From mboxrd@z Thu Jan 1 00:00:00 1970 From: ummeegge To: development@lists.ipfire.org Subject: Re: OpenVPN - DEPRECATED OPTION: --tls-remote Date: Mon, 11 Aug 2014 17:44:21 +0200 Message-ID: <305080CC-720A-497B-84FD-49197C3F1A1C@ipfire.org> In-Reply-To: <1407749797.2114.31.camel@rice-oxley.tremer.info> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============2754149366224567383==" List-Id: --===============2754149366224567383== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hi Michael, Am 11.08.2014 um 11:36 schrieb Michael Tremer: > Hi Erik, >=20 > On Tue, 2014-07-29 at 20:05 +0200, ummeegge wrote: >> Hi all, >> since the update to OpenVPN version 2.3 on IPFire the client log >> message "DEPRECATED OPTION: --tls-remote, please update your >> configuration" appears. so the clientside directive "--tls-remote" >> will be removed from OpenVPN in one of the comming versions --> >> https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage . For >> future updates of OpenVPN on IPFire (2.4+) it will be important to >> modify existing client.ovpn=C2=B4s and replace the "--tls-remote name" with >> the new "--verify-x509-name name type" directive. >=20 > Yes, we should do this at some point. The question that is currently on > my mind is if that is completely backwards-compatible with all > installations that we do have out there. Have tested the "--verify-x509-name" directive positive only with 2.3.2 and a= bove. =3D< 2.3.1 have had problems with this. Causing the heartbleed bug it m= ight be probably a good time and chance for may ~ 90% of the clients out ther= e which have no problems with this. But you are right there are a couple of o= ther clients which are using nevertheless older (may patched) versions. Have = seen this e.g. in the Snom forum that they have problems with this directive.= =20 >=20 >> Since OpenVPN client/server version 2.3.2 the new verify option can be >> used in client configs whereby "type" includes the possibilty of 3 >> different kinds of verification --> "subject", "name" and >> "name-prefix" . This leads to a question which one of the "types" >> should be used for future versions on IPFire.=20 >> At this time IPFire handles "--tls-remote" automatically and it can=C2=B4t >> be configured over the WUI, this is handy cause the user doesn=C2=B4t need >> to bother around with all that kind of settings, but should this >> remain in that way also for the new verification method ? >=20 > This should not be configurable for the user, because I cannot see the > point right now. It should stay compatible to what we are doing at the > moment. I think so. There is also some time left until OpenVPN throws this directive = away. An exact time aren=C2=B4t known at this time. >=20 >> Also, to use "--verify-x509-name" the clients needs to have a version >>> =3D 2.3.2 otherwise the connection won=C2=B4t come up so there is no >> backwards compatibility with the new directive and version =3D< 2.3.1 . >=20 > This is my biggest concern as there might be many systems that run old > versions. >=20 >> May some people out there have some ideas, informations, ...., for >> this topic ? >=20 > Not really as far as we can see. Would you please update the code for > this and send patches when you have the time for it? We could possibly do it in that way: We leave "--tls-remote" in the client.ov= pn configuration file but add also the "--verify-x509-name" directive out com= mented with a little hint when it could be used, like it is done now for the = usage of different interfaces --> "#Coment the above line and uncoment the ne= xt line, if you want to connect on the Blue interface" <-- or someting like t= hat... >=20 >> Anyway a discussion about that might be interesting. >=20 > -Michael >=20 >=20 As a first idea. Greetings, Erik --===============2754149366224567383==--