openvpn configuration?

[David Graser]

That should be addressed (actually just suppressed per WIN32) in http://smedley.id.au/tmp/openvpn-2.3.18-os2-20191009.zip

I downloaded this file, and the Archive Tool says the data is invalid.

There is no file(s) contained in the zip.

[Dave Yeo]

Assuming you're talking about:
Tue Oct  8 19:06:02 2019 WARNING: file 'pass.txt' is group or others accessible

I don't think so. This is what I see, when starting the server, or the client (this is from the client):

Code: [Select]

[W:\TOOLS\OPENVPN]OpenVPN.exe client.ovpn
Wed Oct  9 15:14:39 2019 OpenVPN 2.3.18 i386-pc-os2-emx [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on Oct  7 2019
Wed Oct  9 15:14:39 2019 library versions: OpenSSL 1.0.2n  7 Dec 2017, LZO 2.04
Wed Oct  9 15:14:39 2019 WARNING: INSECURE cipher with block size less than 128 bit (64 bit).  This allows attacks like SWEET32.  Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Wed Oct  9 15:14:39 2019 WARNING: INSECURE cipher with block size less than 128 bit (64 bit).  This allows attacks like SWEET32.  Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
dev_node = (null)
Wed Oct  9 15:14:39 2019 UDPv4 link local (bound): [undef]
sem reset rc=300
Wed Oct  9 15:14:39 2019 UDPv4 link remote: [AF_INET]192.168.0.107:1194
Wed Oct  9 15:14:50 2019 Peer Connection Initiated with [AF_INET]192.168.0.107:1194
Wed Oct  9 15:14:51 2019 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed Oct  9 15:14:51 2019 Initialization Sequence Completed
It does work, but it seems that the program is suggesting that better security settings should be used. I am using the suggested setup from the "another" directory in the openvpn package, from HOBBES, updated to the new openvpn.exe, and minimally modified to match my local network. It looks like a good place to start, but I need to figure out what to change, to make it happy (LOW priority on my part).

The cipher warning is the one to worry about, as it suggests, use the parameter  --cipher with a larger block size (e.g. AES-256-CBC), so --cipher AES-256-CBC. Probably can add it to the configuration file somewhere.
The password in memory thing is only a worry in a few cases such as a trp file containing it or someone with access to the computer. Should always double check trp files towards the bottom where the memory dumps are in case of sensitive info being there.

[Doug Bissett]

The cipher warning is the one to worry about, as it suggests, use the parameter  --cipher with a larger block size (e.g. AES-256-CBC), so --cipher AES-256-CBC. Probably can add it to the configuration file somewhere.
The password in memory thing is only a worry in a few cases such as a trp file containing it or someone with access to the computer. Should always double check trp files towards the bottom where the memory dumps are in case of sensitive info being there.

That saved me some time. I added:

Code: [Select]

--cipher AES-256-CBC
auth-nocacheto both *.ovpn files, and the warnings are gone. It still works, so I guess that is good. This setup uses a file called static.key, created according to the instructions, as a "password", so that wasn't really a problem, in this case.

I still need to figure out how to actually use it.   

[Dave Yeo]

As a proxy?

[Paul Smedley]

That should be addressed (actually just suppressed per WIN32) in http://smedley.id.au/tmp/openvpn-2.3.18-os2-20191009.zip

I downloaded this file, and the Archive Tool says the data is invalid.

There is no file(s) contained in the zip.

Yup, all of a sudden, I can't create a working zip file :/

Edit: fixed now....

[Doug Bissett]

Yup, all of a sudden, I can't create a working zip file

That seems to be caused when the ZIP program finds the file static.key (I don't know if it is the file name, or the contents, that causes the problem). RSync also crashes, when it finds that file. I put the file name in exclude lists, and it doesn't cause a problem any more. It seems to be a good way to authenticate, but if it is going to do things like that, I will go back to using ID and password.

As a proxy?

Probably not. More likely, I will use if for RSync, FTP, and SAMBA, if I can figure out how to do it. I am also not on a fixed IP address, so I need to figure out a way to be able to automatically get my actual IP address, and easily insert it into the config. Currently, I am on my local LAN, but that won't do me much good, when I am not at home. The MyIP program looks like it should do the job, and I can set it to use PMMSend to let me know when it changes. The details are still to be worked out.

[rdunkle]

Is there a possibility to create a tun driver?
I prefer to set up openvpn servers with tun, less traffic and perhaps better security.

[Paul Smedley]

Hi Rich,

Is there a possibility to create a tun driver?
I prefer to set up openvpn servers with tun, less traffic and perhaps better security.

There is definitely a *desire* to create a tun driver - largely for compatability with commercial VPN providers, most of which only support tun.

There's some investigation going on to see what might be required - unfortunately, it seems the source to Pasha's original tap driver has been lost - the original thought was to build on this driver and add the tun part (in a similar way to the win32 openvpn driver).

SO... anything is possible, but don't hold your breath - if a ndis driver is required - there's not many people left with the skills to do this....

Cheers,

Paul.

[Paul Smedley]

Hi All,

I seem to have gotten 2.4.7 running. http://smedley.id.au/tmp/openvpn-2.4.7-os2-20191013.zip

Feedback appreciated.

