Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OPTIONS ERROR: Failed to negotiate with cypher #381

Closed
mcrite opened this issue Nov 13, 2020 · 35 comments
Closed

OPTIONS ERROR: Failed to negotiate with cypher #381

mcrite opened this issue Nov 13, 2020 · 35 comments

Comments

@mcrite
Copy link

mcrite commented Nov 13, 2020

I get this same error over and over again when trying to connect with multiple profiles. Any assistance would be great.

2020-11-13 16:05:38 OPTIONS ERROR: failed to negotiate cipher with server. Configure --data-ciphers-fallback if you want to connect to this server.
2020-11-13 16:05:38 ERROR: Failed to apply push options
2020-11-13 16:05:38 Failed to open tun/tap interface
2020-11-13 16:05:38 SIGUSR1[soft,process-push-msg-failed] received, process restarting
2020-11-13 16:05:38 Restart pause, 5 second(s)

@cron2
Copy link
Contributor

cron2 commented Nov 13, 2020 via email

@bjhdtv
Copy link

bjhdtv commented Feb 27, 2021

Sat Feb 27 17:04:47 2021 SENT CONTROL [ALIYUN-server]: 'PUSH_REQUEST' (status=1)
Sat Feb 27 17:04:47 2021 PUSH: Received control message: 'PUSH_REPLY,route 10.19.0.0 255.255.0.0,topology net30,ping 10,ping-restart 120,ifconfig 10.19.0.30 10.19.0.29'
Sat Feb 27 17:04:47 2021 OPTIONS IMPORT: timers and/or timeouts modified
Sat Feb 27 17:04:47 2021 OPTIONS IMPORT: --ifconfig/up options modified
Sat Feb 27 17:04:47 2021 OPTIONS IMPORT: route options modified
Sat Feb 27 17:04:47 2021 OPTIONS ERROR: failed to negotiate cipher with server. Add the server's cipher ('BF-CBC') to --data-ciphers (currently 'AES-256-GCM:AES-128-GCM') if you want to connect to this server.
Sat Feb 27 17:04:47 2021 ERROR: Failed to apply push options
Sat Feb 27 17:04:47 2021 Failed to open tun/tap interface
Sat Feb 27 17:04:47 2021 SIGUSR1[soft,process-push-msg-failed] received, process restarting
Sat Feb 27 17:04:47 2021 MANAGEMENT: >STATE:1614416687,RECONNECTING,process-push-msg-failed,,,,,
Sat Feb 27 17:04:47 2021 Restart pause, 160 second(s)

@cron2
Copy link
Contributor

cron2 commented Feb 27, 2021 via email

@bjhdtv
Copy link

bjhdtv commented Mar 31, 2021

Which file should I add 'BF-CBC' to?I cannot find the file which has -data-ciphers (currently 'AES-256-GCM:AES-128-GCM') .
Best Regard!

@selvanair
Copy link
Collaborator

The option goes to the config file. The log is reporting the default values so you may not have any --data-ciphers line present. That said, if you are managing the server, change the server config to support AES-256-GCM, if not, ask the server administrator for a proper config file that works with the server.

Continuing to use a weak cipher like BF-CBC should be avoided.

@jackgxl
Copy link

jackgxl commented Jun 7, 2021

I get this same error over and over again when trying to connect with multiple profiles. Any assistance would be great.

2020-11-13 16:05:38 OPTIONS ERROR: failed to negotiate cipher with server. Configure --data-ciphers-fallback if you want to connect to this server.
2020-11-13 16:05:38 ERROR: Failed to apply push options
2020-11-13 16:05:38 Failed to open tun/tap interface
2020-11-13 16:05:38 SIGUSR1[soft,process-push-msg-failed] received, process restarting
2020-11-13 16:05:38 Restart pause, 5 second(s)

for this Error

#[(ERROR: failed to negotiate cipher with server. Add the server's cipher ('BF-CBC') to --data-ciphers (currently 'AES-256-GCM:AES-128-GCM') if you want to connect to this server.)]
ncp-ciphers "BF-CBC"
https://www.lifechangediary.com/solve-failed-negotiate-cipher-openvpn/

@cron2
Copy link
Contributor

cron2 commented Jun 7, 2021 via email

@yunnysunny
Copy link

add the following config to your openvpn configruation file:

cipher BF-CBC

@aldinoed
Copy link

I get this same error over and over again when trying to connect with multiple profiles. Any assistance would be great.

