pool/ocserv
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
4b0b45f791
ocserv/ocserv.config.patch

137 lines
4.5 KiB
Diff
Raw Normal View History

Accepting request 853618 from home:mnhauke:network - Update to version 1.1.2 * Allow setup of new DTLS session concurrent with old session. * Fixed an infinite loop on sec-mod crash when server-drain-ms is set. * Don't apply BanIP checks to clients on the same subnet. * Don't attempt TLS if the client closes the connection with zero data sent. * Increased the maximum configuration line; this allows banner messages longer than 200 characters. * Removed the listen-clear-file config option. This option was incompatible with several clients, and thus is unusable for a generic server. - Update to version 1.1.1: * Improved rate-limit-ms and made it dependent on secmod backlog. This makes the server more resilient (and prevents connection failures) on multiple concurrent connections - Added namespace support for listen address by introducing the listen-netns option. - Disable TLS1.3 when cisco client compatibility is enabled. New anyconnect clients seem to supporting TLS1.3 but are unable to handle a client with an RSA key. - Enable a race free user disconnection via occtl. - Added the config option of a pre-login-banner. - Ocserv siwtched to using multiple ocserv-sm processes to improve scale, with the number of ocserv-sm process dependent on maximum clients and number of CPUs. Configuration option sec-mod-scale can be used to override the heuristics. - Fixed issue with group selection on radius servers sending multiple group class attribute. OBS-URL: https://build.opensuse.org/request/show/853618 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=37
2021-01-02 22:13:41 +01:00
diff --git a/doc/sample.config b/doc/sample.config
index 6a677c9..1cd1d96 100644
--- a/doc/sample.config
+++ b/doc/sample.config
Accepting request 606481 from home:stawidy:branches:network:vpn - Update to version 0.12.0 * Allow DTLS stream to come from different IP from TLS stream. There are situations where internet providers send the UDP stream from different IP. * Increased possibilities of allowed combinations of authentication methods. * Corrected regression since 0.11.8 with OTP authentication. * Added support for hostname-based virtual hosts, utilizing TLS SNI. With that change it is possible to configure multiple servers running over the same port. * Rename the tun device on BSD systems which support SIOCSIFNAME ioctl. * Correctly handle proxy-protocol’s health commands. That eliminates few connection drops when proxy protocol is in use. * Corrected crash on certain cases when proxy protocol is in use. - Update ocserv.config.patch due to upstream changes OBS-URL: https://build.opensuse.org/request/show/606481 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=18
2018-05-13 03:22:59 +02:00
@@ -48,7 +48,7 @@
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
#auth = "pam"
#auth = "pam[gid-min=1000]"
Accepting request 340259 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/340259 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=3
2015-10-21 15:26:19 +02:00
#auth = "plain[passwd=./sample.passwd,otp=./sample.otp]"
Accepting request 314133 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/314133 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=2
2015-06-28 07:23:02 +02:00
-auth = "plain[passwd=./sample.passwd]"
+auth = "plain[passwd=/etc/ocserv/ocpasswd]"
#auth = "certificate"
#auth = "radius[config=/etc/radiusclient/radiusclient.conf,groupconfig=true]"
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
Accepting request 853618 from home:mnhauke:network - Update to version 1.1.2 * Allow setup of new DTLS session concurrent with old session. * Fixed an infinite loop on sec-mod crash when server-drain-ms is set. * Don't apply BanIP checks to clients on the same subnet. * Don't attempt TLS if the client closes the connection with zero data sent. * Increased the maximum configuration line; this allows banner messages longer than 200 characters. * Removed the listen-clear-file config option. This option was incompatible with several clients, and thus is unusable for a generic server. - Update to version 1.1.1: * Improved rate-limit-ms and made it dependent on secmod backlog. This makes the server more resilient (and prevents connection failures) on multiple concurrent connections - Added namespace support for listen address by introducing the listen-netns option. - Disable TLS1.3 when cisco client compatibility is enabled. New anyconnect clients seem to supporting TLS1.3 but are unable to handle a client with an RSA key. - Enable a race free user disconnection via occtl. - Added the config option of a pre-login-banner. - Ocserv siwtched to using multiple ocserv-sm processes to improve scale, with the number of ocserv-sm process dependent on maximum clients and number of CPUs. Configuration option sec-mod-scale can be used to override the heuristics. - Fixed issue with group selection on radius servers sending multiple group class attribute. OBS-URL: https://build.opensuse.org/request/show/853618 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=37
