headers
James Yonan | 1 Oct 2003 01:28

Re: Understanding TLS Mode and RSA key management

Morten Christensen <mc <at> mc.cx> said:

> I need to protect our VPN-tunnels with passwords because computers at 
> the home-end of our tunnels are used by both our employees and the rest 
> of their families.
> 
> As I cannot find a way to combine static keys with passwords, I have to 
> try to understand the use of TLS Mode and RSA keys.
> 
> I have tried to follow "A Simple Guide to RSA Key Management" and the 
> scripts in easy-rsa. A few things :
> 
> What is an "intermediate certificate authority certificate/key" and what 
> is it to be used for ?

Certificates are typically presented in a chain from the top level certificate
(i.e. root certificate) down to the client/server certificate.  Each
certificate is signed by the certificate above it.  The root certificate
itself is self-signed.  An intermediate certificate is a certificate in the
chain which is below the root but above the client/server certificate.

> The Guide says, that we should never need to copy a .key file between 
> computers , but are there tools to build certificates and keys on 
> windows-pc's ?

Yes, the 'openssl' command can be used (which is included in the OpenVPN
Windows distro).

Bear in mind that the Windows version of OpenVPN as of 1.5-beta8 doesn't yet
have the --askpass option implemented, due to windows not supporting the
(Continue reading)

Permalink | Reply | 0 comments |
headers
Bert Shuler | 1 Oct 2003 01:34

RE: OpenVPN 1.5-beta8 released

The windows TUN driver is wonderful!! Thankyou. Will there be any way in
the future to avoid 
"The local and remote VPN endpoints must exist within the same
255.255.255.252 subnet.  This is a limitation of --dev tun when used
with the TAP-WIN32 driver."

Wasting 6 IPs on each connection is not good.

Thanks again James, you rock!

-----Original Message-----
From: James Yonan [mailto:jim <at> yonan.net] 
Sent: Tuesday, September 30, 2003 2:35 AM
To: openvpn-users <at> lists.sourceforge.net
Cc: openvpn-devel <at> lists.sourceforge.net
Subject: [Openvpn-users] OpenVPN 1.5-beta8 released

OpenVPN 1.5-beta8 is now available, and has some significant new
features.

* The major addition is "tun" device support for Windows, making OpenVPN
on Windows now capable of connecting with OpenVPN running on any other
platform.

* A set of --route options have been added to ease route management for
routes which are tied to VPN tunnels.

* The --ifconfig option has been extended to work with both tun or tap
interfaces, and now also works on Windows.
(Continue reading)

Permalink | Reply | 2 comments |
headers
Rob Fowler | 1 Oct 2003 03:58

OpenSSL Security Advisory [30 September 2003]

Heads up. I don't know if this affects us but there is a fair list of
issues.
http://www.openssl.org/news/secadv_20030930.txt
I'm am just cooking the new libs and openvpn with it.

-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
Permalink | Reply | 0 comments |
headers
Rob Fowler | 1 Oct 2003 03:47
Picon

OpenSSL Security Advisory [30 September 2003]

Heads up. I don't know if this would affect is, just passing the info along:

http://www.openssl.org/news/secadv_20030930.txt

---
This email and any files transmitted with it are solely intended for the use of the addressee(s) and may
contain information that is confidential and privileged.  If you receive this email in error, please
advise us by return email immediately.  Please also disregard the contents of the email, delete it and
destroy any copies immediately.
Computershare Limited and its subsidiaries do not accept liability for the views expressed in the email or
for the consequences of any computer viruses that may be transmitted with this email.
This email is also subject to copyright.  No part of it should be reproduced, adapted or transmitted without
the written consent of the copyright owner.

-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
Permalink | Reply | 1 comment |
headers
Morten Christensen | 1 Oct 2003 08:39

Re: Understanding TLS Mode and RSA key management

Morten Christensen wrote in mail, at 30-09-2003 23:29:

> I need to protect our VPN-tunnels with passwords because computers at 
> the home-end of our tunnels are used by both our employees and the rest 
> of their families.
> 
> As I cannot find a way to combine static keys with passwords, I have to 
> try to understand the use of TLS Mode and RSA keys.

The ca.crt file from the certificate authority must be on the 
client-computer at home/on the road to make the tunnel.

When a new key is signed, is the "openssl ca" command then using the 
ca.crt or the ca.key file ?

