Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 7 replies
  • Subscribers 39 subscribers
  • Views 24173 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

I am having an issue with Linux64 authentication client.

Mike B

I created the .conf file and that seemed to work.  When running the binary I am getting an error saying "Setting location at ~/.caa/ca-cert.pem for certificates failed!  I thought it may be a permissions problem so I created a file and made is rw but that didn't help.  This article https://www.sophos.com/en-us/support/knowledgebase/123013.aspx doesn't match the version that is in the XG Firewall so I couldn't follow it.  Any advice would be great. 

Michael



Edited Tags
[edited by: Erick Jan at 10:58 PM (GMT -7) on 15 Sep 2022]
  • 0
    I have tried this on several different versions of Ubuntu now. The original one was on my Kali box because that is what I had available. Now I have tried on some older and newer version of Ubuntu and still get the same error.

    I was thinking that I might need to generate .pem file and place it in the file but haven't figured out how to do that yet. I will keep trying.

    -Mike
  • 0
    Hi Mike, was a bit intrigued by a Linux64 client so I downloaded it and worked right away. One thing though, the tar.gz file had a ca-cert.pem file issued by 'Sophos Client Authentication CA' bundled in it. The only place I could find this certificate directly was the 'Download CA for MSI' link on the Authentication Clients page. It would be nice if we could manage the certificate directly, I'm guessing its a quick-n-dirty way of encrypting the authentication data to the UTM. Octal permission on the file was 0755. Hope it helps.
  • 0 in reply to CyberA
    The only item that was in my tar.gz was the bin file. There wasn't anything else in it. Can you verify the version on the bin (-V) on my version.
  • 0 in reply to CyberA
    A little more information about the file that is in the Sophos. The caa_x64.tar.gz is 1.0 MB compressed. When extracted the only file is the caa bin file.
  • 0 in reply to Mike B

    Here is the version of my caa binary

    ./bin/caa -V
    caa version 0.1.0

    and output of my tar.gz file

    drwxr-xr-x root/0 0 2015-11-20 03:27 ./
    drwxr-xr-x root/0 0 2015-11-20 03:27 ./bin/
    -rwxr-xr-x root/0 2404040 2015-11-20 03:27 ./bin/caa
    drwxr-xr-x root/0 0 2015-11-20 03:27 ./.caa/
    -rwxr-xr-x root/0 1679 2015-11-20 03:27 ./.caa/ca-cert.pem
    -rw-r--r-- root/0 931 2015-11-20 03:27 ./.caa/README
    -rw-r--r-- root/0 63 2015-11-20 03:27 ./.caa/caa.conf

  • 0 in reply to CyberA
    My tar is defiantly missing the rest of the files. I took the SFOS offline and moving it back into my lab area. I will take a closer look at it there and see if I can find the file and SCP it out.
  • 0 in reply to Mike B
    The certificate is only included if you log into the User Portal and download the client from there.
Unfiltered HTML