2021-01-02 22:13:41 +01:00
@@ -90,8 +90,8 @@ auth = "plain[passwd=./sample.passwd]"
# listen-netns = "foo"
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
# TCP and UDP port number
-tcp-port = 443
-udp-port = 443
+tcp-port = 9000
+udp-port = 9001
Accepting request 853618 from home:mnhauke:network - Update to version 1.1.2 * Allow setup of new DTLS session concurrent with old session. * Fixed an infinite loop on sec-mod crash when server-drain-ms is set. * Don't apply BanIP checks to clients on the same subnet. * Don't attempt TLS if the client closes the connection with zero data sent. * Increased the maximum configuration line; this allows banner messages longer than 200 characters. * Removed the listen-clear-file config option. This option was incompatible with several clients, and thus is unusable for a generic server. - Update to version 1.1.1: * Improved rate-limit-ms and made it dependent on secmod backlog. This makes the server more resilient (and prevents connection failures) on multiple concurrent connections - Added namespace support for listen address by introducing the listen-netns option. - Disable TLS1.3 when cisco client compatibility is enabled. New anyconnect clients seem to supporting TLS1.3 but are unable to handle a client with an RSA key. - Enable a race free user disconnection via occtl. - Added the config option of a pre-login-banner. - Ocserv siwtched to using multiple ocserv-sm processes to improve scale, with the number of ocserv-sm process dependent on maximum clients and number of CPUs. Configuration option sec-mod-scale can be used to override the heuristics. - Fixed issue with group selection on radius servers sending multiple group class attribute. OBS-URL: https://build.opensuse.org/request/show/853618 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=37
2021-01-02 22:13:41 +01:00
# The user the worker processes will be run as. This should be a dedicated
# unprivileged user (e.g., 'ocserv') and no other services should run as this
@@ -126,8 +126,8 @@ socket-file = /var/run/ocserv-socket
Accepting request 606481 from home:stawidy:branches:network:vpn - Update to version 0.12.0 * Allow DTLS stream to come from different IP from TLS stream. There are situations where internet providers send the UDP stream from different IP. * Increased possibilities of allowed combinations of authentication methods. * Corrected regression since 0.11.8 with OTP authentication. * Added support for hostname-based virtual hosts, utilizing TLS SNI. With that change it is possible to configure multiple servers running over the same port. * Rename the tun device on BSD systems which support SIOCSIFNAME ioctl. * Correctly handle proxy-protocol’s health commands. That eliminates few connection drops when proxy protocol is in use. * Corrected crash on certain cases when proxy protocol is in use. - Update ocserv.config.patch due to upstream changes OBS-URL: https://build.opensuse.org/request/show/606481 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=18
2018-05-13 03:22:59 +02:00
#server-cert = /etc/ocserv/server-cert.pem
#server-key = /etc/ocserv/server-key.pem
Accepting request 447315 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/447315 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=7
2016-12-21 16:24:26 +01:00
-server-cert = ../tests/certs/server-cert.pem
-server-key = ../tests/certs/server-key.pem
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
+server-cert = /etc/ocserv/certificates/server-cert.pem
+server-key = /etc/ocserv/certificates/server-key.pem
Accepting request 606481 from home:stawidy:branches:network:vpn - Update to version 0.12.0 * Allow DTLS stream to come from different IP from TLS stream. There are situations where internet providers send the UDP stream from different IP. * Increased possibilities of allowed combinations of authentication methods. * Corrected regression since 0.11.8 with OTP authentication. * Added support for hostname-based virtual hosts, utilizing TLS SNI. With that change it is possible to configure multiple servers running over the same port. * Rename the tun device on BSD systems which support SIOCSIFNAME ioctl. * Correctly handle proxy-protocol’s health commands. That eliminates few connection drops when proxy protocol is in use. * Corrected crash on certain cases when proxy protocol is in use. - Update ocserv.config.patch due to upstream changes OBS-URL: https://build.opensuse.org/request/show/606481 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=18
