headers
Albert Siersema | 1 Nov 2005 10:47

Re: pkcs11-protected-authentication not working in 2.1beta4 ?


Hello Alon,

>> Using (--)askpass works fine too when connecting with openvpn but
> Does it also popup PIN dialog?
No, it reads from stdin which makes it impossible to run openvpn as a
MSWindows service.
I was hoping the pkcs11 code would be helpful in that department as using
the cryptoapi and running as a service won't work. Probably because the
service runs as System and tries to retrieve it from the wrong cert store.
Running the service as another user won't help either ?! :-(

Anyone who has an idea how to tackle this ?
Basically I want to store the certificate on a smartcard and be able to
run openvpn as a service (e.g. start/stopping it through net start/stop
openvpnservice).

> PKCS#11 protected authentication is not implemented by most of PKCS#11
> providers, it is used in biometric environment or when external keypad
> is available. Are you sure your provider support protected authentication?
I haven't got a clue as of yet. I'm not really a Windows user myself so it
took me quite a while to figure out what to supply as a provider. In the end
I looked in the firefox preferences :) but there's probably a win32 CLI tool
somewhere that can list the various pkcs11 resources and info.

Cheers,
Albert
Permalink | Reply | 4 comments |
headers
Marc Brünink | 1 Nov 2005 11:49
Picon

Re: [bug report] DOS: openvpn 2.0.2 segfaults on Solaris 9.


On Montag, Okt 31, 2005, at 22:06 Europe/Berlin, James Yonan wrote:

> On Mon, 31 Oct 2005, [ISO-8859-1] Marc Brünink wrote:
>
>>
>> On Montag, Okt 31, 2005, at 17:26 Europe/Berlin, Giancarlo Razzolini
>> wrote:
>>
>>> Marc Brünink wrote:
>>>> Hi list,
>>>>
>>>> I'm posting this there in case someone already fixed it or is 
>>>> disposed
>>>> to fix it :-)
>>>> First of all: OpenVPN is great! Thanks for your work!.
>>>> Second of all: I've encounterd a reproducible bug :-(
>>>> I'm running
>>>> OpenVPN 2.0.2 sparc-sun-solaris2.9 [SSL] [LZO] built on Oct 17 2005
>>>> on a
>>>> SunOS sun 5.9 Generic_112233-12 sun4u sparc SUNW,Sun-Fire-V240
>>>> machine. OpenVPN is running in tcp server mode. Everything works
>>>> perfect
>>>> unless I do a portscan on this machine. Then OpenVPN simply 
>>>> segfaults.
>>>> I'm using
>>>> nmap -T Aggressive <ipaddress> -p 1194
>>>>
>>>>
>>>> Mon Oct 31 17:08:03 2005 us=485855 PO_WAIT[0,0] fd=3 rev=0x00000001
(Continue reading)

Permalink | Reply | 1 comment |
headers
Alon Bar-Lev | 1 Nov 2005 18:22
Picon
Gravatar

Re: pkcs11-protected-authentication not working in 2.1beta4 ?

Hi!

Albert Siersema wrote:
> Hello Alon,
>>>Using (--)askpass works fine too when connecting with openvpn but
>>
>>Does it also popup PIN dialog?
> 
> No, it reads from stdin which makes it impossible to run openvpn as a
> MSWindows service.

Strange... I don't understand what is the difference between 
the --show-pkcs11-* and the --askpass...
Just to make sure... --show-pkcs11-slots prompt for PIN???

> I was hoping the pkcs11 code would be helpful in that department as using
> the cryptoapi and running as a service won't work. Probably because the
> service runs as System and tries to retrieve it from the wrong cert store.
> Running the service as another user won't help either ?! :-(

But it does!
Use the management interface.
Put the following in your configuration file:

management hold
management 127.0.0.1 8887
management-query-passwords

Now start your service.
Insert your smartcard.
(Continue reading)

Permalink | Reply | 3 comments |
headers
James Yonan | 1 Nov 2005 21:17

OpenVPN 2.0.4 Released -- Note security fixes

This release contains fixes for two security issues that just came to my
attention over the past 24 hours, which affect OpenVPN 2.0, 2.0.1, 2.0.2,
and the 2.1 beta series.  OpenVPN 1.x is not affected.

