OS/2, eCS & ArcaOS - Technical > Networking
openvpn configuration?
David Graser:
--- Quote from: Doug Bissett on October 09, 2019, 11:41:01 pm ---
--- Quote ---That should be addressed (actually just suppressed per WIN32) in http://smedley.id.au/tmp/openvpn-2.3.18-os2-20191009.zip
--- End quote ---
I downloaded this file, and the Archive Tool says the data is invalid.
--- End quote ---
There is no file(s) contained in the zip.
Dave Yeo:
--- Quote from: Doug Bissett on October 09, 2019, 11:31:10 pm ---
--- Quote ---Assuming you're talking about:
Tue Oct 8 19:06:02 2019 WARNING: file 'pass.txt' is group or others accessible
--- End quote ---
I don't think so. This is what I see, when starting the server, or the client (this is from the client):
--- Code: ---[W:\TOOLS\OPENVPN]OpenVPN.exe client.ovpn
Wed Oct 9 15:14:39 2019 OpenVPN 2.3.18 i386-pc-os2-emx [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on Oct 7 2019
Wed Oct 9 15:14:39 2019 library versions: OpenSSL 1.0.2n 7 Dec 2017, LZO 2.04
Wed Oct 9 15:14:39 2019 WARNING: INSECURE cipher with block size less than 128 bit (64 bit). This allows attacks like SWEET32. Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Wed Oct 9 15:14:39 2019 WARNING: INSECURE cipher with block size less than 128 bit (64 bit). This allows attacks like SWEET32. Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
dev_node = (null)
Wed Oct 9 15:14:39 2019 UDPv4 link local (bound): [undef]
sem reset rc=300
Wed Oct 9 15:14:39 2019 UDPv4 link remote: [AF_INET]192.168.0.107:1194
Wed Oct 9 15:14:50 2019 Peer Connection Initiated with [AF_INET]192.168.0.107:1194
Wed Oct 9 15:14:51 2019 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed Oct 9 15:14:51 2019 Initialization Sequence Completed
--- End code ---
It does work, but it seems that the program is suggesting that better security settings should be used. I am using the suggested setup from the "another" directory in the openvpn package, from HOBBES, updated to the new openvpn.exe, and minimally modified to match my local network. It looks like a good place to start, but I need to figure out what to change, to make it happy (LOW priority on my part).
--- End quote ---
The cipher warning is the one to worry about, as it suggests, use the parameter --cipher with a larger block size (e.g. AES-256-CBC), so --cipher AES-256-CBC. Probably can add it to the configuration file somewhere.
The password in memory thing is only a worry in a few cases such as a trp file containing it or someone with access to the computer. Should always double check trp files towards the bottom where the memory dumps are in case of sensitive info being there.
Doug Bissett:
--- Quote ---The cipher warning is the one to worry about, as it suggests, use the parameter --cipher with a larger block size (e.g. AES-256-CBC), so --cipher AES-256-CBC. Probably can add it to the configuration file somewhere.
The password in memory thing is only a worry in a few cases such as a trp file containing it or someone with access to the computer. Should always double check trp files towards the bottom where the memory dumps are in case of sensitive info being there.
--- End quote ---
That saved me some time. I added:
--- Code: -----cipher AES-256-CBC
auth-nocache
--- End code ---
to both *.ovpn files, and the warnings are gone. It still works, so I guess that is good. This setup uses a file called static.key, created according to the instructions, as a "password", so that wasn't really a problem, in this case.
I still need to figure out how to actually use it. ;D
Dave Yeo:
As a proxy?
Paul Smedley:
--- Quote from: David Graser on October 10, 2019, 01:36:02 am ---
--- Quote from: Doug Bissett on October 09, 2019, 11:41:01 pm ---
--- Quote ---That should be addressed (actually just suppressed per WIN32) in http://smedley.id.au/tmp/openvpn-2.3.18-os2-20191009.zip
--- End quote ---
I downloaded this file, and the Archive Tool says the data is invalid.
--- End quote ---
There is no file(s) contained in the zip.
--- End quote ---
Yup, all of a sudden, I can't create a working zip file :/
Edit: fixed now....
Navigation
[0] Message Index
[#] Next page
[*] Previous page
Go to full version