Re: [Openvpn-users] domain users using openvpn-plugin-auth-pam.so

2016-12-17 Thread Selva Nair
Hi, On Sun, Dec 18, 2016 at 12:06 AM, Jeff Sadowski wrote: > > Thank you this helps. > > I'm using Fedora > I'm guessing the pam_*.so file needs to be with the rest of the pam_*.so > files. > I found the pam_*.so files in /usr/lib/security/ > > I don't see pam_ldap.so I don't see an option to in

[Openvpn-users] redirect-gateway not working

2016-12-17 Thread Muhammad Yousuf Khan
Hello All, I have been using openvpn for years this is a great vpn application. today i tuck in a issue which i never face before. i wanted to redirect all traffic through vpn for a client however it is not working. i place the redirect-gateway def1 in server config and client configs individually

Re: [Openvpn-users] domain users using openvpn-plugin-auth-pam.so

2016-12-17 Thread Jeff Sadowski
On Sat, Dec 17, 2016 at 5:46 PM, Selva Nair wrote: > Hi, > > On Sat, Dec 17, 2016 at 5:57 PM, Jeff Sadowski > wrote: > >> I am able to validate with local users using the following configs. >> However if I try a domain user it fails to authenticate. >> >> The same domain user authenticates with

Re: [Openvpn-users] One client times out, other works fine

2016-12-17 Thread W. Martin Borgert
On 2016-12-18 02:16, W. Martin Borgert wrote: > Hi, Sorry for double-posting. On the first send, mutt crashed... -- Check out the vibrant tech community on one of the world's most engaging tech sites, SlashDot.org! http:

[Openvpn-users] One client times out, other works fine

2016-12-17 Thread W. Martin Borgert
Hi, I have two PCs with the same OpenVPN client configuration. One is running openvpn 2.3.11 (-2, Debian 9) and works fine, the other one has openvpn 2.3.4 (-5+deb8u1, Debian 8) and fails with a timeout. On both machines I use network-manager-openvpn in their respective versions (1.2.6-2 on the "

[Openvpn-users] One client times out while another works fine

2016-12-17 Thread W. Martin Borgert
Hi, I have two PCs with the same OpenVPN client configuration. One is running openvpn 2.3.11 (-2, Debian 9) and works fine, the other one has openvpn 2.3.4 (-5+deb8u1, Debian 8) and fails with a timeout. On both machines I use network-manager-openvpn in their respective versions (1.2.6-2 on the "

Re: [Openvpn-users] domain users using openvpn-plugin-auth-pam.so

2016-12-17 Thread Selva Nair
Hi, On Sat, Dec 17, 2016 at 5:57 PM, Jeff Sadowski wrote: > I am able to validate with local users using the following configs. > However if I try a domain user it fails to authenticate. > > The same domain user authenticates with freeradius. > > Makes sense based on the pam config which uses on

[Openvpn-users] domain users using openvpn-plugin-auth-pam.so

2016-12-17 Thread Jeff Sadowski
I am able to validate with local users using the following configs. However if I try a domain user it fails to authenticate. The same domain user authenticates with freeradius. server.conf -- port 1194 proto udp dev tun topology subnet server 192.168.3.0 255.255.255.0 push

Re: [Openvpn-users] Keywords to look for that may indicate a VPN provider is providing strong encryption/decryption?

2016-12-17 Thread Gert Doering
Hi, On Fri, Dec 16, 2016 at 04:48:16PM +0100, Sebastian Rubenstein wrote: > It seems to me that using the --tls-auth key file is not good for security at > all as an expert had earlier replied that anyone who has the --tls-auth key > file could inject malicious packets. What viable alternatives

Re: [Openvpn-users] Does windows (10) client need admin rights?

2016-12-17 Thread Gert Doering
Moin, On Thu, Dec 15, 2016 at 09:27:38PM -0800, Kevin Long wrote: > Having the OpenVPN GUI require admin privileges to run is certainly not > ideal. Am I missing something or is there a way around this? Install 2.4_rc2 on the clients :-) gert -- USENET is *not* the non-clickable part of WWW!

Re: [Openvpn-users] question about "WARNING: this cipher's block size is less than 128 bit"

2016-12-17 Thread Gert Doering
Hi, On Sat, Dec 17, 2016 at 01:23:53PM +0100, David Sommerseth wrote: > On 17/12/16 11:13, Gert Doering wrote: > > (Main reason we can't stick to BF-CBC is that we use OTP passwords and > > with "reneg-bytes 64M" it's asking way too often for user+password...) > > And to avoid any --reneg-bytes i

Re: [Openvpn-users] question about "WARNING: this cipher's block size is less than 128 bit"

2016-12-17 Thread David Sommerseth
On 17/12/16 11:13, Gert Doering wrote: > > (Main reason we can't stick to BF-CBC is that we use OTP passwords and > with "reneg-bytes 64M" it's asking way too often for user+password...) And to avoid any --reneg-bytes issues, there is the new --auth-gen-token in OpenVPN v2.4, which will help. Th

Re: [Openvpn-users] question about "WARNING: this cipher's block size is less than 128 bit"

2016-12-17 Thread Gert Doering
Hi, some small (but significant!) followup on this discussion... On Tue, Nov 08, 2016 at 12:17:55PM +1300, Jason Haar wrote: [..] > All right, let's get this clear for me and for others :-) > > If I have a 2.4 server, I can set it to "cipher BF-CBC" and keep all the > 2.3 clients happy. Then I c