Individual patches are available here:

http://openvpn.net/patch/2.0.4-security-patches

Change Log:

* Security fix -- Affects non-Windows OpenVPN clients of
  version 2.0 or higher which connect to a malicious or
  compromised server.  A format string vulnerability
  in the foreign_option function in options.c could
  potentially allow a malicious or compromised server
  to execute arbitrary code on the client.  Only
  non-Windows clients are affected.  The vulnerability
  only exists if (a) the client's TLS negotiation with
  the server succeeds, (b) the server is malicious or
  has been compromised such that it is configured to
  push a maliciously crafted options string to the client,
  and (c) the client indicates its willingness to accept
  pushed options from the server by having "pull" or
  "client" in its configuration file (Credit: Vade79).
  CVE-2005-3393
* Security fix -- Potential DoS vulnerability on the
  server in TCP mode.  If the TCP server accept() call
  returns an error status, the resulting exception handler
  may attempt to indirect through a NULL pointer, causing
  a segfault.  Affects all OpenVPN 2.0 versions.
(Continue reading)

Permalink | Reply | 8 comments |
headers
James Yonan | 1 Nov 2005 22:55

Re: [bug report] DOS: openvpn 2.0.2 segfaults on Solaris 9.

On Tue, 1 Nov 2005, [ISO-8859-1] Marc Brünink wrote:

> 
> On Montag, Okt 31, 2005, at 22:06 Europe/Berlin, James Yonan wrote:
> 
> > On Mon, 31 Oct 2005, [ISO-8859-1] Marc Brünink wrote:
> >
> >>
> >> On Montag, Okt 31, 2005, at 17:26 Europe/Berlin, Giancarlo Razzolini
> >> wrote:
> >>
> >>> Marc Brünink wrote:
> >>>> Hi list,
> >>>>
> >>>> I'm posting this there in case someone already fixed it or is 
> >>>> disposed
> >>>> to fix it :-)
> >>>> First of all: OpenVPN is great! Thanks for your work!.
> >>>> Second of all: I've encounterd a reproducible bug :-(
> >>>> I'm running
> >>>> OpenVPN 2.0.2 sparc-sun-solaris2.9 [SSL] [LZO] built on Oct 17 2005
> >>>> on a
> >>>> SunOS sun 5.9 Generic_112233-12 sun4u sparc SUNW,Sun-Fire-V240
> >>>> machine. OpenVPN is running in tcp server mode. Everything works
> >>>> perfect
> >>>> unless I do a portscan on this machine. Then OpenVPN simply 
> >>>> segfaults.
> >>>> I'm using
> >>>> nmap -T Aggressive <ipaddress> -p 1194
> >>>>
(Continue reading)

Permalink | Reply | 0 comments |
headers
Matthias Andree | 1 Nov 2005 23:24
Picon
Picon

Re: OpenVPN 2.0.4 Released -- Note security fixes

On Tue, 01 Nov 2005, James Yonan wrote:

> This release contains fixes for two security issues that just came to my
> attention over the past 24 hours, which affect OpenVPN 2.0, 2.0.1, 2.0.2,
> and the 2.1 beta series.  OpenVPN 1.x is not affected.

Thanks for the quick fixes.

I understand that the release focus has been anything but helper
scripts, however I found that the easy-rsa/2.0/ directory disappeared,
it was present in 2.0.2 and gone in 2.0.4. What's the story about
easy-rsa/* and easy-rsa/2.0/* in the distribution tarballs, and what has
become of easy-rsa/2.0 in release 2.0.4?

Thanks,

--

-- 
Matthias Andree

-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP.  Click here to play: http://sourceforge.net/geronimo.php
Permalink | Reply | 5 comments |
headers
James Yonan | 2 Nov 2005 05:14

OpenVPN 2.1-beta6 released

Download:

http://openvpn.net/beta/

Change Log:

2005.11.01 -- Version 2.1-beta6

* Security fixes (merged from 2.0.4).
* Fix attempt of assertion at multi.c:1586 (note that
  this precise line number will vary across different
  versions of OpenVPN).
* Windows reliability changes:
  (a) Added code to make sure that the local PATH environmental
      variable points to the Windows system32 directory.
  (b) Added new --ip-win32 adaptive mode which tries 'dynamic'
      and then fails over to 'netsh' if the DHCP negotiation fails.
  (c) Made --ip-win32 adaptive the default.
* More PKCS#11 additions/changes (Alon Bar-Lev).
* Added ".PHONY: plugin" to Makefile.am to work around
  "make dist" issue.
* Fixed double fork issue that occurs when --management-hold
  is used.
* Moved TUN/TAP read/write log messages from --verb 8 to 6.
* Warn when multiple clients having the same common name or
  username usurp each other when --duplicate-cn is not used.
* Modified Windows and Linux versions of get_default_gateway
  to return the route with the smallest metric
  if multiple 0.0.0.0/0.0.0.0 entries are present.
* Added ">NEED-OK" alert and "needok" command to management
(Continue reading)

