Hi Selva,
On 29/06/15 17:59, Selva Nair wrote:
Hi,
Thanks for your comment. Yes I do have tls-auth key 0 in the server
and have completely forgotten why I set it at all (it was a long time
ago..)
> If the server has the parameter set to 1, then all clients need to
have that parameter set to 0, and vice versa.
The description of direction parameter in the manual is lacking as
well. Against --tls-auth it says see --secret for more description of
direction, but --secret is about the non-TLS mode. Nowhere it says
what are the legitimate values for direction or what 1 or 0 means (it
takes values 0 or 1 only, I suppose )
The warning has disappeared after adding the direction parameter to
this "offending" client config --- here is the server and updated
client configs (took the hint ;)
[...]
Glad to hear that helped, your configuration looks OK.
Is the VPN functioning ?
as for the keydir/tls-auth documentation: thanks for bringing this up,
there's an overhaul planned of the OpenVPN man page and this should be
included in this.
The reason that the --tls-auth part refers to --secret is because it
uses the exact same logic: the --tls-auth key is a preshared key used to
protect OpenVPN's TLS control channel , very much like --secret is used
to encrypt all traffic in non-TLS mode.
cheers,
JJK
On Mon, Jun 29, 2015 at 11:05 AM, Jan Just Keijser <[email protected]
<mailto:[email protected]>> wrote:
Hi,
Selva Nair wrote:
Hi,
I have a server running Debian wheezy with openvpn is 2.2.1
(stock version of the distribution).
When version 2.3 clients connect, the server log shows
WARNING: 'keydir' is present in local config but missing in
remote config, local='keydir 1'
What is this keydir option? I don't have it explicitly set in
either the server or any client configs so it appears to be a
default. The only reference to keydir in the man page is
against the description of --opt-verify which states 'keydir'
as one of the options checked for compatibility. It seems
there no description of --keydir itself anywhere in the
manpage (not in 2.2.1, nor in 2.3.2).
Any idea what this option does? On a related note, what is the
recommended way to upgrade to 2.3 on Debian wheezy?
the warning is confusing, to say the least. Most likely your
server config contains something like
tls-auth ta.key 1
whereas your client config either does not contain such a line ,
or it contains
tls-auth ta.key
without any parameter. Read the man page on the 'tls-auth' option
and you'll find that the second parameter can be 0 or 1 and that
it specifies the key direction. If the server has the parameter
set to 1, then all clients need to have that parameter set to 0,
and vice versa.
Of course, without your server and client config files it is
impossible to tell exactly what is happening (yes you can take
that as a hint ;))
HTH,
JJK
------------------------------------------------------------------------------
Don't Limit Your Business. Reach for the Cloud.
GigeNET's Cloud Solutions provide you with the tools and support that
you need to offload your IT needs and focus on growing your business.
Configured For All Businesses. Start Your Cloud Today.
https://www.gigenetcloud.com/
_______________________________________________
Openvpn-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-users
