Benjamin Smith

Since upgrading to Ubuntu 8.10 (Intrepid) I had been having trouble with my SSL VPN connectivity. Rather than sit down and figure it out I chose to fire up a virtual box instance of 8.04 and use it to get work done. Finally, tonight, I hit the tipping point and decided to figure this out. First I discovered debug mode with the SSL client. You can enable it on the command line by running

# startct -d

That will put a log in /var/log/AvConnect.log with lots of debugging goodness. The first thing I noticed was a fun error that looked kinda like this:

XGSSL::Connect() DoHandShake Failed!!!

Obviously enough, this led me to believe that this was a problem with the ssl handshake.

So, I decided at this point to inspect the guts of the Aventail client. Seemed simple enough, a few shell scripts (startct,stopct,uninstall) and some perl (cctel.pl) and then there’s this mysterious binary, AvConnect. I decided to look deeper and found this..

# file /usr/local/Aventail/AvConnect 
/usr/local/Aventail/AvConnect: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), for GNU/Linux 2.2.5, dynamically linked (uses shared libs), stripped

Looks like it uses shared libs, let’s see where it’s linking..

# ldd /usr/local/Aventail/AvConnect 
linux-gate.so.1 =>  (0xb8008000)
libpthread.so.0 => /lib/tls/i686/cmov/libpthread.so.0 (0xb7fd4000)
libssl.so.0.9.7 => /usr/lib/libssl.so.0.9.7 (0xb7e93000)
libcrypto.so.0.9.7 => /usr/lib/libcrypto.so.0.9.7 (0xb7d3c000)
libm.so.6 => /lib/tls/i686/cmov/libm.so.6 (0xb7d16000)
libc.so.6 => /lib/tls/i686/cmov/libc.so.6 (0xb7bb8000)
/lib/ld-linux.so.2 (0xb8009000)
libdl.so.2 => /lib/tls/i686/cmov/libdl.so.2 (0xb7bb4000)
libz.so.1 => /usr/lib/libz.so.1 (0xb7b9e000)

Did a bit more digging by running some tests with OpenSSL.

# openssl version
OpenSSL 0.9.8g 19 Oct 2007

# openssl s_client -CAfile /etc/ssl/certs/Entrust_Root_Certification_Authority.pem -connect <myvpnhost>:443 -showcerts

Which seemed to work fine..

So, puzzled I compared the openssl package on my 8.04 VM to what I had installed, shockingly they matched.

# openssl version
OpenSSL 0.9.8g 19 Oct 2007

Taking a shot in the dark I decided to upgrade my local install of openssl from source. Fairly run of the mill install..

# wget http://openssl.org/source/openssl-0.9.8i.tar.gz

# tar zxvfm openssl-0.9.8i.tar.gz

To get the shared objects, you’ll want to run configure like so:

# cd openssl-0.9.8i
# ./config shared

Now, do the magic..

# make && make test

Install it in the default location /usr/local/ssl

# sudo make install

Then, you’ll want to update your links in /usr/lib to point at the new shared objects.

# sudo ln -s /usr/local/ssl/lib/libcrypto.so /usr/lib/libcrypto.so

# sudo ln -s /usr/local/ssl/lib/libssl.so /usr/lib/libssl.so

# sudo rm /usr/lib/libcrypto.so.0.9.7

# sudo ln -s /usr/lib/libcrypto.so /usr/lib/libcrypto.so.0.9.7

# sudo rm /usr/lib/libssl.so.0.9.7

# sudo ln -s /usr/lib/libssl.so /usr/lib/libssl.so.0.9.7

Then test it out by running startct and you should be able to connect as usual. I have yet to figure out why the ssl handshake fails with the packaged version of openssl, so if anyone has any clue about that or has a smarter work around, please let me know :)

This is, of course, not the recommended action for people new to Linux/Ubuntu and I provide no guarantee that it will work for you. I just wished to provide a possible work around for anyone having the same issue googling around aimlessly.

Enjoy

EDIT: More comprehensive shuffling of lib links per comments and observations below. Thanks devodl and js!