Permalink | Reply | 0 comments |
headers
James Yonan | 2 Nov 2005 07:58

Re: OpenVPN 2.0.4 Released -- Note security fixes

On Tue, 1 Nov 2005, Matthias Andree wrote:

> On Tue, 01 Nov 2005, James Yonan wrote:
> 
> > This release contains fixes for two security issues that just came to my
> > attention over the past 24 hours, which affect OpenVPN 2.0, 2.0.1, 2.0.2,
> > and the 2.1 beta series.  OpenVPN 1.x is not affected.
> 
> Thanks for the quick fixes.
> 
> I understand that the release focus has been anything but helper
> scripts, however I found that the easy-rsa/2.0/ directory disappeared,
> it was present in 2.0.2 and gone in 2.0.4. What's the story about
> easy-rsa/* and easy-rsa/2.0/* in the distribution tarballs, and what has
> become of easy-rsa/2.0 in release 2.0.4?

That's an oversight...  It looks like it was accidently dropped from the 
tarball during the CVS -> SVN migration.

It is, however, present (and the default) in the 2.1-beta releases in
easy-rsa/

You can also get it directly from the svn repository:

http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn/easy-rsa/

James

-------------------------------------------------------
SF.Net email is sponsored by:
(Continue reading)

Permalink | Reply | 4 comments |
headers
Matthias Andree | 2 Nov 2005 09:24
Picon
Picon
Favicon

Re: OpenVPN 2.0.4 Released -- Note security fixes

On Tue, 01 Nov 2005, James Yonan wrote:

> On Tue, 1 Nov 2005, Matthias Andree wrote:
> 
> > ...      however I found that the easy-rsa/2.0/ directory disappeared,
> > it was present in 2.0.2 and gone in 2.0.4. What's the story about
> > easy-rsa/* and easy-rsa/2.0/* in the distribution tarballs, and what has
> > become of easy-rsa/2.0 in release 2.0.4?
> 
> That's an oversight...  It looks like it was accidently dropped from the 
> tarball during the CVS -> SVN migration.
> 
> It is, however, present (and the default) in the 2.1-beta releases in
> easy-rsa/

Could you perhaps provide a tarball that unpacks into
openvpn-2.0.4/easy-rsa/2.0/ at the same place as the
openvpn-2.0.4.tar.gz?

The FreeBSD port is now at version 2.0.4, I'd however like to restore
the 2.0.2 file layout with easy-rsa/2.0 in place in a revision of the
port (2.0.4_1 perhaps).

An officially shipped easy-rsa-2.0[_rc1] tarball would help us
distributors quite a bit. FreeBSD prefers readable patches or files in
the ports system over binary (i. e. a "shar" archive or perhaps
uuencoded .tar.gz), and while I could theoretically ship a uuencoded
.tar.gz, I'd prefer not to bloat the FreeBSD ports (which are actually
only build instructions, file lists, MD5 sums) with another 50 or
perhaps 14 kB.
(Continue reading)

Permalink | Reply | 3 comments |
headers
Albert Siersema | 2 Nov 2005 16:05

Re: pkcs11-protected-authentication not working in 2.1beta4 ?


> Strange... I don't understand what is the difference between the
> --show-pkcs11-* and the --askpass...
> Just to make sure... --show-pkcs11-slots prompt for PIN???
Yes it pops up the PIN dialog window (GUI) from the safesign middleware so
to speak.
askpass shows a prompt on stdout and reads from stdin.

> But it does!
> Use the management interface.
> Put the following in your configuration file:
> 
> management hold
> management 127.0.0.1 8887
> management-query-passwords

Yes, just what I thought :) After browsing through the beta4 source and
manual pages 'n all I saw this one as well. It has potential but for it to
be useful to a mere user (i.e. less computer literate people) a kind of GUI
wrapper has to be written. I was thinking about this along the lines of
combining it with something like:
inactive 1800
ping 10
ping-exit 60
explicit-exit-notify
tls-exit
Then writing a script or such that starts the openvpn service, connects to
the management interface, pops up a GUI dialog to ask the user for the PIN,
then sending it through the management interface.
Should be feasable. Thing is, i'm not a Windows programming-person but maybe
(Continue reading)

Permalink | Reply | 2 comments |

Gmane