If the ca.crt file is used, then everybody with physical access to the 
client computer at home/on the road can make new keys without passwords 
and get access to the tls-server at the office ?

--
mvh
Morten Christensen

-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
Permalink | Reply | 0 comments |
headers
Jussi Jääskeläinen | 1 Oct 2003 09:00
Picon

share error..

There is "bug"..
As you can see from log, I have --ping-restart option and because that
options time out, it try to restart openvpn.. But can not read that
key-file.
--> So last process keeps it (still) open.  Should be easy to fix!

Oct  1 10:00:35 ws9 openvpn[27020]: Inactivity timeout (--ping-restart),
restarting
Oct  1 10:00:35 ws9 openvpn[27020]: Closing TCP/UDP socket
Oct  1 10:00:35 ws9 openvpn[27020]: Closing TUN/TAP device
Oct  1 10:00:35 ws9 openvpn[27020]: OpenVPN 1.5-beta7 i686-pc-linux-gnu
[SSL] [LZO] built on Sep 19 2003
Oct  1 10:00:35 ws9 openvpn[27020]: Cannot open shared secret file
/etc/openvpn/upi.key: Permission denied (errno=13)
Oct  1 10:00:35 ws9 openvpn[27020]: Exiting

--
Computers are like airconditioners: They stop working properly if you open
Windows!

Jussi Jääskeläinen
Tietotili Consulting Oy

-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
Permalink | Reply | 0 comments |
headers
Jussi Jääskeläinen | 1 Oct 2003 09:24
Picon

RE: share error..

More information..
Then I changed that key "chmod 777 upi.key"
error changes little bit.. Now it cannot open TUN/TAP dev /dev/net/tun:
Permission denied (errno=13)

Oct  1 10:27:16 ws9 openvpn[27386]: Inactivity timeout (--ping-restart),
restarting
Oct  1 10:27:16 ws9 openvpn[27386]: Closing TCP/UDP socket
Oct  1 10:27:16 ws9 openvpn[27386]: Closing TUN/TAP device
Oct  1 10:27:16 ws9 openvpn[27386]: OpenVPN 1.5-beta7 i686-pc-linux-gnu
[SSL] [LZO] built on Sep 19 2003
Oct  1 10:27:16 ws9 openvpn[27386]: WARNING: file '/etc/openvpn/upi.key' is
group or others accessible
Oct  1 10:27:16 ws9 openvpn[27386]: Static Encrypt: Cipher 'BF-CBC'
initialized with 128 bit key
Oct  1 10:27:16 ws9 openvpn[27386]: Static Encrypt: Using 160 bit message
digest 'SHA1' for HMAC authentication
Oct  1 10:27:16 ws9 openvpn[27386]: Static Decrypt: Cipher 'BF-CBC'
initialized with 128 bit key
Oct  1 10:27:16 ws9 openvpn[27386]: Static Decrypt: Using 160 bit message
digest 'SHA1' for HMAC authentication
Oct  1 10:27:16 ws9 openvpn[27386]: LZO compression initialized
Oct  1 10:27:16 ws9 openvpn[27386]: Data Channel MTU parms [ link_mtu=1300
extra_frame=45 extra_buffer=19 extra_tun=0 ]
Oct  1 10:27:16 ws9 openvpn[27386]: Note: Cannot open TUN/TAP dev
/dev/net/tun: Permission denied (errno=13)
Oct  1 10:27:16 ws9 openvpn[27386]: Note: Attempting fallback to kernel 2.2
TUN/TAP interface
Oct  1 10:27:16 ws9 openvpn[27386]: Cannot allocate TUN/TAP dev dynamically
Oct  1 10:27:16 ws9 openvpn[27386]: Exiting
(Continue reading)

Permalink | Reply | 0 comments |
headers
Jussi Jääskeläinen | 1 Oct 2003 09:25
Picon

share error..

