list-openvpn-nl

list-openvpn-nl@lists.fox-it.com

37 discussions

OpenVPN-NL v2.3.4-nl1 released
by Steffan Karger 11 Aug '14

11 Aug '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 A new version of OpenVPN-NL (2.3.4-nl1) is available on the OpenVPN-NL site [1]. This version is based on OpenVPN 2.3.4, and PolarSSL 1.2.11 [2]. The new version of OpenVPN-NL includes a new PolarSSL release, which fixes a denial-of-service vulnerability when GCM TLS-cipher suites were used [3]. A successful attack could compromise the availability, but would *not* compromise confidentiality. In OpenVPN-NL, this denial-of-service attack can only be exploited when the group key ("tls-auth") has been compromised. We strongly recommend that you upgrade to the new version of OpenVPN-NL. Important note for plugin/script users: This release changes the representation of the tls_serial_{n} environment variable from hex to decimal, to match upstream OpenVPN behaviour. To ease transition for plugin/script users, a new env variable tls_serial_hex_{n} is added, that exports the serial in hex represenation (like tls_serial_{n} previously did). References [1] https://openvpn.fox-it.com/ [2] https://polarssl.org/tech-updates/releases [3] https://polarssl.org/tech-updates/security-advisories/polarssl-security-adv… -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBCAAGBQJT6NRRAAoJEEEwndWOY1w59q8H/RjWWp63ODmHskLp/M8tNV/+ QtmJj7NeXjzCmEHTWUWpcE8XYa9+iozDo0Dc0MRUf0BaIRM2zwnT0Nj/wGbZnNFb cL9cmc53IrnPDclMXZGNgn0q+Dn/mR37Yga32sJlv6s+Qu9/xYPgVkRxzG7OO4uY VG6PPWPk82w95HpLgdF27ZuNZXHvgQuMkW2RXMUzkoLfXykCJrak1wXVECGll6mT 6vVf2IRLf+YMzlaE96Tz60qczg0T0q4cAwMIZTTw2flGAFUMh8LDL+Fgh5Q1+3/P xJNrdZDkHD1hy/xwNEseyYAiHL8wqUtXZ13631ekaxnEdpsP+XKPo2VyR1WeqMI= =Yfrw -----END PGP SIGNATURE-----

1 0

OpenVPN-NL security advisory - heartbleed
by Steffan Karger 08 Apr '14

08 Apr '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 A serious vulnerability in OpenSSL has been discovered [1]. OpenVPN-NL does not use OpenSSL and thus is not affected by this bug. OpenVPN-NL users should consider: * OpenVPN-NL uses PolarSSL, not OpenSSL, and is not vulnerable [2]. * When using OpenVPN-NL together with OpenSSL-based OpenVPN, the OpenSSL-based peers are vulnerable, and their keys and connection could be compromised. * When using a TLS-auth ('group') key, attackers needs this key to mount an attack on OpenSSL-based peers (e.g. through an untrusted or compromised client). [1] http://heartbleed.com/ [2] https://polarssl.org/tech-updates/security-advisories/polarssl-security-adv… -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) iQEcBAEBCAAGBQJTRA1VAAoJEEEwndWOY1w54cYH/1yk02o0qKCJQXY0j20Q83tO m3DKdDDZl2jFfQkV5Z0w49qm+ZqifZiZyAWvpWeo3P5PicdMDgDxsle7dtva90VM DAEEslDC7V3Fwbj0237wM6GUZ7ruJarxxhH8UFTfaSkZZmXVMBkDHBKwX5nC6OfM GDNBXGEYqtf1eaCneGsp6m/TrL2opAhvVWbrOAj3ir7Y9usepLlH0Ce3DQewTmzz zU8xk25oPZ5KfaVab7tLaXaJwFRBDQVKpFzVdgGnGu3LGlmncMKwdRNCwSrkxkZ2 7J+EKxcEu8jVGjXSvoP9qcKe5bz6e2P9PWQYr6T1fPWdj7hK7KTFyekpOmUrHMs= =FDQd -----END PGP SIGNATURE-----

