From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael Tremer To: development@lists.ipfire.org Subject: Re: OpenVPN - DEPRECATED OPTION: --tls-remote Date: Mon, 11 Aug 2014 11:36:37 +0200 Message-ID: <1407749797.2114.31.camel@rice-oxley.tremer.info> In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============7817534710933190519==" List-Id: --===============7817534710933190519== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Hi Erik, On Tue, 2014-07-29 at 20:05 +0200, ummeegge wrote: > Hi all, > since the update to OpenVPN version 2.3 on IPFire the client log > message "DEPRECATED OPTION: --tls-remote, please update your > configuration" appears. so the clientside directive "--tls-remote" > will be removed from OpenVPN in one of the comming versions --> > https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage . For > future updates of OpenVPN on IPFire (2.4+) it will be important to > modify existing client.ovpn´s and replace the "--tls-remote name" with > the new "--verify-x509-name name type" directive. Yes, we should do this at some point. The question that is currently on my mind is if that is completely backwards-compatible with all installations that we do have out there. > Since OpenVPN client/server version 2.3.2 the new verify option can be > used in client configs whereby "type" includes the possibilty of 3 > different kinds of verification --> "subject", "name" and > "name-prefix" . This leads to a question which one of the "types" > should be used for future versions on IPFire. > At this time IPFire handles "--tls-remote" automatically and it can´t > be configured over the WUI, this is handy cause the user doesn´t need > to bother around with all that kind of settings, but should this > remain in that way also for the new verification method ? This should not be configurable for the user, because I cannot see the point right now. It should stay compatible to what we are doing at the moment. > Also, to use "--verify-x509-name" the clients needs to have a version > >= 2.3.2 otherwise the connection won´t come up so there is no > backwards compatibility with the new directive and version =< 2.3.1 . This is my biggest concern as there might be many systems that run old versions. > May some people out there have some ideas, informations, ...., for > this topic ? Not really as far as we can see. Would you please update the code for this and send patches when you have the time for it? > Anyway a discussion about that might be interesting. -Michael --===============7817534710933190519==--