishino Feb 19, 2022
Collaborator

DrissiReda Feb 19, 2022
Author

pkishino Feb 19, 2022
Collaborator

jwwolff
Jul 30, 2022