2020-11-13 16:05:38 OPTIONS ERROR: failed to negotiate cipher with server. Configure --data-ciphers-fallback if you want to connect to this server. 2020-11-13 16:05:38 ERROR: Failed to apply push options 2020-11-13 16:05:38 Failed to open tun/tap interface 2020-11-13 16:05:38 SIGUSR1[soft,process-push-msg-failed] received, process restarting 2020-11-13 16:05:38 Restart pause, 5 second(s)

I think yo have to upgrade your openvpn server package to the latest repository.
For example: If you get an error with openvpn on your debian 8 like yours, you have to uninstall with purge option on your old openvpn. After that, insert the debian 9's repository or latest, then update and install without change the config. So, don't forget to copy all files inside the /etc/openvpn directory before you uninstall the old openvpn then paste it into same directory in new openvpn.

It's work for me. Greetings from Indonesia

@schwabe
Copy link

schwabe commented Oct 31, 2021

Note that what @yunnysunny says works with 2.5 but will also stop working with 2.6 as --cipher is deprecated.

@huangjiayegithub
Copy link

add the following config to your openvpn configruation file:

cipher BF-CBC

thanks it's useful for me , thank you very much !

if someone have this problem, pls add cipher BF-CBC to your file "xxxx.ovpn"

@schwabe
Copy link

schwabe commented Dec 2, 2021

Instead of blindly adding directives, reading https://github.com/OpenVPN/openvpn/blob/master/doc/man-sections/cipher-negotiation.rst and understanding what is happening is the better alternative.

@cron2
Copy link
Contributor

cron2 commented Dec 2, 2021 via email

@Imsol0
Copy link

Imsol0 commented Jul 13, 2022

Hi,
On Thu, Dec 02, 2021 at 03:18:29AM -0800, huangjiayegithub wrote: if someone have this problem, pls add cipher BF-CBC to your file "xxxx.ovpn"
This is actually bad advice, as it will stop working in 2.6 -> if you have this problem, do what was stated before - upgrade the server to 2.4 or higher (2.3 is ANCIENT) - if that is not possible, add BF-CBC to the list in --data-ciphers, in your config (or add that line), as in data-ciphers AES-256-GCM:AES-128-GCM:BF-CBC gert -- "If was one thing all people took for granted, was conviction that if you feed honest figures into a computer, honest figures come out. Never doubted it myself till I met a computer with a sense of humor." Robert A. Heinlein, The Moon is a Harsh Mistress Gert Doering - Munich, Germany @.***

where should i finf config file in kali . /etc/openvpn ?
there are only two directories and one .conf file .. nothing much

@sazzad1337
Copy link

The cipher is not added correctly or something, so I had to modify the .ovpn file manually, if you open the file you'll see
cipher AES-256-CBC

just change it to -
data-ciphers AES-256-CBC

@itfanr
Copy link

itfanr commented Jan 9, 2023

cipher BF-CBC

Thank you. It works for me.

@SomeoneElseOSM
Copy link

Unfortunately, "put the following into your config" isn't enough to resolve this, so following "Questions like this are better suited for the openvn-users list or the openvpn community forum" I've asked at https://forums.openvpn.net/viewtopic.php?t=35283 .
(mentioning here just to link the two issues together)

@selvanair
Copy link
Collaborator

"put the following into your config" means, open the config file and add the suggested line to it.

If the config is in the user's profile, you can do this from the GUI by clicking the menu item named Edit config shown against each connection entry in the menu. Choose the connection for which you want to make the changes, click Edit config and wait for the config file to open up in a notepad window. Make the change and save it (i.e overwrite the file).

If the config is in the global config directory, or if not sure, try the same as above. If saving succeeds, you are done. Otherwise you will get a permission denied error while trying to save the file. If that happens, note down the location of the file listed in the error message that pops up, and edit it directly with admin privileges.

