Public bug reported:

Using "remote-cert-tls server" in a client configuration results in the
following log messages being reported :

Jul  5 15:39:44 simon-laptop openvpn[9228]: ++ Certificate has key usage  00a0, 
expects 00a0
Jul  5 15:39:44 simon-laptop openvpn[9228]: VERIFY KU OK
Jul  5 15:39:44 simon-laptop openvpn[9228]: Validating certificate extended key 
usage
Jul  5 15:39:44 simon-laptop openvpn[9228]: ++ Certificate has EKU (str) TLS 
Web Server Authentication, expects TLS Web Server Authentication
Jul  5 15:39:44 simon-laptop openvpn[9228]: VERIFY EKU OK
Jul  5 15:39:44 simon-laptop openvpn[9228]: VERIFY X509NAME OK: 
/C=*****/[email protected]

Using "remote-cert-tls client" in a server configuration results in
similar log output.  I think this is something that should be ignored
when the key usage matches the expectation. Here is a suggested solution
:

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ 
(openvpn|ovpn-[._[:alnum:]-]+)\[[[:digit:]]+\]:( 
([-_.@[:alnum:]]+/)?[.[:digit:]]{7,15}:[[:digit:]]{2,5})? Validating 
certificate (|extended )key usage$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ 
(openvpn|ovpn-[._[:alnum:]-]+)\[[[:digit:]]+\]:( 
([-_.@[:alnum:]]+/)?[.[:digit:]]{7,15}:[[:digit:]]{2,5})? \+\+ Certificate has 
key usage  ([0-9a-f]{4}), expects \4$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ 
(openvpn|ovpn-[._[:alnum:]-]+)\[[[:digit:]]+\]:( 
([-_.@[:alnum:]]+/)?[.[:digit:]]{7,15}:[[:digit:]]{2,5})? \+\+ Certificate has 
EKU \(str\) TLS Web (Client|Server) Authentication, expects TLS Web \4 
Authentication$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ 
(openvpn|ovpn-[._[:alnum:]-]+)\[[[:digit:]]+\]:( 
([-_.@[:alnum:]]+/)?[.[:digit:]]{7,15}:[[:digit:]]{2,5})? VERIFY (|E)KU OK$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ 
(openvpn|ovpn-[._[:alnum:]-]+)\[[[:digit:]]+\]:( 
([-_.@[:alnum:]]+/)?[.[:digit:]]{7,15}:[[:digit:]]{2,5})? VERIFY X509NAME OK: 
.+$

Those rules should be added to /etc/logcheck/ignore.d.server/openvpn

$ lsb_release -rd
Description:    Ubuntu 11.04
Release:        11.04

$ apt-cache policy logcheck-database
logcheck-database:
  Installed: 1.3.13
  Candidate: 1.3.13
  Version table:
 *** 1.3.13 0
        500 http://ca.archive.ubuntu.com/ubuntu/ natty/main amd64 Packages
        100 /var/lib/dpkg/status

ProblemType: Bug
DistroRelease: Ubuntu 11.04
Package: logcheck-database 1.3.13
ProcVersionSignature: Ubuntu 2.6.38-10.46-generic 2.6.38.7
Uname: Linux 2.6.38-10-generic x86_64
Architecture: amd64
Date: Wed Jul  6 08:34:38 2011
Dependencies:
 
PackageArchitecture: all
ProcEnviron:
 LANGUAGE=en_US:en
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: logcheck
UpgradeStatus: No upgrade log present (probably fresh install)

** Affects: logcheck (Ubuntu)
     Importance: Undecided
         Status: New


** Tags: apport-bug natty

** Tags removed: amd64

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/806537

Title:
  OpenVPN ignore rules should silence certificate validation messages

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/logcheck/+bug/806537/+subscriptions

-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to