I have looked through the logs for the community versions.
The only things I found were some bug fixes related to auth-token in version 2.5.8 but looking at them I am not sure they would result in the sort of things you are experiencing.
ensure that auth-token received from server is cleared if requested by the management interface (“forget password” or automatically via ``–management-forget-disconnect’')
in a setup without username+password, but with auth-token and auth-token-username pushed by the server, OpenVPN would start asking for username+password on token expiry. Fix.
using --auth-token together with --management-client-auth (on the server) would lead to TLS keys getting out of sync and client being disconnected. Fix.
To be clear, after editing my user config file as described earlier, the client no longer prompts for private key password when the user’s private key is not encrypted… The earlier posted client and server logs describe that case interaction.
When the user private key is encrypted, the prompt appears, but the key password I created does not work. The prompt keeps popping back up with an error saying it’s the wrong password. If I enter the TOTP code after entering the password, no success.
Normally, I prefer to use the most current stable release. However, I’ve been utilizing 2.5.9 as any of 2.6.x versions do not work unless each ovpn file is edited., and then edit the new ovpn file whenever the key expires and a new key is generated. (all clients Windows 10/11) Would it make sense for IPFire to include the “providers legacy default” when it generates the ovpn file?
Sven’s tip works for me. Thank you!!!
Don, what do you mean “edit the new ovpn file whenever the key expires…”?Which line in the ovpn file needs to be changed? Which key expires?
If I move into the 2.6.x client, I need to edit each ovpn file to get it to work. When the certificate expires (default is 730 days) and I generate a new certificate, I need to edit the ovpn file again. Far easier to stay with 2.5.9, which works fine (unless there’s some known security flaw that I’ve missed.)