Note: Instead of "adding" you can also replace the corresponding option line if it already exists in the file --- in this case that would be the line starting data-ciphers. If it doesn't exist, just add the line at the bottom of the file.

@TajangSec
Copy link

The cipher is not added correctly or something, so I had to modify the .ovpn file manually, if you open the file you'll see cipher AES-256-CBC

just change it to - data-ciphers AES-256-CBC

goodBoy,it's useful

@nazmul30801
Copy link

nazmul30801 commented Feb 14, 2023

How to fix this issue?

My Command -

┌──(root㉿kali)-[~/Downloads]
└─$ sudo openvpn myvpn.ovpn

Error massages -

2023-02-14 17:35:47 OPTIONS ERROR: failed to negotiate cipher with server. Add the server's cipher ('AES-256-CBC') to --data-ciphers (currently 'AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305') if you want to connect to this server.
2023-02-14 17:35:47 ERROR: Failed to apply push options
2023-02-14 17:35:47 Failed to open tun/tap interface
2023-02-14 17:35:47 SIGUSR1[soft,process-push-msg-failed] received, process restarting
2023-02-14 17:35:47 Restart pause, 1 second(s)

Solution of this issue

Just run this command -

┌──(root㉿kali)-[~/Downloads]
└─$ sed -i 's/cipher AES-256-CBC/data-ciphers AES-256-CBC/' *.ovpn

Then try again to connect openVPN -

┌──(root㉿kali)-[~/Downloads]
└─$ sudo openvpn myvpn.ovpn

Hope it works for everyone 👍

This problem is not happened by openVPN. It occurs by ovpn file provider.

@cron2
Copy link
Contributor

cron2 commented Feb 14, 2023 via email

@bountyhacking
Copy link

bountyhacking commented Feb 17, 2023

How to fix this issue?

My Command -

┌──(root㉿kali)-[~/Downloads]
└─$ sudo openvpn myvpn.ovpn

Error massages -

2023-02-14 17:35:47 OPTIONS ERROR: failed to negotiate cipher with server. Add the server's cipher ('AES-256-CBC') to --data-ciphers (currently 'AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305') if you want to connect to this server.
2023-02-14 17:35:47 ERROR: Failed to apply push options
2023-02-14 17:35:47 Failed to open tun/tap interface
2023-02-14 17:35:47 SIGUSR1[soft,process-push-msg-failed] received, process restarting
2023-02-14 17:35:47 Restart pause, 1 second(s)

Solution of this issue

Just run this command -

┌──(root㉿kali)-[~/Downloads]
└─$ sed -i 's/cipher AES-256-CBC/data-ciphers AES-256-CBC/' *.ovpn

Then try again to connect openVPN -

┌──(root㉿kali)-[~/Downloads]
└─$ sudo openvpn myvpn.ovpn

Hope it works for everyone +1

This problem is not happened by openVPN. It occurs by ovpn file provider.

Harry you are a wizzard! it worked for me thanks buddy

@cron2
Copy link
Contributor

cron2 commented Feb 17, 2023

How to fix this issue?

┌──(root㉿kali)-[~/Downloads]
└─$ sed -i 's/cipher AES-256-CBC/data-ciphers AES-256-CBC/' *.ovpn

Actually, this is bad advice.

It will fix the immediate problem, but when the server side wants to upgrade to AEAD ciphers (AES-256-GCM, Chacha-Poly) your suggestion will break the setup again because this disallows use of these more modern ciphers.

So the suggestion should always be to append non-default ciphers to the data-ciphers line, so this would be

data-ciphers AES-256-GCM:AES-128-GCM:AES-256-CBC

as a replacement for the cipher line. So the sed command would become:

$ sed -i 's/cipher AES-256-CBC/data-ciphers AES-256-GCM:AES-128-GCM:AES-256-CBC/' *.ovpn

(and someone with a bit more time and scripting experience could extend this to cover "any cipher xxx line", of course)

@schwabe
Copy link

schwabe commented Feb 17, 2023

Or add compat-mode 2.5.0 to the configuration instead of trying to be clever with the cipher. We have this option for exactly configuration profiles like this.