1 0

OpenVPN-NL v2.3.2-nl2 released
by Steffan Karger 07 Nov '13

07 Nov '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 A new version of OpenVPN-NL (2.3.2-nl2) is available on the OpenVPN-NL site [1]. This version is based on OpenVPN 2.3.2, and PolarSSL 1.2.10 [2]. This new version of OpenVPN-NL includes a new PolarSSL release, which fixes a possible timing attack on the server [3,4]. A successful attack could compromise the server's RSA private key. In OpenVPN-NL, this denial-of-service attack can only be exploited when the group key ("tls-auth") has been compromised. We strongly recommend that you upgrade to this new version of OpenVPN-NL. Although we believe that this attack is not feasible over the internet, users should consider whether their situation warrants replacement of their server's private/public key pair. References - ---------- [1] https://openvpn.fox-it.com/ [2] https://polarssl.org/tech-updates/releases [3] https://polarssl.org/tech-updates/security-advisories/polarssl-security-adv… [4] https://polarssl.org/public/ctrsa13.pdf -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQEcBAEBCAAGBQJSe8TcAAoJEEEwndWOY1w5k9QH/0lTbDPVsvJGYE4ZGEy3KeF0 752bUybgKik8v4eF1Ac6L3rY+8KRRJxgSU/Oo2gX9+5E8tbbRnfDavwB4JIRYjpt 07gcim3fH+15M5diWNOoVyUS70m6bIJjJFeA2SbhtzWMMhffaIjHGl3hM08IvR4S vvoWZ7DxIlbezNmeM+oefiMR00N47syRhcI2JaEzTOFF7Keis3zUZzvMgK8wJ2cX OwieXcpSrzLY9zPjBD37TEQkIe5UXb/Y5237BpQRHgGyZ35jLMptQuLajr6HcUac gn5ql+CNASTjJTijeoJ3tLRKpn2HU/+4V/rb5RuGgpG/4X39I297z8sG2Gw3aEo= =vTvA -----END PGP SIGNATURE-----

1 0

OpenVPN-NL v2.3.2-nl1 released
by Steffan Karger 05 Jul '13

05 Jul '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 A new version of OpenVPN-NL (2.3.2-nl1) is available on the OpenVPN-NL site [1]. This version is based on OpenVPN 2.3.2, and PolarSSL 1.2.8 [2]. The new version of OpenVPN-NL includes a new PolarSSL release, which fixes a denial-of-service possibility during TLS negotiation [3]. A successful attack could compromise the availability, but would *not* compromise confidentiality. In OpenVPN-NL, this denial-of-service attack can only be exploited when the group key ("tls-auth") has been compromised. We strongly recommend that you upgrade to the new version of OpenVPN-NL. References - - - - - ---------- [1] https://openvpn.fox-it.com/ [2] https://polarssl.org/tech-updates/releases [3] https://polarssl.org/tech-updates/security-advisories/polarssl-security-adv… -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQEcBAEBCAAGBQJR1rCiAAoJEEEwndWOY1w5wQAH/2TyRgP4F3PUoUe5S2j98DH1 izlBarfToTtkzD4yibmcr9vY5gJMR2kKQig+FcU82n83EK0Pd+gM7cwOxGt4pWeg vsMHaO163oE0B5tQ8XNiA0loCmYkj8Zr1zlIS8livEyPzJh+pbfQHUv6A6q5wjlz UPJ8tLM57qoN9NAb3XqaPN8B1kZ3I/7fMUzRzrzs2tW2AqYTxw+2vMAiHWUf6dgE 14JpmWlXe2a28IhWHY+PztioVROZB9oUGWsg5+yHZqTIQIy1GJHw6CyyfSxn7r3x 1RhCMNjkP/E+B3hSlDNK9iEFC2npu+x65JkbokSNSMNJsujlIK29xjYR+0o0o9s= =m/j9 -----END PGP SIGNATURE-----

