openvpn-devel Mailing List for OpenVPN

 【电 话】 0755/82129135 82128600 82128650 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 企业竞争情报体系构建暨竞争对手情报获取、分析、利用操作实务 与经验交流（深圳）培训会 ★ 中 国・深圳 ★ ★2006年3月18-19日★ ★承办：众人行管理咨询 深圳市一二三管理咨询有限公司★ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ●	背景 企业要在变幻莫测的市场中取得或保持竞争优势，就必须重视对竞争对手和竞争环境等 情报信息的分析处理，必须构建有助于提升战略决策水平的竞争情报体系。在国内，竞争 情报经历了三年的高速发展后，在电子、通信、汽车、机械、医药、冶金、能源、化工、 烟酒等行业，已有1000多家优秀企业成功地构建了竞争情报体系，体系的运作不仅为企业 带来了行业与竞争对手的技术、产品、市场、客户、绩效与能力指标等商业情报，更成为 企业“克敌制胜”的有力武器。这些企业还把获取、分析和利用竞争对手情报的能力定位 为上至决策者，下至研发、生产、营销、战略等部门管理人员必须具备的基本素质。 企业通过对竞争环境的监测，发现政策、市场机遇和风险，掌握竞争对手的动向和策 略，引导企业通过对情报的收集、分析，来获取战略决策依据，最快、最准地做出市场反 应，并规避决策风险，实现企业绩效和效益的持续改善，众人行管理咨询在深圳举办2006 年“企业竞争情报体系构建暨竞争对手情报获取、分析、利用操作实务与经验交流大会”。 大会紧扣企业应用，竞争情报实战专家，结合国内外的成功经验与失败教训对竞争情报策 略与操作方法进行深入的解析和点评。 ●	课程特色： 重点采用“方法与操作结合”、“案例与实践同步”的专题讲解方式，并辅以提问、 答疑、讨论、现场咨询等互动的交流方式进行。 参加过竞争情报培训的管理人员普遍认为，该课程主题新、内容实，能学以致用。 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ●	课程大纲 时间:3月17日 全天报到 3月18日9:00-12:00 1、竞争情报体系构建关键风险解析及规避 2、影响竞争情报部门运作效率的因素及化解办法 3、竞争对手的识别和锁定 4、竞争对手情报的搜集 5、竞争对手信息的基本内容 6、竞争对手的监测与跟踪 7、竞争对手情报分析研究 8、竞争情报的利用―案例介绍 12：00-12:20 全体代表、专家合影 14:00-16:30 9、竞争情报与企业危机预警(方法、工具、案例) 10、如何防止信息收集中的偏差、如何了解竞争对手的非理性行为、如何撰写竞争情报报告 16:30-17:00 互动交流：竞争情报获取、分析和利用的技巧 3月19日 9:00-11:30 1、 如何理解竞争情报与企业的经营 2、 竞争情报在国内外企业开展情况及趋势 3、 企业情报与反情报战术 4、 竞争对手情报源和基本收集技能 5、 竞争情报的分析和研究 6、 如何构建有助于提升企业决策水平的竞争情报系统 7、 情报人员所应具备的素质与技能 11:30-12:00 提问答疑：借鉴经验，解决竞争情报实践的疑难问题 14:00-16:30 1、 基于平衡计分卡框架的全面竞争对手分析体系 2、 企业竞争情报系统介绍（亲自主持的多个案例） 3、 企业如何建立自己的竞争情报系统 4、 企业如何选拔和培养情报专业人才 5、如何识别企业所需要的情报内容 6、商业情报泄漏的主要途径及反情报技术手段解析 7、竞争情报实践及成功经验介绍 8、企业开展竞争情报工作与信息化的关系 16:30-17:00 经验交流：参会代表各抒己见，相互借鉴提高 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ● 师资简介 曾忠禄：澳门理工学院教授，暨南大学企业管理博士生导师，国内企业竞争情报研究与应 用领域先驱，先后在美国印第安那州戈申学院、维也纳经济管理大学、法国国家科学研究 所从事竞争情报研究与实践，将竞争情报方法导入到中川国际投标与索赔、中国-欧盟企业 合作、澳门博彩业、日本中小企业发展战略等项目和事务中。著有《情报制胜―如何搜集、 分析和利用企业竞争情报》、《企业竞争情报管理―战胜竞争对手的秘密武器》等专著(普 通话授课) 张世平：中国竞争情报领域实战型操作专家，慧聪研究院情报中心总监慧聪国际集团部门 总经理。竞争情报高级讲师，竞争情报专家。有多年的军事情报工作经历，著有专业情报 书籍《经济情报决定企业命运》。擅长把军事情报手段和思维方法，融汇于企业竞争情报 应用领域，有多所军事指挥院校以及北师大情报学研究生班和北京大学EMBA学习经历。主 持咨询并成功实施多家国内国际知名大型企业的竞争情报系统，具有绝对丰富的实战经验， 对中国大型企业竞争情报应用有着精深独到的见解。 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ●	备注： 培训时间：2006年3月18日-19日 培训地点：深圳地铁管理中心 培训费用：每人交纳会务费 2200元(含资料费、培训费、午餐饮料)，住宿统一安排（费用自理）。 授课对象： 1、企业董事长、总经理、营销总监、情报经理及市场、销售、战略、企划、研发、信息等 部门负责人与市场调研、市场策划、情报管理、信息管理、产品开发等从业人员； 2、情报研究、服务机构及高校的领导与专业人士。 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 【培训地点】 深圳地铁管理中心 【上课时间】 ★2006年3月18-19日★ 【培训费用】 2200元/人(包含培训费、讲义、午餐、茶点、合影、通讯录) 【主办单位】 众人行管理咨询 【电 话】 0755/82129135 82128600 82128650 【传 真】 0755/61351396 82129209 邮箱：xia...@12... 【联 系 人】 凌小姐 曾小姐 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 