2018-05-13 03:22:59 +02:00
# Diffie-Hellman parameters. Only needed if for old (pre 3.6.0
# versions of GnuTLS for supporting DHE ciphersuites.
Accepting request 853618 from home:mnhauke:network - Update to version 1.1.2 * Allow setup of new DTLS session concurrent with old session. * Fixed an infinite loop on sec-mod crash when server-drain-ms is set. * Don't apply BanIP checks to clients on the same subnet. * Don't attempt TLS if the client closes the connection with zero data sent. * Increased the maximum configuration line; this allows banner messages longer than 200 characters. * Removed the listen-clear-file config option. This option was incompatible with several clients, and thus is unusable for a generic server. - Update to version 1.1.1: * Improved rate-limit-ms and made it dependent on secmod backlog. This makes the server more resilient (and prevents connection failures) on multiple concurrent connections - Added namespace support for listen address by introducing the listen-netns option. - Disable TLS1.3 when cisco client compatibility is enabled. New anyconnect clients seem to supporting TLS1.3 but are unable to handle a client with an RSA key. - Enable a race free user disconnection via occtl. - Added the config option of a pre-login-banner. - Ocserv siwtched to using multiple ocserv-sm processes to improve scale, with the number of ocserv-sm process dependent on maximum clients and number of CPUs. Configuration option sec-mod-scale can be used to override the heuristics. - Fixed issue with group selection on radius servers sending multiple group class attribute. OBS-URL: https://build.opensuse.org/request/show/853618 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=37
2021-01-02 22:13:41 +01:00
@@ -154,7 +154,7 @@ server-key = ../tests/certs/server-key.pem
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
# client certificates (public keys) if certificate authentication
# is set.
Accepting request 606481 from home:stawidy:branches:network:vpn - Update to version 0.12.0 * Allow DTLS stream to come from different IP from TLS stream. There are situations where internet providers send the UDP stream from different IP. * Increased possibilities of allowed combinations of authentication methods. * Corrected regression since 0.11.8 with OTP authentication. * Added support for hostname-based virtual hosts, utilizing TLS SNI. With that change it is possible to configure multiple servers running over the same port. * Rename the tun device on BSD systems which support SIOCSIFNAME ioctl. * Correctly handle proxy-protocol’s health commands. That eliminates few connection drops when proxy protocol is in use. * Corrected crash on certain cases when proxy protocol is in use. - Update ocserv.config.patch due to upstream changes OBS-URL: https://build.opensuse.org/request/show/606481 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=18
2018-05-13 03:22:59 +02:00
#ca-cert = /etc/ocserv/ca.pem
Accepting request 447315 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/447315 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=7
2016-12-21 16:24:26 +01:00
-ca-cert = ../tests/certs/ca.pem
Accepting request 314133 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/314133 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=2
2015-06-28 07:23:02 +02:00
+ca-cert = /etc/ocserv/certificates/ca-cert.pem
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
Accepting request 340259 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/340259 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=3