Cheers,

Paul

[David McKenna]

Hi Paul,

 I am using your new 2.4.7 build here on both OS/2 client and server with no issues so far. It's great being able to log on to my home network shares with ArcaMapper anywhere I can connect to the internet.

 There is one minor issue with ArcaMapper (happened with all the OpenVPN builds I've tried) - when started, on the 'Network Neighborhood' tab, all of the SAMBA machines show up, but none of the shares on them. I can mount 'All shares on server' on any of the machines and shares appear when I browse the drive mounted, but no shared folder can be mounted individually. This does not happen when I am connected directly to my LAN at home. Not a big deal, but maybe there is some setting not quite right.... need to read more about OpenVPN

 Thanks for all you do for OS/2!

Regards,

 PS. - the OpenVPN_src.zip on Hobbes doesn't have the TAP driver source in it?

 

 

[Paul Smedley]

Hey Dave!

I am using your new 2.4.7 build here on both OS/2 client and server with no issues so far. It's great being able to log on to my home network shares with ArcaMapper anywhere I can connect to the internet.

 There is one minor issue with ArcaMapper (happened with all the OpenVPN builds I've tried) - when started, on the 'Network Neighborhood' tab, all of the SAMBA machines show up, but none of the shares on them. I can mount 'All shares on server' on any of the machines and shares appear when I browse the drive mounted, but no shared folder can be mounted individually. This does not happen when I am connected directly to my LAN at home. Not a big deal, but maybe there is some setting not quite right.... need to read more about OpenVPN

Wow! That was quick! The main reason I had an interest in updating OpenVPN is that I've been using it myself quite a bit recently to connect to my home LAN from remote - mainly from my phone.

Sorry, I can't help with the ArcaMapper issue - I think it's just calling smbtree or smbclient to try and list the available shares...

Thanks for all you do for OS/2!

 PS. - the OpenVPN_src.zip on Hobbes doesn't have the TAP driver source in it?

I wish I had more free time for OS/2 related stuff - life keeps seeming to get in the way

Unfortunately OpenVPN_src.zip only has the source for the openvpn client itself, not the tap driver

Cheers,

Paul

[David McKenna]

 Paul,

  Thanks for the smbtree hint. Here is what I get when I run it:

[C:\]smbtree
Registered MSG_REQ_POOL_USAGE
Registered MSG_REQ_DMALLOC_MARK and LOG_CHANGED
rlimit_max: increasing rlimit_max (10000) to minimum Windows limit (16384)
_get_interfaces: Failed to retrieve interface index for 'lan1': No such file or directory
added interface lan0 ip=192.168.0.100 bcast=192.168.0.255 netmask=255.255.255.0
added interface lan1 ip=10.7.7.2 bcast=10.7.7.255 netmask=255.255.255.0
IBMPEERS
        \\MUSICMACHINE                  MusicMachine
         \\MAINMACHINE                   MAINMACHINE Samba Server for OS/2 based systems
                \\MAINMACHINE\IPC$              IPC Service (MAINMACHINE Samba Server for OS/2 based systems)
                \\MAINMACHINE\D                 Drive D: (JFS)
                \\MAINMACHINE\Printer           Printer

 Seems there is an error from 'get interfaces' with 'lan1'. (the TAP driver) MusicMachine is Windows 10 with several shares not shown, but do show on the drive when mounted. Not sure what to do about it. I'm guessing this may be a SAMBA config issue with multiple interfaces. Google brings up nothing on this error....

[Jan-Erik Lärka]

I used Safe Fire PPP a lot and was very pleased with it. Installation was a bit "sparse", but the drivers, gui and engine worked flawlessly.

Today i found out that it was developed further.
Safe Fire PPP 1.3a from 2007-2009 contain updated drivers for network and protocol AND OpenVPN references.

I've installed it, but has been unable to figure out how to enable OpenVPN.
Can you tell me how to ... ?

The driver seem to contain quite a lot of what we want (TAP and TUN)!

From plref.htm

PL_OVPN plugin library

The OpenVPN related code.

OpenVPN plugin

This plugin incorporates the OpenVPN 2.1_rc1 code to create OpenVPN tunnels. It have to be used in conjunction with pl_lan:Adapter plugin to bind to a system TCP/IP stack. Of course various filters like NAT may be inserted in the chain also. There is no support for TUN device as pppX interface. Both (TAP and TUN) modes are implemented over lanX interface like TAP-Win32 adapter.

To generate TLS certificates you'll need the openssl utility. No special version restriction for it. For example you can take it here.

Plugin is operating in Single Connection Mode - only binding to the 0 index of stream pack is allowed.

Links in the text above was removed during copy paste

Merry Christmas,
//Jan-Erik

[Paul Smedley]

Hi Jan-Erik!

Today i found out that it was developed further.
Safe Fire PPP 1.3a from 2007-2009 contain updated drivers for network and protocol AND OpenVPN references.

I've installed it, but has been unable to figure out how to enable OpenVPN.
Can you tell me how to ... ?

This sounds really interesting! I'll track down a copy of safefire ppp 1.3a (or can you email to me) and see what it includes.

Ideally I can adapt the openvpn code to use the safefire ppp driver and both tun and tap can be supported - we'll have to see....

Cheers,

Paul

[Ian B Manners]

 sfl-1.3a-091019.zip

http://www.os2site.com/sw/internet/firewall/index.html