Document ">PASSWORD:Auth-Token" real-time message
PATCH 1/1 Document ">PASSWORD:Auth-Token" real-time message
From: Simon Rozman <[email protected]...>
Authentication tokens are security enhancement eliminating client need to cache passwords, and are indispensable at two factor authentication methods, such as HOTP or TOTP.
The ">PASSWORD:Auth-Token" message was not mentioned anywhere in the OpenVPN Management Interface Notes. This patch adds a simple use case example, while the more detailed feature description remains explained in the OpenVPN manual.
--- doc/management-notes.txt | 7 +++++++ 1 file changed, 7 insertions(+)
doc/management-notes.txt +7 -0
@@ -317,6 +317,13 @@ COMMAND -- password and username >PASSWORD:Verification Failed: 'custom server-generated string' + Example 6: If server pushes --auth-token to the client, the OpenVPN + will produce a real-time PASSWORD message: + + >PASSWORD:Auth-Token:foobar + + The client should replace the local password with the "foobar". + COMMAND -- forget-passwords ---------------------------
Signature · 1 line
2.9.0.windows.1
Hi Simon,
Really great to see all your patches! Thanks a lot!
Quoted 19 lines · On 11/10/17 15:45, [email protected]... wrote:
From: Simon Rozman <[email protected]...>
Authentication tokens are security enhancement eliminating client need to cache passwords, and are indispensable at two factor authentication methods, such as HOTP or TOTP.
The ">PASSWORD:Auth-Token" message was not mentioned anywhere in the OpenVPN Management Interface Notes. This patch adds a simple use case example, while the more detailed feature description remains explained in the OpenVPN manual.
--- doc/management-notes.txt | 7 +++++++ 1 file changed, 7 insertions(+)doc/management-notes.txt +0
-0
doc/management-notes.txt COMMAND -- password and username · line 326
Quoted 10 lines
doc/management-notes.txt +7
-0@@ -317,6 +317,13 @@ COMMAND -- password and username >PASSWORD:Verification Failed: 'custom server-generated string' + Example 6: If server pushes --auth-token to the client, the OpenVPN + will produce a real-time PASSWORD message: + + >PASSWORD:Auth-Token:foobar + + The client should replace the local password with the "foobar". +
This area is part of the code I've been involved with fairly recently.
You are not incorrect, and this was the behaviour until we released OpenVPN 2.4.4. As of v2.4.4, the >PASSWORD: line will be sent to the management interface, but the code which implements usage of the management interface can basically ignore it. The caching of the token is now handled properly by the OpenVPN core, also if you are using --auth-nocache in the client config.
(Quick remark, it seems we did not fix this issue in v2.3 at all, it only have a partial fix but is lacking a backport of commit 3322c558fa7)
We might actually consider to remove the >PASSWORD: response in the future.
I can give this patch an ACK if we just remove the line about "replacing the local password". For me, that can be done on-the-fly on commit time in this case.
Signature · 4 lines
kind regards, David Sommerseth OpenVPN, Inc
Hi,
Quoted 1 line
Really great to see all your patches! Thanks a lot!
I have a strong motivation for it, as I am planning some future changes for openvpnserv.exe. It would help me to keep in sync with official OpenVPN source base if the majority of base issues MSVC has with OpenVPN sources is resolved first.
Or perhaps the change I am planning for openvpnserv.exe is aligned with OpenVPN dev team and it might get integrated once. But that's a discussion for a separate thread.
Quoted 8 lines
This area is part of the code I've been involved with fairly recently.
You are not incorrect, and this was the behaviour until we released OpenVPN 2.4.4. As of v2.4.4, the >PASSWORD: line will be sent to the management interface, but the code which implements usage of the management interface can basically ignore it. The caching of the token is now handled properly by the OpenVPN core, also if you are using --auth-nocache in the client config.
Thank you for notifying me of this. I haven't had time to test eduVPN Client (which currently does handle ">PASSWORD:Auth-Token" messages) with 2.4.4 yet.
Quoted 3 lines
I can give this patch an ACK if we just remove the line about "replacing the local password". For me, that can be done on-the-fly on commit time in this case.
Yes, please.
Best regards,
Simon
[Openvpn-devel] [PATCH applied] Re: Document
In reply to [email protected]...Applied with the change proposed by David (removing the last sentence).
Thanks.
Your patch has been applied to the master and release/2.4 branch.
commit a294cd65f6c61d41e1b7584b07295aba73aeb4cb (master) commit a255c3b2a77b282fcf1a8cba9d7ec34d48bfd0ed (release/2.4)
Author: Simon Rozman Date: Wed Oct 11 15:45:30 2017 +0200
Document
Acked-by: David Sommerseth <[email protected]...>
Message-Id: <[email protected]...>
URL: https://www.mail-archive.com/[email protected]/msg15599.html
Signed-off-by: Gert Doering <[email protected]...>--
kind regards,
Gert Doering