Changes between Version 17 and Version 18 of HOWTO

Timestamp:

07/25/14 15:26:40 (10 years ago)

Author:

Samuli Seppänen

Comment:

Finished basic formatting fixes, still needs review...

HOWTO

@@ -1156 +1156 @@
 = Important Note on possible "Man-in-the-Middle" attack if clients do not verify the certificate of the server they are connecting to =
 
-To avoid a possible Man-in-the-Middle attack where an authorized client tries to connect to another client by impersonating the server, make sure to enforce some kind of server certificate verification by clients. There are currently five different ways of accomplishing this, listed in the order of preference:
-
-1. OpenVPN 2.1 and above: Build your server certificates with specific key usage and extended key usage.
-
-The RFC3280 determine that the following attributes should be provided for TLS connections:
+To avoid a possible Man-in-the-Middle attack where an authorized client tries to connect to another client by impersonating the server, make sure to enforce some kind of server certificate verification by clients. There are currently five different ways of accomplishing this, listed in the order of preference.
+
+Option 1 for OpenVPN 2.1 and above: build your server certificates with specific key usage and extended key usage. The RFC3280 determine that the following attributes should be provided for TLS connections:
 
 {{{#!html
@@ -1189 +1187 @@
 }}}
 
-Mode Key usage Extended key usage
-Client digitalSignature TLS Web Client Authentication
-keyAgreement
-    digitalSignature, keyAgreement
-    Server      digitalSignature, keyEncipherment       TLS Web Server Authentication
-    digitalSignature, keyAgreement
-
-    You can build your server certificates with the build-key-server script (see the easy-rsa documentation for more info). This will designate the certificate as a server-only certificate by setting the right attributes. Now add the following line to your client configuration:
-
-        remote-cert-tls server
-
-    [OpenVPN 2.0 and below] Build your server certificates with the build-key-server script (see the easy-rsa documentation for more info). This will designate the certificate as a server-only certificate by setting nsCertType=server. Now add the following line to your client configuration:
-
+You can build your server certificates with the build-key-server script (see the easy-rsa documentation for more info). This will designate the certificate as a server-only certificate by setting the right attributes. Now add the following line to your client configuration:
+{{{
+remote-cert-tls server
+}}}
+Option 2, for OpenVPN 2.0 and below: Build your server certificates with the '''build-key-server''' script (see the easy-rsa documentation for more info). This will designate the certificate as a server-only certificate by setting '''nsCertType=server'''. Now add the following line to your client configuration:
+{{{
+ns-cert-type server
+}}}
+This will block clients from connecting to any server which lacks the '''nsCertType=server''' designation in its certificate, even if the certificate has been signed by the '''ca''' file in the OpenVPN configuration file.
+
+Option 3: Use the '''tls-remote''' directive on the client to accept/reject the server connection based on the common name of the server certificate.
+
+Option 4: Use a '''tls-verify''' script or plugin to accept/reject the server connection based on a custom test of the server certificate's embedded X509 subject details.
      
-
-        ns-cert-type server
-
-    This will block clients from connecting to any server which lacks the nsCertType=server designation in its certificate, even if the certificate has been signed by the ca file in the OpenVPN configuration file.
-    Use the tls-remotedirective on the client to accept/reject the server connection based on the common name of the server certificate.
-
-     
-    Use a tls-verifyscript or plugin to accept/reject the server connection based on a custom test of the server certificate's embedded X509 subject details.
-
-     
-    Sign server certificates with one CA and client certificates with a different CA. The client configuration ca directive should reference the server-signing CA file, while the server configuration cadirective should reference the client-signing CA file.
+Option 5: Sign server certificates with one CA and client certificates with a different CA. The client configuration '''ca''' directive should reference the server-signing CA file, while the server configuration cadirective should reference the client-signing CA file.
 
 = Sample OpenVPN 2.0 configuration files =