forked from pool/ocserv
82e9a0ee9b
- Update to version 1.1.6
* Fixed compatibility with clients on Windows ARM64.
* Added futex() to the accepted list of seccomp.
It is required by Fedora 36’s libc.
* Work around change of returned error code in GnuTLS 3.7.3
for gnutls_privkey_import_x509_raw().
- Changes in version 1.1.5
* Fixed manpage output.
- Changes in version 1.1.4
* Added newfstatat() and epoll_pwait() to the accepted list of
seccomp calls. This improves compatibility with certain libcs
and aarch64.
* Do not allow assigning the same IPv6 as tun device address and
to the client. This allows using /127 as prefix (#430).
OBS-URL: https://build.opensuse.org/request/show/995041
OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=43
137 lines
4.6 KiB
Diff
137 lines
4.6 KiB
Diff
diff --git a/doc/sample.config b/doc/sample.config
|
|
index 0e33484f..60ab3e93 100644
|
|
--- a/doc/sample.config
|
|
+++ b/doc/sample.config
|
|
@@ -48,7 +48,7 @@
|
|
#auth = "pam"
|
|
#auth = "pam[gid-min=1000]"
|
|
#auth = "plain[passwd=./sample.passwd,otp=./sample.otp]"
|
|
-auth = "plain[passwd=./sample.passwd]"
|
|
+auth = "plain[passwd=/etc/ocserv/ocpasswd]"
|
|
#auth = "certificate"
|
|
#auth = "radius[config=/etc/radiusclient/radiusclient.conf,groupconfig=true]"
|
|
|
|
@@ -90,8 +90,8 @@ auth = "plain[passwd=./sample.passwd]"
|
|
# listen-netns = "foo"
|
|
|
|
# TCP and UDP port number
|
|
-tcp-port = 443
|
|
-udp-port = 443
|
|
+tcp-port = 9000
|
|
+udp-port = 9001
|
|
|
|
# The user the worker processes will be run as. This should be a dedicated
|
|
# unprivileged user (e.g., 'ocserv') and no other services should run as this
|
|
@@ -126,8 +126,8 @@ socket-file = /var/run/ocserv-socket
|
|
|
|
#server-cert = /etc/ocserv/server-cert.pem
|
|
#server-key = /etc/ocserv/server-key.pem
|
|
-server-cert = ../tests/certs/server-cert.pem
|
|
-server-key = ../tests/certs/server-key.pem
|
|
+server-cert = /etc/ocserv/certificates/server-cert.pem
|
|
+server-key = /etc/ocserv/certificates/server-key.pem
|
|
|
|
# Diffie-Hellman parameters. Only needed if for old (pre 3.6.0
|
|
# versions of GnuTLS for supporting DHE ciphersuites.
|
|
@@ -154,7 +154,7 @@ server-key = ../tests/certs/server-key.pem
|
|
# client certificates (public keys) if certificate authentication
|
|
# is set.
|
|
#ca-cert = /etc/ocserv/ca.pem
|
|
-ca-cert = ../tests/certs/ca.pem
|
|
+ca-cert = /etc/ocserv/certificates/ca-cert.pem
|
|
|
|
# The number of sub-processes to use for the security module (authentication)
|
|
# processes. Typically this should not be set as the number of processes
|
|
@@ -180,7 +180,7 @@ ca-cert = ../tests/certs/ca.pem
|
|
# the isolation was tested at. If you get random failures on worker processes, try
|
|
# disabling that option and report the failures you, along with system and debugging
|
|
# information at: https://gitlab.com/ocserv/ocserv/issues
|
|
-isolate-workers = true
|
|
+isolate-workers = false
|
|
|
|
# A banner to be displayed on clients after connection
|
|
#banner = "Welcome"