Sorry for the cross post, but I didn't want to spam both lists with my very very long post...to here it is in the other list. http://article.gmane.org/gmane.network.openvpn.user/14199 Your assistance is appreciated. Dale 

MingW (ver 3.7) doesn't have the "ieproxy.h" header. But it doesn't seem to require it either since most types and prototypes are in <wininet.h>. I patched proxy.c to make it build: --- CVS-latest\proxy.c Mon Dec 12 18:00:00 2005 +++ proxy.c Mon Feb 20 18:05:32 2006 @@ -39,7 +39,7 @@ #include "base64.h" #include "ntlm.h" -#ifdef WIN32 +#if defined(WIN32) && !defined(__MINGW32__) #include "ieproxy.h" #endif --------------- So if MingW doesn't need it, why should it be needed for MSVC. --gv 

On Wed, Feb 15, 2006 at 12:49:37PM +0800, Michael Fung wrote: > OpenVPN is very helpful for people accessing internet in China. However, = the=20 > Chinese government is going to invest 1 billon dollars to built a filter = to=20 > censor all traffic and block unwanted content/protocol. And OpenVPN may a= lso=20 If you're worried about filtering and tracking, you might want to look into http://tor.eff.org A considerable infrastructure is in place: http://serifos.eecs.harvard.edu/= cgi-bin/exit.pl?sortbw=3D1 and you can easily run your own private Tor networks within China. > be blocked. Is it possible to make the protocol header difficult for this= =20 > filter to detect? By making the protocol header customized by the config= =20 > files? --=20 Eugen* Leitl <a href=3D"http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE 

Dear Developers, OpenVPN is very helpful for people accessing internet in China. However, the Chinese government is going to invest 1 billon dollars to built a filter to censor all traffic and block unwanted content/protocol. And OpenVPN may also be blocked. Is it possible to make the protocol header difficult for this filter to detect? By making the protocol header customized by the config files? Rgds, Michael 

I believe the following might be a bug (although I'd love to stand corrected on it) with OpenVPN 2.1beta8 running on OpenBSD. server.conf (OpenBSD 3.7-stable): local W.X.Y.Z port 1194 proto tcp-server dev tun0 ca crypto/ca.crt cert crypto/vpn1.albourne.com.crt key crypto/vpn1.albourne.com.key # This file should be kept secret dh crypto/dh1024.pem topology subnet server 192.168.172.0 255.255.252.0 ifconfig-pool-persist /usr/local/var/run/openvpn-ipp.txt client-to-client keepalive 10 120 comp-lzo persist-key persist-tun status /usr/local/var/run/openvpn-status.log verb 3 client.conf (Ubuntu 5.10/Linux 2.6.12): client dev tun proto tcp-client remote W.X.Y.Z 1194 resolv-retry infinite nobind persist-key persist-tun ca ca.crt cert cygnus.crt key cygnus.key ns-cert-type server comp-lzo verb 3 The server and client (both 2.1beta8, compiled from source) happily start up with no errors, handshake and set the relevant local interfaces: [client] Fri Feb 10 01:00:28 2006 PUSH: Received control message: 'PUSH_REPLY,route-gateway 192.168.172.1,topology subnet,ping 10,ping-restart 120,ifconfig 192.168.172.3 255.255.252.0' Fri Feb 10 01:00:28 2006 OPTIONS IMPORT: timers and/or timeouts modified Fri Feb 10 01:00:28 2006 OPTIONS IMPORT: --ifconfig/up options modified Fri Feb 10 01:00:28 2006 OPTIONS IMPORT: route-related options modified Fri Feb 10 01:00:28 2006 TUN/TAP device tun0 opened Fri Feb 10 01:00:28 2006 TUN/TAP TX queue length set to 100 Fri Feb 10 01:00:28 2006 /sbin/ifconfig tun0 192.168.172.3 netmask 255.255.252.0 mtu 1500 broadcast 192.168.175.255 [server] Fri Feb 10 00:00:26 2006 83.X.Y.Z:16009 [cygnus] Peer Connection Initiated with 83.X.Y.Z:16009 Fri Feb 10 00:00:26 2006 cygnus/83.X.Y.Z:16009 MULTI: Learn: 192.168.172.3 -> cygnus/83.X.Y.Z:16009 Fri Feb 10 00:00:26 2006 cygnus/83.X.Y.Z:16009 MULTI: primary virtual IP for cygnus/83.X.Y.Z:16009: 192.168.172.3 Fri Feb 10 00:00:27 2006 cygnus/83.X.Y.Z:16009 PUSH: Received control message: 'PUSH_REQUEST' Fri Feb 10 00:00:27 2006 cygnus/83.X.Y.Z:16009 SENT CONTROL [cygnus]: 'PUSH_REPLY,route-gateway 192.168.172.1,topology subnet,ping 10,ping-restart 120,ifconfig 192.168.172.3 255.255.252.0' (status=1) The output from ifconfig: [client] tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:192.168.172.3 P-t-P:192.168.172.3 Mask:255.255.252.0 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) [server] tun0: flags=9843<UP,BROADCAST,RUNNING,SIMPLEX,LINK0,MULTICAST> mtu 1500 address: 00:bd:af:74:c0:01 inet 192.168.172.1 netmask 0xfffffc00 broadcast 192.168.175.255 inet6 fe80::2bd:afff:fe74:c001%tun0 prefixlen 64 scopeid 0x17 So that looks just fine. If I try to send ICMP ping packets down the wire observing with tcpdump -i tun0 on both systems I get the following output: [client] 00:54:41.013660 IP (tos 0x0, ttl 64, id 8, offset 0, flags [DF], proto: ICMP (1), length: 84) 192.168.172.4 > 192.168.172.1: ICMP echo request, id 17700, seq 9, length 64 00:54:42.013493 IP (tos 0x0, ttl 64, id 9, offset 0, flags [DF], proto: ICMP (1), length: 84) 192.168.172.4 > 192.168.172.1: ICMP echo request, id 17700, seq 10, length 64 [server] 00:54:41.041494 0:54:0:8:40:0 0:0:0:2:45:0 4001 88: 614a c0a8 ac04 c0a8 ac01 0800 cf8b 4524 0009 c1ca ef43 4735 0000 0809 0a0b 0c0d 0e0f 1011 1213 1415 1617 1819 1a1b 1c1d 1e1f 2021 2223 2425 2627 2829 2a2b 2c2d 2e2f 3031 3233 3435 3637 00:54:42.041826 0:54:0:9:40:0 0:0:0:2:45:0 4001 88: 6149 c0a8 ac04 c0a8 ac01 0800 768b 4524 000a c2ca ef43 9f34 0000 0809 0a0b 0c0d 0e0f 1011 1213 1415 1617 1819 1a1b 1c1d 1e1f 2021 2223 2425 2627 2829 2a2b 2c2d 2e2f 3031 3233 3435 3637 (I _think_ the above are the correct packets on the server-side, there's nothing but stuff like the above) If I remove the "topology subnet" from server.conf and restart I can happily ping through the tunnel and the output from tcpdump on both ends is as expected (note that the client is assigned IP 192.168.172.6, as expected, with the map30 topology): [server] sudo tcpdump -i tun0 tcpdump: listening on tun0, link-type LOOP 23:59:40.442035 192.168.172.6 > 192.168.172.1: icmp: echo request (DF) 23:59:40.442074 192.168.172.1 > 192.168.172.6: icmp: echo reply (DF) 23:59:41.442278 192.168.172.6 > 192.168.172.1: icmp: echo request (DF) 23:59:41.442293 192.168.172.1 > 192.168.172.6: icmp: echo reply (DF) 23:59:42.443881 192.168.172.6 > 192.168.172.1: icmp: echo request (DF) 23:59:42.443894 192.168.172.1 > 192.168.172.6: icmp: echo reply (DF) 23:59:43.444639 192.168.172.6 > 192.168.172.1: icmp: echo request (DF) This seems to indicate that there is a problem on OpenBSD 3.7 with OpenVPN 2.1beta8. I am more than willing to act as a test site as I have a redundant firewall pair and while I debug this problem I can run the primary in map30 mode to give VPN access to remote clients. Please let me know if you need more information and/or want me to try stuff. Ciao, Arrigo 

Hello, after posting a question in gmane.network.openvpn.user without getting an answer, I ask here again. If that is a breech in your customs, I beg your pardon, but I do not see any other way. On trying to set up Ethernet-Bridging with OpenVPN 2.0.5 I obtain the following error: hwgate:/etc/openvpn # openvpn --mktun --dev tap0 Mon Feb 6 04:33:39 2006 Note: Cannot ioctl TUNSETIFF tap0: Invalid argument (er rno=22) Mon Feb 6 04:33:39 2006 Note: Attempting fallback to kernel 2.2 TUN/TAP interfa ce Mon Feb 6 04:33:39 2006 TUN/TAP device /dev/tap0 opened Mon Feb 6 04:33:39 2006 Cannot ioctl TUNSETPERSIST(1) tap0: Invalid argument (e rrno=22) Mon Feb 6 04:33:39 2006 Exiting I am using SuSE Linux Enterprise Server 9.1 (Kernel 2.6.5-7.139-default). Any idea, how ot make bridging work? Cheers Carsten 

Philippe Lemesle wrote: > Hello, all. >=20 > At work, the admins are so paranoid that the policy is to block all int= ernet=20 > access to ensure security.=20 > The only way to go to the Internet is by the way of an HTTP-proxy which= offers=20 > SSL functionnality. > The admins are aware the some employees use VPN over SSL. In fact, they= are=20 > currently studying the option of cutting down SSL functionnality of the= HTTP- > proxy. > So it's possible that in the near future I won't be able to use OpenVPN= anymore. >=20 > I've studied alternative solutions and found a software called HTTHost = (coupled=20 > with HTTPort for the client part).=20 > HTTHost is able to pass plain non-SSL HTTP-proxy via an option called "= remote=20 > host". > But it's less flexible than OpenVPN because it only tunnels TCP connect= ions and=20 > doesn't offer true VPN functionnality. >=20 > So, it would be really nice if someone could add a functionality to the= --http- > proxy command so that we can connect to remote host through an non-SSL = HTTP=20 > proxy. >=20 AFAIK, the so called ssl functionality you are talking about uses the HTTP CONNECT method. Unless your network admin doesn't want to allow your users to access any https site, it should be enabled in the network proxy. Normally it only is enabled on TCP port 443, which is luckily open in almost any ISP in the world. So i use it to make an OpenVPN connection as normal. Using the method described in the HTTPort page is horrible because your latency increases dramatically and you need a "man in the middle" doing the dirty job. I belive that, it would be impossible to implement this feature in OpenVPN, without putting aside the whole security model it is built around (SSL/TLS, they require a "real" TCP or UDP connection to work). And even if it is implemented, in a similar way that HTTPort does, it would loose almost of it's VPN functionality. So i don't believe it would or should be implemented. I can break through firewalls using many different ways, but i almost never saw only one proxy that had the method CONNECT disabled. I believe that if you are in a very restrict network, and it is in your enterprise policy that you shouldn't do this kind of connection, then you are risking your job, even if the traffic is encrypted. I only do this kind of break through in my university, and even there, i managed to ask if it was a break in the network usage policy. My 6 cents, --=20 Giancarlo Razzolini Linux User 172199 Moleque Sem Conteudo Numero #002 Slackware Current Snike Tecnologia em Inform=E1tica 4386 2A6F FFD4 4D5F 5842 6EA0 7ABE BBAB 9C0E 6B85 

Hello, all. At work, the admins are so paranoid that the policy is to block all internet access to ensure security. The only way to go to the Internet is by the way of an HTTP-proxy which offers SSL functionnality. The admins are aware the some employees use VPN over SSL. In fact, they are currently studying the option of cutting down SSL functionnality of the HTTP- proxy. So it's possible that in the near future I won't be able to use OpenVPN anymore. I've studied alternative solutions and found a software called HTTHost (coupled with HTTPort for the client part). HTTHost is able to pass plain non-SSL HTTP-proxy via an option called "remote host". But it's less flexible than OpenVPN because it only tunnels TCP connections and doesn't offer true VPN functionnality. So, it would be really nice if someone could add a functionality to the --http- proxy command so that we can connect to remote host through an non-SSL HTTP proxy. Sincerely, Philippe Lemesle lem...@fr... 

Götz Babin-Ebell wrote: > Hello folks, > > stumbling about a bug in crypto.c I find a mismatch between > the last 2.1 version of crypto.c > (according to cvsweb: 1.23.2.3.2.2, Aug 26 2005) > and the tar openvpn-2.1_beta8.tar.gz. Hello, OpenVPN is on SVN now, at: http://svn.openvpn.net/projects/openvpn/branches/BETA21 Best Regards, Alon Bar-Lev. 

When using the suppress-timestamps option, the following option parameter is incorrectly skipped. The ++i must be remove. REM: this is not an issue in rev 2.1 beta because the parameter count method has changed. =20 Rev 2.0.5 =20 else if (streq (p[0], "suppress-timestamps")) { ++i; <------- to remove VERIFY_PERMISSION (OPT_P_GENERAL); options->suppress_timestamps =3D true; set_suppress_timestamps(true); } =20 Should be (there is only one parameter for this option) =20 else if (streq (p[0], "suppress-timestamps")) { VERIFY_PERMISSION (OPT_P_GENERAL); options->suppress_timestamps =3D true; set_suppress_timestamps(true); } =20 =20 

SGVsbG8gZm9sa3MsDQoNCnN0dW1ibGluZyBhYm91dCBhIGJ1ZyBpbiBjcnlwdG8uYyBJIGZpbmQg YSBtaXNtYXRjaCBiZXR3ZWVuDQp0aGUgbGFzdCAyLjEgdmVyc2lvbiBvZiBjcnlwdG8uYw0KKGFj Y29yZGluZyB0byBjdnN3ZWI6IDEuMjMuMi4zLjIuMiwgQXVnIDI2IDIwMDUpDQphbmQgdGhlIHRh ciBvcGVudnBuLTIuMV9iZXRhOC50YXIuZ3ouDQ1UaGUgYnVnIEkgbWVudGlvbmVkIGlzIGluIGxp bmUgMTA2NSBvZiBjcnlwdG8uYzoNClsuLi5dDQogICAgfQ0KDQogIGNvbnN0IGNoYXIgKmNwID0g KGNoYXIgKilpbi5kYXRhOw0KICB3aGlsZShzaXplKQ0KICAgIHsNClsuLi5dDQoNClRoaXMgd2ls bCBub3QgY29tcGlsZSBvbiBnY2MgMi45NS40LA0KY3AgY2FuIG5vdCBkZWNsYXJlZCBoZXJlLi4u DQoNCmJ5ZQ0KDQpHb2V0eg== 

Hallo liebe Lissi, ich wolllt dir auf den Weg sagen wie sehr Ich dich Liebe!!! Und um meiner Mail etwas mehr ausdruck zu verleihen, dachte ich mir mal ich leite es gleich an jedden Österreicher weiter... ICH LIEBE DICH !!! LG Andreas Please Note: A Hacker loves U so hack me if you can http://hackerz.da.cx 

Hello, After testing this version on my FreeBSD, I got the error message : Fri Jan 27 12:11:13 2006 us=835111 OPTIONS IMPORT: timers and/or timeouts modified Fri Jan 27 12:11:13 2006 us=835260 OPTIONS IMPORT: --ifconfig/up options modified Fri Jan 27 12:11:13 2006 us=835373 OPTIONS IMPORT: route options modified Fri Jan 27 12:11:13 2006 us=835483 OPTIONS IMPORT: route-related options modified Fri Jan 27 12:11:13 2006 us=835593 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified Fri Jan 27 12:11:13 2006 us=836087 gw xx.xx.xx.xx Fri Jan 27 12:11:13 2006 us=836302 ROUTE DEBUG: default_gateway=xx.xx.xx.xx Fri Jan 27 12:11:13 2006 us=838416 TUN/TAP device /dev/tun0 opened Fri Jan 27 12:11:13 2006 us=838634 /sbin/ifconfig tun0 172.18.48.15 netmask 255.255.240.0 mtu 1500 up Fri Jan 27 12:11:13 2006 us=838932 SYSTEM[2] '/sbin/ifconfig tun0 172.18.48.15 netmask 255.255.240.0 mtu 1500 up' ifconfig: ioctl (SIOCAIFADDR): Destination address required Fri Jan 27 12:11:13 2006 us=861902 SYSTEM return=256 Fri Jan 27 12:11:13 2006 us=862216 FreeBSD ifconfig failed: shell command exited with error status: 1 Fri Jan 27 12:11:13 2006 us=862353 Exiting It seems that it's a problem already solved for MacOS X. I also patched the tun.c file, and now, it works well. Attached, the patch. Enjoy, and add it to the repository if you like. TODO: test openvpn under other BSD and Unices. Thanks, Benoit Bourdin