From mboxrd@z Thu Jan 1 00:00:00 1970 From: Adolf Belka To: development@lists.ipfire.org Subject: Re: [PATCH 2/3] OpenVPN: Move the OpenSSL configuration file out of /var/ipfire Date: Wed, 05 Jun 2024 13:33:28 +0200 Message-ID: <34806518-d849-4d08-a757-b14d389c4232@ipfire.org> In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============4711237182319261834==" List-Id: --===============4711237182319261834== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hi All, I should have also added to the end of this message that patches 1 and 3 were= applied, as far as I could tell as per the patch. I then installed the built iso into a vm machine and ran the x509 install and= got the root certificate and no host certificate with the standard openssl e= rror message. In the httpd/error_log file it had the following message Email Address []:Error checking request extension section server Regards, Adolf. On 05/06/2024 13:26, Adolf Belka wrote: > Hi Michael, > > Here is my feedback on these three patches and the issues I found when I tr= ied to use them. > > I had to manually apply them so there is also the possibility that I made a= typo somewhere. > > On 18/04/2024 23:36, Michael Tremer wrote: >> We should not have any configuration files that we share in this place, >> therefore this patch is moving it into /usr/share/openvpn where we >> should be able to update it without any issues. >> >> Signed-off-by: Michael Tremer >> --- >> =C2=A0 config/rootfiles/common/openvpn | 2 +- >> =C2=A0 html/cgi-bin/ovpnmain.cgi=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 | 2 +- >> =C2=A0 lfs/openvpn=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 | 6 ++++++ >> =C2=A0 3 files changed, 8 insertions(+), 2 deletions(-) >> >> diff --git a/config/rootfiles/common/openvpn b/config/rootfiles/common/ope= nvpn >> index d9848a579..c0d49bfad 100644 >> --- a/config/rootfiles/common/openvpn >> +++ b/config/rootfiles/common/openvpn > These changes were no problem. >> @@ -25,6 +25,7 @@ usr/sbin/openvpn-authenticator >> =C2=A0 #usr/share/doc/openvpn/openvpn.8.html >> =C2=A0 #usr/share/man/man5/openvpn-examples.5 >> =C2=A0 #usr/share/man/man8/openvpn.8 >> +usr/share/openvpn/openssl.cnf >> =C2=A0 var/ipfire/ovpn/ca >> =C2=A0 var/ipfire/ovpn/caconfig >> =C2=A0 var/ipfire/ovpn/ccd >> @@ -35,7 +36,6 @@ var/ipfire/ovpn/certs/serial >> =C2=A0 var/ipfire/ovpn/crls >> =C2=A0 var/ipfire/ovpn/n2nconf >> =C2=A0 #var/ipfire/ovpn/openssl >> -var/ipfire/ovpn/openssl/ovpn.cnf >> =C2=A0 var/ipfire/ovpn/openvpn-authenticator >> =C2=A0 var/ipfire/ovpn/ovpn-leases.db >> =C2=A0 var/ipfire/ovpn/ovpnconfig >> diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi >> index 9b8ff5aa5..ed80fef7d 100755 >> --- a/html/cgi-bin/ovpnmain.cgi >> +++ b/html/cgi-bin/ovpnmain.cgi > Also this change no problem. >> @@ -54,7 +54,7 @@ my %mainsettings =3D (); >> &General::readhash("/srv/web/ipfire/html/themes/ipfire/include/colors.txt"= , \%color); >> =C2=A0 =C2=A0 # Use a custom OpenSSL configuration file for all operations >> -$ENV["OPENSSL_CONF"] =3D "${General::swroot}/ovpn/ca/cacert.pem"; >> +$ENV["OPENSSL_CONF"] =3D "/usr/share/openvpn/openssl.cnf"; >> =C2=A0 =C2=A0 ### >> =C2=A0 ### Initialize variables >> diff --git a/lfs/openvpn b/lfs/openvpn >> index b71b4ccc9..0704aa438 100644 >> --- a/lfs/openvpn >> +++ b/lfs/openvpn > This change refused to build as it said the directory removal was for a non= empty directory. When I looked at it I believe that it needed to be differen= t. >> @@ -101,6 +101,12 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) >> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 chown root:root /etc/fcron.daily/openvpn-cr= l-updater >> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 chmod 750 /etc/fcron.daily/openvpn-crl-upda= ter >> =C2=A0 +=C2=A0=C2=A0=C2=A0 # Move the OpenSSL configuration file out of /v= ar/ipfire >> +=C2=A0=C2=A0=C2=A0 mkdir -pv /usr/share/openvpn >> +=C2=A0=C2=A0=C2=A0 mv -v /var/ipfire/ovpn/openssl/ovpn.cnf \ >> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 /usr/share/openvpn/ >> +=C2=A0=C2=A0=C2=A0 rmdir -v /usr/share/openvpn >> + > > The above lines I changed to > > +=C2=A0=C2=A0=C2=A0 # Move the OpenSSL configuration file out of /var/ipfire > +=C2=A0=C2=A0=C2=A0 mkdir -pv /usr/share/openvpn > +=C2=A0=C2=A0=C2=A0 mv -v /var/ipfire/ovpn/openssl/ovpn.cnf \ > +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 /usr/share/openvpn/openssl.cnf > +=C2=A0=C2=A0=C2=A0 rmdir -v /var/ipfire/ovpn/openssl/ > + > with my changes in the last two lines. > When I changed just the last line to start with then the openvpn lfs built = but then later on in the cdrom stage it complained about openssl.cnf not bein= g found, hence I also then added the change to the one before last line. > > Regards, > Adolf. > >> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 # Install authenticator >> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 install -v -m 755 $(DIR_SRC)/config/ovpn/op= envpn-authenticator \ >> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 /usr/sbin/openvpn-a= uthenticator --===============4711237182319261834==--