|
|
@@ -249,7 +249,7 @@ mobile-dpd = 1800
|
|
switch-to-tcp-timeout = 25
|
|
|
|
# MTU discovery (DPD must be enabled)
|
|
-try-mtu-discovery = false
|
|
+try-mtu-discovery = true
|
|
|
|
# To enable load-balancer connection draining, set server-drain-ms to a value
|
|
# higher than your load-balancer health probe interval.
|
|
@@ -415,8 +415,8 @@ rekey-method = ssl
|
|
# STATS_BYTES_OUT, STATS_DURATION that contain a 64-bit counter of the bytes
|
|
# output from the tun device, and the duration of the session in seconds.
|
|
|
|
-#connect-script = /usr/bin/myscript
|
|
-#disconnect-script = /usr/bin/myscript
|
|
+#connect-script = /usr/bin/ocserv-script
|
|
+#disconnect-script = /usr/bin/ocserv-script
|
|
|
|
# This script is to be called when the client's advertised hostname becomes
|
|
# available. It will contain REASON with "host-update" value and the
|
|
@@ -506,7 +506,8 @@ ipv4-netmask = 255.255.255.0
|
|
# The advertised DNS server. Use multiple lines for
|
|
# multiple servers.
|
|
# dns = fc00::4be0
|
|
-dns = 192.168.1.2
|
|
+dns = 8.8.8.8
|
|
+dns = 8.8.4.4
|
|
|
|
# The NBNS server (if any)
|
|
#nbns = 192.168.1.3
|
|
@@ -545,8 +546,8 @@ ping-leases = false
|
|
# comment out all routes from the server, or use the special keyword
|
|
# 'default'.
|
|
|
|
-route = 10.10.10.0/255.255.255.0
|
|
-route = 192.168.0.0/255.255.0.0
|
|
+#route = 10.10.10.0/255.255.255.0
|
|
+#route = 192.168.0.0/255.255.0.0
|
|
#route = fef4:db8:1000:1001::/64
|
|
#route = default
|
|
|
|
@@ -719,18 +720,18 @@ client-bypass-protocol = false
|
|
# An example virtual host with different authentication methods serviced
|
|
# by this server.
|
|
|
|
-[vhost:www.example.com]
|
|
-auth = "certificate"
|
|
+#[vhost:www.example.com]
|
|
+#auth = "certificate"
|
|
|
|
-ca-cert = ../tests/certs/ca.pem
|
|
+#ca-cert = ../tests/certs/ca.pem
|
|
|
|
# The certificate set here must include a 'dns_name' corresponding to
|
|
# the virtual host name.
|
|
|
|
-server-cert = ../tests/certs/server-cert-secp521r1.pem
|
|
-server-key = ../tests/certs/server-key-secp521r1.pem
|
|
+#server-cert = ../tests/certs/server-cert-secp521r1.pem
|
|
+#server-key = ../tests/certs/server-key-secp521r1.pem
|
|
|
|
-ipv4-network = 192.168.2.0
|
|
-ipv4-netmask = 255.255.255.0
|
|
+#ipv4-network = 192.168.2.0
|
|
+#ipv4-netmask = 255.255.255.0
|
|
|
|
-cert-user-oid = 0.9.2342.19200300.100.1.1
|
|
+#cert-user-oid = 0.9.2342.19200300.100.1.1
|
|
diff --git a/doc/systemd/socket-activated/ocserv.socket b/doc/systemd/socket-activated/ocserv.socket
|
|
index 9444f190..a0ac362a 100644
|
|
--- a/doc/systemd/socket-activated/ocserv.socket
|
|
+++ b/doc/systemd/socket-activated/ocserv.socket
|
|
@@ -2,8 +2,8 @@
|
|
Description=OpenConnect SSL VPN server Socket
|
|
|
|
[Socket]
|
|
-ListenStream=443
|
|
-ListenDatagram=443
|
|
+ListenStream=9000
|
|
+ListenDatagram=9001
|
|
BindIPv6Only=default
|
|
Accept=false
|
|
ReusePort=true
|