@SimonYen
Copy link

data-ciphers AES-256-GCM:AES-128-GCM:BF-CBC

Thank you so much!!!

@selvanair
Copy link
Collaborator

The cause of the error is that the configuration file you are using is not compatible with the server you are connecting to. You have to contact your server administrator for proper guidance and corrected config file.

All the suggestions in this thread were aimed at users who may have the know-how to adapt the advice to match the errors they see in the logs.

@cron2
Copy link
Contributor

cron2 commented Mar 31, 2023 via email

@gmarroyo261194
Copy link

The cipher is not added correctly or something, so I had to modify the .ovpn file manually, if you open the file you'll see cipher AES-256-CBC

just change it to - data-ciphers AES-256-CBC

Work for me! thanks!

@ShrikantDandile
Copy link

The cipher is not added correctly or something, so I had to modify the .ovpn file manually, if you open the file you'll see cipher AES-256-CBC

just change it to - data-ciphers AES-256-CBC

This helped me mine was.
cipher AES-128-CBC
I changed it to.

data-ciphers AES-128-CBC

@GameScripting
Copy link

GameScripting commented Sep 28, 2023

For me this works:

Server Version:

* OpenVPN 2.3.10 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jan  9 2019
library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.08
* on Ubuntu 16.04.7 LTS

Client Version:

* OpenVPN 2.6.6 [git:v2.6.6/c9540130121bfc21] Windows-MSVC [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] [DCO] built on Aug 15 2023
* Windows version 10.0 (Windows 10 or greater), amd64 executable
* library versions: OpenSSL 3.1.2 1 Aug 2023, LZO 2.10

--

1. On the server, in the server.conf file, add a line:

cipher AES-256-CBC

Do NOT try to use AES-128-GCM, this is not supported by Ubuntu 16.04!

2. On the client, in the client.ovpn file, add a line

data-ciphers AES-256-CBC

--

One more tip:

Add log openvpn.log to the server config and check the generated log for error. For me, I added an invalid cipher and the server did still happily start without error (I expected it to not start with an invalid config/cipher)

@cron2
Copy link
Contributor

cron2 commented Sep 28, 2023

* OpenVPN 2.3.10 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jan  9 2019
library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.08
* on Ubuntu 16.04.7 LTS

Do NOT try to use AES-128-GCM, this is not supported by Ubuntu 16.04!

It is highly recommended to never use an operating system or a SSL library on the public Internet that has run out of support years ago already (April 2021 for Ubuntu 16.04, and OpenSSL 1.0.2 had its official end of life in 2015).

So please upgrade that server to 20.04 or 22.04 - and then you can just use the default AES-GCM cipher suite, which is faster, and does not need any extra config.

@DeyDoNN
Copy link

DeyDoNN commented Dec 3, 2023

The cipher is not added correctly or something, so I had to modify the .ovpn file manually, if you open the file you'll see cipher AES-256-CBC

just change it to - data-ciphers AES-256-CBC

You saved me! Cheers!

@muhammadyaqooob
Copy link

The cipher is not added correctly or something, so I had to modify the .ovpn file manually, if you open the file you'll see cipher AES-256-CBC

just change it to - data-ciphers AES-256-CBC

Thank You. I faced the issue during my eCPPT exam.
This was in the open vpn config file:

cipher AES-128-CBC

i changed it to

data-ciphers AES-128-CBC

and it worked.

Thank You

@schwabe
Copy link

schwabe commented Feb 25, 2024

removing the AEAD ciphers from trhe list will probably get you into trouble later. I would really recommend to keep them and instead use

data-ciphers AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305:AES-128-CBC

@divyeshransariya
Copy link

divyeshransariya commented Jul 14, 2024

The cipher is not added correctly or something, so I had to modify the .ovpn file manually, if you open the file you'll see cipher AES-256-CBC

just change it to - data-ciphers AES-256-CBC

This has worked for me. Nothing to do anything else.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests