openvpn-devel Mailing List for OpenVPN

Hi, On Wed, Jul 25, 2012 at 01:57:20PM +0800, jay alco wrote: > Hi, i build openvpn from source with the following featured disabled SSL, > CRYPTO. I have successfully build openpn without this option but during the > test running the server configuration it gives me error > > Options error: Unrecognized option or missing parameter(s) in > config.ovpn:6: client-cert-not-required (2.2.2) If you build without SSL, none of the SSL-related options are compiled in (surprise!). [..] > It looks like all options under P2MP and P2MP_SERVER are disable when i > disable SSL, CRYPTO. and for that i can not use client-cert-not-required, > username-as-common-name, server X X, etc.. and cannot run the server. How > do i eneable P2MP and P2MP_SERVER during build? P2MP_SERVER requires SSL to operate - if you disable SSL, there is no way you can use the OpenVPN server functionality. All you can do is use OpenVPN in point-to-point mode. gert -- USENET is *not* the non-clickable part of WWW! //www.muc.de/~gert/ Gert Doering - Munich, Germany ge...@gr... fax: +49-89-35655025 ge...@ne... 

On Wednesday 25 July 2012 11:39:16 Samuli Seppänen wrote: > This release fixes a major problem in "tap server" mode (Trac #216), > adds support for querying proxy information via the management interface > and fixes some smaller issues. In addition, the Windows installer comes > with tap-windows-9.9.2 (fixes the "DHCP NAK bomb on Windows 7" bug, Trac > #97) and openvpn-gui-1.0.5. I also want to mention that the GUI is now correctly supplying the HTTPS and SOCKS proxy server system settings to openvpn. The info is queried from the control panel internet settings. If WPAD or a PAC file are configured there, it uses automatic proxy detection as well. I would like to ask people to give this a try and report any shortcomings back to the -devel list. Thanks, Heiko -- Heiko Hund | Sr. Software Engineer | Tel +49-721-25516-237 | Fax -200 SOPHOS NSG | Amalienbadstr. 41 Bau 52 | 76227 Karlsruhe | Germany 

Hi Jay, > I'm trying to build openvpn on windows with mingw but having trouble. > I tried building both openvpn 2.1.4 and 2.2.2 from source without > changing configuration, just executing domake-win and it builds the > exe perfectly. But when i change configurations in makeopenvpn file i > cause me the error. > > I use the following configuration to guild without crypto and ssl. just lzo. > > --enable-strict \ > --prefix=$H/windest \ > MAN2HTML=true \ > --disable-crypto \ > --disable-ssl \ > --enable-password-save \ > --with-lzo-headers=$H/$LZO_DIR/include \ > --with-lzo-lib=$H/$LZO_DIR \ > --with-pkcs11-helper-headers=$H/$PKCS11_HELPER_DIR/usr/local/include \ > --with-pkcs11-helper-lib=$H/$PKCS11_HELPER_DIR/usr/local/lib > > but it produce the following error both 2.1.4 and 2.2.2. Trust me, trying to build 2.1.4 for Windows is (as Gert said) a way to insanity. If you really have to use a s.c. "stable" version of OpenVPN, I suggest 2.2.2 which at least has a more or less complete Python-based buildsystem which is documented here: <https://community.openvpn.net/openvpn/wiki/BuildingOnWindows> However, I'd recommend taking the just released openvpn-2.3-alpha3 and using the new "openvpn-build" buildsystem to build it: <https://github.com/OpenVPN/openvpn-build> <https://community.openvpn.net/openvpn/wiki/BuildingUsingGenericBuildsystem> If you want to try building on a Windows using Microsoft Visual Studio 2010 or later, "openvpn-build" has a separate "msvc" buildsystem for that purpose. The "generic" buildsystem, which is a cross-compile buildsystem for *NIX environments, is more well tested, and works very nicely. Ubuntu 12.04 64-bit is a good build platform, provided you install backported mingw-w64 packages: <https://community.openvpn.net/openvpn/wiki/InstallingMingwW64> Hope this helps, -- Samuli Seppänen Community Manager OpenVPN Technologies, Inc irc freenode net: mattock 

The OpenVPN community project team is proud to release OpenVPN 2.3_alpha3. It can be downloaded from here: <http://openvpn.net/index.php/open-source/downloads.html> This release fixes a major problem in "tap server" mode (Trac #216), adds support for querying proxy information via the management interface and fixes some smaller issues. In addition, the Windows installer comes with tap-windows-9.9.2 (fixes the "DHCP NAK bomb on Windows 7" bug, Trac #97) and openvpn-gui-1.0.5. A full list of new features and the changelog are available here: <https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23> The changelog is also attached to this email. For generic help use these support channels: - Official documentation: <http://openvpn.net/index.php/open-source/documentation/howto.html> - Wiki: <https://community.openvpn.net> - Forums: <https://forums.openvpn.net> - User mailing list: <http://sourceforge.net/mail/?group_id=48978> - User IRC channel: #openvpn at irc.freenode.net Please report bugs and ask development questions here: - Bug tracker and Wiki: <https://community.openvpn.net> - Developer mailing list: <http://sourceforge.net/mail/?group_id=48978> - Developer IRC channel: #openvpn-devel at irc.freenode.net (requires Freenode registration) -- Samuli Seppänen Community Manager OpenVPN Technologies, Inc irc freenode net: mattock 

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 25/07/12 07:57, jay alco wrote: [...snip...] > It looks like all options under P2MP and P2MP_SERVER are disable > when i disable SSL, CRYPTO. and for that i can not use > client-cert-not-required, username-as-common-name, server X X, > etc.. and cannot run the server. How do i eneable P2MP and > P2MP_SERVER during build? OpenVPN does not support P2MP mode without PKI (certificates/keys). So what you're trying to do is not possible. And even though you want to use --client-cert-not-required, the server-side would still need both a key and a certificate. And the client would still need the CA certificate which issued the server certificate. In addition common name is used in the code paths which are related to X509 verifications. These code paths are also disabled when SSL/CRYPTO features are disabled. Which again would remove the - --username-as-common-name feature. Compiling without SSL/CRYPTO will only make it possible to use P2P mode, which means you need a single OpenVPN process using a dedicated port for each client. Further, if you want to use --secret instead of SSL/TLS certificates, that would be really a weak solution in a P2MP setup, as all clients would be able to decrypt the traffic from all other clients. Using SSL/TLS certificates, each client have an individual encryption so it would be much harder for other clients to eavesdrop other connected clients communication. kind regards, David Sommerseth -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAlAPqeEACgkQDC186MBRfro0DgCgg2eckszK19J/6WFzj4zajQmn 3GMAn2KfoqiYWdJ/ygTV8GW21apBLOkA =vsQE -----END PGP SIGNATURE----- 

Hi, i build openvpn from source with the following featured disabled SSL, CRYPTO. I have successfully build openpn without this option but during the test running the server configuration it gives me error Options error: Unrecognized option or missing parameter(s) in config.ovpn:6: client-cert-not-required (2.2.2) i user the following options. local xxx.xxx.xxx.xxx port 800 proto tcp dev tun client-cert-not-required script-security 2 username-as-common-name plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so /etc/pam.d/login server 10.10.0.0 255.255.255.0 persist-key persist-tun It looks like all options under P2MP and P2MP_SERVER are disable when i disable SSL, CRYPTO. and for that i can not use client-cert-not-required, username-as-common-name, server X X, etc.. and cannot run the server. How do i eneable P2MP and P2MP_SERVER during build?