More information..
Then I changed that key "chmod 777 upi.key"
error changes little bit.. Now it cannot open TUN/TAP dev /dev/net/tun:
Permission denied (errno=13)

Oct  1 10:27:16 ws9 openvpn[27386]: Inactivity timeout (--ping-restart),
restarting
Oct  1 10:27:16 ws9 openvpn[27386]: Closing TCP/UDP socket
Oct  1 10:27:16 ws9 openvpn[27386]: Closing TUN/TAP device
Oct  1 10:27:16 ws9 openvpn[27386]: OpenVPN 1.5-beta7 i686-pc-linux-gnu
[SSL] [LZO] built on Sep 19 2003
Oct  1 10:27:16 ws9 openvpn[27386]: WARNING: file '/etc/openvpn/upi.key' is
group or others accessible
Oct  1 10:27:16 ws9 openvpn[27386]: Static Encrypt: Cipher 'BF-CBC'
initialized with 128 bit key
Oct  1 10:27:16 ws9 openvpn[27386]: Static Encrypt: Using 160 bit message
digest 'SHA1' for HMAC authentication
Oct  1 10:27:16 ws9 openvpn[27386]: Static Decrypt: Cipher 'BF-CBC'
initialized with 128 bit key
Oct  1 10:27:16 ws9 openvpn[27386]: Static Decrypt: Using 160 bit message
digest 'SHA1' for HMAC authentication
Oct  1 10:27:16 ws9 openvpn[27386]: LZO compression initialized
Oct  1 10:27:16 ws9 openvpn[27386]: Data Channel MTU parms [ link_mtu=1300
extra_frame=45 extra_buffer=19 extra_tun=0 ]
Oct  1 10:27:16 ws9 openvpn[27386]: Note: Cannot open TUN/TAP dev
/dev/net/tun: Permission denied (errno=13)
Oct  1 10:27:16 ws9 openvpn[27386]: Note: Attempting fallback to kernel 2.2
TUN/TAP interface
Oct  1 10:27:16 ws9 openvpn[27386]: Cannot allocate TUN/TAP dev dynamically
Oct  1 10:27:16 ws9 openvpn[27386]: Exiting
(Continue reading)

Permalink | Reply | 2 comments |
headers
James Yonan | 1 Oct 2003 10:53

Re: share error..

Jussi,

If you downgrade privilege with --user/-group then you will not be able to
re-read keys or reopen the tun/tap dev.  

Luckily, openvpn has the --persist-key and --persist-tun options to persist
the key state and tun/tap file descriptor across the reset, so that there is
no need to reopen resources which are now inaccessible due to the privilege
downgrade.

James

Jussi Jääskeläinen <jussi.jaaskelainen <at> tietotili.fi> said:

> More information..
> Then I changed that key "chmod 777 upi.key"
> error changes little bit.. Now it cannot open TUN/TAP dev /dev/net/tun:
> Permission denied (errno=13)
>  
> Oct  1 10:27:16 ws9 openvpn[27386]: Inactivity timeout (--ping-restart),
> restarting
> Oct  1 10:27:16 ws9 openvpn[27386]: Closing TCP/UDP socket
> Oct  1 10:27:16 ws9 openvpn[27386]: Closing TUN/TAP device
> Oct  1 10:27:16 ws9 openvpn[27386]: OpenVPN 1.5-beta7 i686-pc-linux-gnu
> [SSL] [LZO] built on Sep 19 2003
> Oct  1 10:27:16 ws9 openvpn[27386]: WARNING: file '/etc/openvpn/upi.key' is
> group or others accessible
> Oct  1 10:27:16 ws9 openvpn[27386]: Static Encrypt: Cipher 'BF-CBC'
> initialized with 128 bit key
> Oct  1 10:27:16 ws9 openvpn[27386]: Static Encrypt: Using 160 bit message
(Continue reading)

Permalink | Reply | 0 comments |
headers
Luc Van der Veken | 1 Oct 2003 10:46
Favicon

Re: OpenVPN 1.5-beta8 released

On Tue, 30 Sep 2003 16:34:39 -0700, "Bert Shuler"
<bshuler <at> pbs.solutionsiq.com> wrote:

> The windows TUN driver is wonderful!! Thankyou. Will there be any way in
> the future to avoid 
> "The local and remote VPN endpoints must exist within the same
> 255.255.255.252 subnet.  This is a limitation of --dev tun when used
> with the TAP-WIN32 driver."
> 
> Wasting 6 IPs on each connection is not good.

You're not wasting 6 IP's, only two (a /30 network has 4 addresses:
the network address, two client addresses and the broadcast address).

Actually this is the way I was already using TAP: one /30 subnet per
tunnel.

-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
Permalink | Reply | 0 comments |

Gmane