1 0

OpenVPN-NL v2.3.1-nl1 released
by Steffan Karger 15 May '13

15 May '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 A new version of OpenVPN-NL is available on the OpenVPN-NL site [1]. This version is based on OpenVPN 2.3.1, which integrates PolarSSL 1.2 support [2]. The new version of PolarSSL contains a number of security fixes, in particular fixes against the 'Lucky Thirteen' SSL attack. For a full list of changes, please refer to the OpenVPN site [3]. The new version of OpenVPN fixes a security issue where an attacker with a man-in-the-middle position could inject arbitrary ciphertext into the data channel [4]. Due to the number of improvements, we strongly recommend that you upgrade to the new version of OpenVPN-NL. *nix packages renamed - - --------------------- The package and executable name for the Red Hat, Suse, Debian and Ubuntu packages have been changed to openvpn-nl, to allow it to be deployed alongside a regular openvpn installation. Furthermore, OpenVPN-NL now looks for config files in /etc/openvpn-nl/. To update your packages version, install the new openvpn-nl package and migrate your configuration. PolarSSL 1.2 - - ------------- Most relevant for OpenVPN is the addition of Galois Counter Mode (GCM) for AES-based TLS ciphers. The preferred TLS mode has been updated to TLS-DHE-RSA-WITH-AES-256-GCM-SHA384. Furthermore, the PolarSSL API has changed in several places, requiring changes to OpenVPN code. New deployment advisory - - ----------------------- The deployment advisory has been updated to v1.3. This version deprecates version 1.2 and advises the usage of OpenVPN-NL 2.3. Minor changes - - ------------- - The command line parameter --use-urandom allows for /dev/urandom to be used as a random source instead of /dev/random on *nix platforms. - x509 certificate subject and issuer strings containing \0 characters are now rejected. References - - ---------- [1] https://openvpn.fox-it.com/ [2] https://polarssl.org/tech-updates/releases [3] https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23 [4] https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-f375aa67cc -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQEcBAEBCAAGBQJRk4aHAAoJEEEwndWOY1w5yY0IAJf4xG3GHzcDPsmkTK3+mHbk MLnG4n7C1rEtkf4A/PJ0X4hAYS14Mk+5QMYmqinl6KIvKGw0fs6hDMm4b2X0j1fm z4cWn1/exc0erofAteO+NqLspAIf8AVg/miB3qVgB1E9mAo30tE9fiNn/L49L2Pb a7kmY8SyNJuHEG2y1mRPb1a/v0ZMvsyiVtMGxWkDiYj9x6bEV+FwIGYLR7eM42NP mXMekvCoiKBCci8HewLVcMcJeIOCFeuPF2zUax2CH1yeDggFMXGEWkNI/QmuiIPE YKV+zTQNqy4l0sqPbXJDvWH5S3qL+ZLrV5pLZXGR7N/B2mCtfSI6ynVkOdrf34s= =gItO -----END PGP SIGNATURE-----