2015-10-21 15:26:19 +02:00
### All configuration options below this line are reloaded on a SIGHUP.
Accepting request 853618 from home:mnhauke:network - Update to version 1.1.2 * Allow setup of new DTLS session concurrent with old session. * Fixed an infinite loop on sec-mod crash when server-drain-ms is set. * Don't apply BanIP checks to clients on the same subnet. * Don't attempt TLS if the client closes the connection with zero data sent. * Increased the maximum configuration line; this allows banner messages longer than 200 characters. * Removed the listen-clear-file config option. This option was incompatible with several clients, and thus is unusable for a generic server. - Update to version 1.1.1: * Improved rate-limit-ms and made it dependent on secmod backlog. This makes the server more resilient (and prevents connection failures) on multiple concurrent connections - Added namespace support for listen address by introducing the listen-netns option. - Disable TLS1.3 when cisco client compatibility is enabled. New anyconnect clients seem to supporting TLS1.3 but are unable to handle a client with an RSA key. - Enable a race free user disconnection via occtl. - Added the config option of a pre-login-banner. - Ocserv siwtched to using multiple ocserv-sm processes to improve scale, with the number of ocserv-sm process dependent on maximum clients and number of CPUs. Configuration option sec-mod-scale can be used to override the heuristics. - Fixed issue with group selection on radius servers sending multiple group class attribute. OBS-URL: https://build.opensuse.org/request/show/853618 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=37
2021-01-02 22:13:41 +01:00
@@ -174,7 +174,7 @@ ca-cert = ../tests/certs/ca.pem
Accepting request 447315 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/447315 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=7
2016-12-21 16:24:26 +01:00
# the isolation was tested at. If you get random failures on worker processes, try
# disabling that option and report the failures you, along with system and debugging
# information at: https://gitlab.com/ocserv/ocserv/issues
Accepting request 340259 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/340259 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=3
2015-10-21 15:26:19 +02:00
-isolate-workers = true
+isolate-workers = false
Accepting request 853618 from home:mnhauke:network - Update to version 1.1.2 * Allow setup of new DTLS session concurrent with old session. * Fixed an infinite loop on sec-mod crash when server-drain-ms is set. * Don't apply BanIP checks to clients on the same subnet. * Don't attempt TLS if the client closes the connection with zero data sent. * Increased the maximum configuration line; this allows banner messages longer than 200 characters. * Removed the listen-clear-file config option. This option was incompatible with several clients, and thus is unusable for a generic server. - Update to version 1.1.1: * Improved rate-limit-ms and made it dependent on secmod backlog. This makes the server more resilient (and prevents connection failures) on multiple concurrent connections - Added namespace support for listen address by introducing the listen-netns option. - Disable TLS1.3 when cisco client compatibility is enabled. New anyconnect clients seem to supporting TLS1.3 but are unable to handle a client with an RSA key. - Enable a race free user disconnection via occtl. - Added the config option of a pre-login-banner. - Ocserv siwtched to using multiple ocserv-sm processes to improve scale, with the number of ocserv-sm process dependent on maximum clients and number of CPUs. Configuration option sec-mod-scale can be used to override the heuristics. - Fixed issue with group selection on radius servers sending multiple group class attribute. OBS-URL: https://build.opensuse.org/request/show/853618 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=37
2021-01-02 22:13:41 +01:00
# A banner to be displayed on clients after connection
Accepting request 340259 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/340259 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=3
2015-10-21 15:26:19 +02:00
#banner = "Welcome"
Accepting request 853618 from home:mnhauke:network - Update to version 1.1.2 * Allow setup of new DTLS session concurrent with old session. * Fixed an infinite loop on sec-mod crash when server-drain-ms is set. * Don't apply BanIP checks to clients on the same subnet. * Don't attempt TLS if the client closes the connection with zero data sent. * Increased the maximum configuration line; this allows banner messages longer than 200 characters. * Removed the listen-clear-file config option. This option was incompatible with several clients, and thus is unusable for a generic server. - Update to version 1.1.1: * Improved rate-limit-ms and made it dependent on secmod backlog. This makes the server more resilient (and prevents connection failures) on multiple concurrent connections - Added namespace support for listen address by introducing the listen-netns option. - Disable TLS1.3 when cisco client compatibility is enabled. New anyconnect clients seem to supporting TLS1.3 but are unable to handle a client with an RSA key. - Enable a race free user disconnection via occtl. - Added the config option of a pre-login-banner. - Ocserv siwtched to using multiple ocserv-sm processes to improve scale, with the number of ocserv-sm process dependent on maximum clients and number of CPUs. Configuration option sec-mod-scale can be used to override the heuristics. - Fixed issue with group selection on radius servers sending multiple group class attribute. OBS-URL: https://build.opensuse.org/request/show/853618 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=37
2021-01-02 22:13:41 +01:00
@@ -242,7 +242,7 @@ mobile-dpd = 1800
Accepting request 580000 from home:MargueriteSu:branches:network:vpn - update version 0.11.10 * see NEWS - drop boo1021353-ocserv-doc-racing-in-parallel-build.patch * upstreamed - add ocserv-LZ4_compress_default.patch * leap doesn't have LZ4_compress_default OBS-URL: https://build.opensuse.org/request/show/580000 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=13
2018-02-26 03:10:00 +01:00
switch-to-tcp-timeout = 25
Accepting request 340259 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/340259 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=3
2015-10-21 15:26:19 +02:00
# MTU discovery (DPD must be enabled)
-try-mtu-discovery = false
+try-mtu-discovery = true
Accepting request 853618 from home:mnhauke:network - Update to version 1.1.2 * Allow setup of new DTLS session concurrent with old session. * Fixed an infinite loop on sec-mod crash when server-drain-ms is set. * Don't apply BanIP checks to clients on the same subnet. * Don't attempt TLS if the client closes the connection with zero data sent. * Increased the maximum configuration line; this allows banner messages longer than 200 characters. * Removed the listen-clear-file config option. This option was incompatible with several clients, and thus is unusable for a generic server. - Update to version 1.1.1: * Improved rate-limit-ms and made it dependent on secmod backlog. This makes the server more resilient (and prevents connection failures) on multiple concurrent connections - Added namespace support for listen address by introducing the listen-netns option. - Disable TLS1.3 when cisco client compatibility is enabled. New anyconnect clients seem to supporting TLS1.3 but are unable to handle a client with an RSA key. - Enable a race free user disconnection via occtl. - Added the config option of a pre-login-banner. - Ocserv siwtched to using multiple ocserv-sm processes to improve scale, with the number of ocserv-sm process dependent on maximum clients and number of CPUs. Configuration option sec-mod-scale can be used to override the heuristics. - Fixed issue with group selection on radius servers sending multiple group class attribute. OBS-URL: https://build.opensuse.org/request/show/853618 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=37
2021-01-02 22:13:41 +01:00
# To enable load-balancer connection draining, set server-drain-ms to a value
# higher than your load-balancer health probe interval.
@@ -412,8 +412,8 @@ rekey-method = ssl
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
# STATS_BYTES_OUT, STATS_DURATION that contain a 64-bit counter of the bytes
# output from the tun device, and the duration of the session in seconds.
-#connect-script = /usr/bin/myscript
-#disconnect-script = /usr/bin/myscript
+#connect-script = /usr/bin/ocserv-script
+#disconnect-script = /usr/bin/ocserv-script
Accepting request 853618 from home:mnhauke:network - Update to version 1.1.2 * Allow setup of new DTLS session concurrent with old session. * Fixed an infinite loop on sec-mod crash when server-drain-ms is set. * Don't apply BanIP checks to clients on the same subnet. * Don't attempt TLS if the client closes the connection with zero data sent. * Increased the maximum configuration line; this allows banner messages longer than 200 characters. * Removed the listen-clear-file config option. This option was incompatible with several clients, and thus is unusable for a generic server. - Update to version 1.1.1: * Improved rate-limit-ms and made it dependent on secmod backlog. This makes the server more resilient (and prevents connection failures) on multiple concurrent connections - Added namespace support for listen address by introducing the listen-netns option. - Disable TLS1.3 when cisco client compatibility is enabled. New anyconnect clients seem to supporting TLS1.3 but are unable to handle a client with an RSA key. - Enable a race free user disconnection via occtl. - Added the config option of a pre-login-banner. - Ocserv siwtched to using multiple ocserv-sm processes to improve scale, with the number of ocserv-sm process dependent on maximum clients and number of CPUs. Configuration option sec-mod-scale can be used to override the heuristics. - Fixed issue with group selection on radius servers sending multiple group class attribute. OBS-URL: https://build.opensuse.org/request/show/853618 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=37