1 0

OpenVPN-NL v2.1.4-fox6 released
by Adriaan de Jong 14 Feb '12

14 Feb '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 A new version of OpenVPN-NL is available on the OpenVPN-NL site [1]. This version fixes a few small issues reported by the community, and includes support for the random number generator introduced in PolarSSL v1.1.0 [2]. Aside from these technical changes, the deployment advisory has been updated with a new section on virtual machines. Details of these changes will be given in the next few sections. Due to the improvements in the random number generator, we strongly recommend that you upgrade to the new version of OpenVPN-NL. New PolarSSL RNG - ---------------- In response to security concerns PolarSSL has introduced a new random number generator. It consists of two parts: an entropy gathering function, which allows the combination of a number of entropy sources, and a front-end deterministic random bit generator (DRBG), based on NIST-SP800-90 [3]. OpenVPN-NL uses a combination of the existing HAVEGE random number generator and the platform entropy device (e.g. /dev/random on Linux, CryptoAPI on Windows) as entropy sources. Two new OpenVPN-NL command line options have been introduced to allow users to tweak the new RNG: - min-platform-entropy: On Linux, sets the minimum number of bytes to read from /dev/random when reseeding. As /dev/random is blocking, setting this too high can cause OpenVPN-NL to block when not enough platform entropy is available. The deployment advisory recommends the use of at least 10 bytes. The default is 16 bytes. - use-prediction-resistance: Enables prediction resistance according to the NIST standard [3]. This should only be enabled if enough platform entropy is available. Enabling this option is recommended in the deployment advisory. The default is to disable prediction resistance. New deployment advisory - ----------------------- The deployment advisory has been updated to v1.2. This version adds a new paragraph on the use of OpenVPN-NL in virtual environments and on concentrators: "Users are advised to use hardware random number generators or entropy gathering daemons via the interfaces and conventions that the host offers. These feed into the system entropy pool. This is recommended on concentrators and systems that run in virtual environments. Enabling the use-prediction-resistance configuration option is recommended. Note that this may deplete kernel entropy sources more quickly. Users are advised not to adjust the configuration option min-platform-entropy below the value 10." Minor bug fixes - --------------- - Fixed bug in certificate serial number output to scripts. The last digit of the serial number was not output in some situations. - Disabled non-blocking connect on the Windows version, fixing the broken TCP behaviour. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQEcBAEBCAAGBQJPOiyPAAoJED0YDGtLy/yg4DwH/2SU8WKE1UuzFaMDquQPYGiJ 0HJXmnMXbpP4TTDTapmjObu0xcHpnG7r0tP9CcGA79LKjNEA35GMgThaWoeyHQDK 93+cCNYZHY+kKEWaMWKJ7O0sO0wsaQ8YpNTHMh07qqX5e7IwdpZBTYDW+hLVwi2z fmRQ9jszkHLgFjenOGIGIiHLBR+VQbljRx5iWMiIz4Dyd3YRsfoMObykWxdftQ8W w/TIQb4lW+mpOjLdSTwwrwBTNlwf7jK0CBTCEf0RvDER/9VXDzmcR5pvSsA1OzFe y/xxI/0ptvdtjaYlol3d682yPCar0UjKBidtWpqUR/zyq/dAujY6YDUI7ScNNlY= =qWLz -----END PGP SIGNATURE-----

1 0

Deployment advisory update: use of OpenVPN-NL within virtualised environments
by Adriaan de Jong 01 Dec '11

01 Dec '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Feedback from the security community has triggered an investigation into the quality of PolarSSL's random number generation within virtualised environments. PolarSSL performs the random number generation and cryptographic functions required by OpenVPN-NL. To ensure that security is maintained while this investigation proceeds, the NLNCSA has added an extra restriction to its deployment advisory: - OpenVPN-NL should not be used in virtualised environments. This restriction might be lifted in the future, depending on the results of the investigation. We would like to thank Jacob Appelbaum, Marsh Ray, and Oscar Koeroo for starting the discussion on this matter. Details - ------- PolarSSL versions prior to v1.1 use only the HAVEGE random number generation algorithm. At its heart, this uses timing information based on the processor's high resolution timer (the RDTSC instruction). This instruction can be virtualised, and some virtual machine hosts have chosen to disable this instruction, returning 0s or predictable results. Currently, the problem appears to be limited to commercial cloud server providers. Solution - -------- A new version of PolarSSL, v1.1, will be released within a few days. This contains a new random number generator based on the CTR_DRBG algorithm specified in NIST SP-800-90. The entropy used by this algorithm is accumulated from multiple sources, including the existing Havege RNG, platform-specific entropy sources and timing sources. This increases the quality of the entropy pool, and makes it less vulnerable to problems within a single source. Once this new RNG has been succesfully evaluated, it will be included in future releases of OpenVPN-NL. Further research is also being done to determine the overall quality of random number generation within virtual machines. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQEcBAEBCAAGBQJO15v9AAoJED0YDGtLy/ygUnwIAIbFJ+tz/MKvv0VlSRq9ch53 J/4L57esdUKdjT7oy0E03dTU26LAteuMd/5YeEIGwegl9ImY0xvTReQhF4GZ7+oS O1zzsynH1B1bYY8l8ncIM19SW91T1MaKHpJsd5eVr8uKBPcsLAEKuXil0U7US11w mkMbdMIpzXU/b6SLMN1RrS3YU0kvkLBpDp0eOywl+QbHVf2ifiwXHw+6m7zHPXDC WsPnGLiEfDvVaWGvVfUC285zXuCQ+nnbrk2bCvFugAuKziSqt/x5W9LcmhICvKXg IQufGt9JEg3ADW7xn627RdMCDKy9emUo0peOWKYyTN56o3oMPVff9YsQaDlkr10= =mPMD -----END PGP SIGNATURE-----

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

list-openvpn-nl