2021-01-02 22:13:41 +01:00
# This script is to be called when the client's advertised hostname becomes
# available. It will contain REASON with "host-update" value and the
@@ -491,7 +491,8 @@ ipv4-netmask = 255.255.255.0
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
# The advertized DNS server. Use multiple lines for
# multiple servers.
# dns = fc00::4be0
-dns = 192.168.1.2
+dns = 8.8.8.8
Accepting request 447315 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/447315 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=7
2016-12-21 16:24:26 +01:00
+dns = 8.8.4.4
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
# The NBNS server (if any)
#nbns = 192.168.1.3
Accepting request 853618 from home:mnhauke:network - Update to version 1.1.2 * Allow setup of new DTLS session concurrent with old session. * Fixed an infinite loop on sec-mod crash when server-drain-ms is set. * Don't apply BanIP checks to clients on the same subnet. * Don't attempt TLS if the client closes the connection with zero data sent. * Increased the maximum configuration line; this allows banner messages longer than 200 characters. * Removed the listen-clear-file config option. This option was incompatible with several clients, and thus is unusable for a generic server. - Update to version 1.1.1: * Improved rate-limit-ms and made it dependent on secmod backlog. This makes the server more resilient (and prevents connection failures) on multiple concurrent connections - Added namespace support for listen address by introducing the listen-netns option. - Disable TLS1.3 when cisco client compatibility is enabled. New anyconnect clients seem to supporting TLS1.3 but are unable to handle a client with an RSA key. - Enable a race free user disconnection via occtl. - Added the config option of a pre-login-banner. - Ocserv siwtched to using multiple ocserv-sm processes to improve scale, with the number of ocserv-sm process dependent on maximum clients and number of CPUs. Configuration option sec-mod-scale can be used to override the heuristics. - Fixed issue with group selection on radius servers sending multiple group class attribute. OBS-URL: https://build.opensuse.org/request/show/853618 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=37
2021-01-02 22:13:41 +01:00
@@ -530,8 +531,8 @@ ping-leases = false
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
# comment out all routes from the server, or use the special keyword
# 'default'.
Accepting request 314133 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/314133 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=2
2015-06-28 07:23:02 +02:00
-route = 10.10.10.0/255.255.255.0
-route = 192.168.0.0/255.255.0.0
+#route = 10.10.10.0/255.255.255.0
+#route = 192.168.0.0/255.255.0.0
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
#route = fef4:db8:1000:1001::/64
Accepting request 447315 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/447315 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=7
2016-12-21 16:24:26 +01:00
#route = default
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
Accepting request 853618 from home:mnhauke:network - Update to version 1.1.2 * Allow setup of new DTLS session concurrent with old session. * Fixed an infinite loop on sec-mod crash when server-drain-ms is set. * Don't apply BanIP checks to clients on the same subnet. * Don't attempt TLS if the client closes the connection with zero data sent. * Increased the maximum configuration line; this allows banner messages longer than 200 characters. * Removed the listen-clear-file config option. This option was incompatible with several clients, and thus is unusable for a generic server. - Update to version 1.1.1: * Improved rate-limit-ms and made it dependent on secmod backlog. This makes the server more resilient (and prevents connection failures) on multiple concurrent connections - Added namespace support for listen address by introducing the listen-netns option. - Disable TLS1.3 when cisco client compatibility is enabled. New anyconnect clients seem to supporting TLS1.3 but are unable to handle a client with an RSA key. - Enable a race free user disconnection via occtl. - Added the config option of a pre-login-banner. - Ocserv siwtched to using multiple ocserv-sm processes to improve scale, with the number of ocserv-sm process dependent on maximum clients and number of CPUs. Configuration option sec-mod-scale can be used to override the heuristics. - Fixed issue with group selection on radius servers sending multiple group class attribute. OBS-URL: https://build.opensuse.org/request/show/853618 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=37
2021-01-02 22:13:41 +01:00
@@ -698,18 +699,18 @@ dtls-legacy = true
Accepting request 606481 from home:stawidy:branches:network:vpn - Update to version 0.12.0 * Allow DTLS stream to come from different IP from TLS stream. There are situations where internet providers send the UDP stream from different IP. * Increased possibilities of allowed combinations of authentication methods. * Corrected regression since 0.11.8 with OTP authentication. * Added support for hostname-based virtual hosts, utilizing TLS SNI. With that change it is possible to configure multiple servers running over the same port. * Rename the tun device on BSD systems which support SIOCSIFNAME ioctl. * Correctly handle proxy-protocol’s health commands. That eliminates few connection drops when proxy protocol is in use. * Corrected crash on certain cases when proxy protocol is in use. - Update ocserv.config.patch due to upstream changes OBS-URL: https://build.opensuse.org/request/show/606481 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=18
2018-05-13 03:22:59 +02:00
# An example virtual host with different authentication methods serviced
# by this server.
-[vhost:www.example.com]
-auth = "certificate"
+#[vhost:www.example.com]
+#auth = "certificate"
-ca-cert = ../tests/certs/ca.pem
+#ca-cert = ../tests/certs/ca.pem
# The certificate set here must include a 'dns_name' corresponding to
# the virtual host name.
-server-cert = ../tests/certs/server-cert-secp521r1.pem
-server-key = ../tests/certs/server-key-secp521r1.pem
+#server-cert = ../tests/certs/server-cert-secp521r1.pem
+#server-key = ../tests/certs/server-key-secp521r1.pem
-ipv4-network = 192.168.2.0
-ipv4-netmask = 255.255.255.0
+#ipv4-network = 192.168.2.0
+#ipv4-netmask = 255.255.255.0
-cert-user-oid = 0.9.2342.19200300.100.1.1
+#cert-user-oid = 0.9.2342.19200300.100.1.1
Accepting request 853618 from home:mnhauke:network - Update to version 1.1.2 * Allow setup of new DTLS session concurrent with old session. * Fixed an infinite loop on sec-mod crash when server-drain-ms is set. * Don't apply BanIP checks to clients on the same subnet. * Don't attempt TLS if the client closes the connection with zero data sent. * Increased the maximum configuration line; this allows banner messages longer than 200 characters. * Removed the listen-clear-file config option. This option was incompatible with several clients, and thus is unusable for a generic server. - Update to version 1.1.1: * Improved rate-limit-ms and made it dependent on secmod backlog. This makes the server more resilient (and prevents connection failures) on multiple concurrent connections - Added namespace support for listen address by introducing the listen-netns option. - Disable TLS1.3 when cisco client compatibility is enabled. New anyconnect clients seem to supporting TLS1.3 but are unable to handle a client with an RSA key. - Enable a race free user disconnection via occtl. - Added the config option of a pre-login-banner. - Ocserv siwtched to using multiple ocserv-sm processes to improve scale, with the number of ocserv-sm process dependent on maximum clients and number of CPUs. Configuration option sec-mod-scale can be used to override the heuristics. - Fixed issue with group selection on radius servers sending multiple group class attribute. OBS-URL: https://build.opensuse.org/request/show/853618 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=37
2021-01-02 22:13:41 +01:00
diff --git a/doc/systemd/socket-activated/ocserv.socket b/doc/systemd/socket-activated/ocserv.socket
index 9444f19..a0ac362 100644
--- a/doc/systemd/socket-activated/ocserv.socket
+++ b/doc/systemd/socket-activated/ocserv.socket
Accepting request 314133 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/314133 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=2
2015-06-28 07:23:02 +02:00
@@ -2,8 +2,8 @@
Description=OpenConnect SSL VPN server Socket
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
Accepting request 314133 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/314133 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=2
2015-06-28 07:23:02 +02:00
[Socket]
-ListenStream=443
-ListenDatagram=443
+ListenStream=9000
+ListenDatagram=9001
BindIPv6Only=default
Accept=false
ReusePort=true
Reference in New Issue Copy Permalink