Hello! 3 months ago I had problem with hard disk drive and I've lost data stored in: c:\Program Files\OpenVPN\easy-rsa\keys\ I had a backup but 1 month old. Now i have to revoke a certificate that was created in that unlucky month. When I type: [code]vars.bat revoke-full.bat szlendakm[/code] I receive an error message: [quote]ERROR:name does not match /C=PL/ST=....................[/quote] I've read similar topic "revoke user with 'ERROR:name does not match'" (https://forums.openvpn.net/topic7979.html) but it does not match my problem. I'm aware that file c:\Program Files\OpenVPN\easy-rsa\keys\index.txt stores data about *.pem, but I don't have *.pem for that certificate. Is there any chance to revoke certyficate without XX.pem for that certificate? What should I do?

How to revoke cert with "ERROR:name does not match" (2)

pol

Hello!

3 months ago I had problem with hard disk drive and I've lost data stored in: c:\Program Files\OpenVPN\easy-rsa\keys\
I had a backup but 1 month old.

Now i have to revoke a certificate that was created in that unlucky month.
When I type:

vars.bat
revoke-full.bat szlendakm

I receive an error message:

ERROR:name does not match /C=PL/ST=....................

I've read similar topic "revoke user with 'ERROR:name does not match'" (https://forums.openvpn.net/topic7979.html) but it does not match my problem.

I'm aware that file c:\Program Files\OpenVPN\easy-rsa\keys\index.txt stores data about *.pem, but I don't have *.pem for that certificate.

Is there any chance to revoke certyficate without XX.pem for that certificate?
What should I do?

maikcat

you can try to re-create index.txt (if you have the certs that created last month)
and then try to revoke them..

just my 2 cents.

Michael.

janjust

in order to revoke a certificate you need the certificate DN (/C=PL/.... etc) and its serial number; if you no longer have the serial numbers and cannot predict them then you're in trouble....

pol

Serial number is in *.crt and I have it. Problem is that I've created many new certifacates after that and this serial number was overwritten.

Now I created identical certyficate szlendakm with identical name and switch them. index.txt now has that name, but still I can't revoke it!

ERROR:name does not match /C=PL/ST=....................

What should I do?!
How to block that connection?

janjust

you can't revoke the certificate if you don't know the serial number....

another way to block the connection is to add a 'tls-verify' script and to blacklist the full certificate name in that script.

pol

I'm not an expert. I'm just a beginner. I thought that 'tls-verify' verifies white-list only.
How to make a blacklist verification?

janjust

if the 'tls-verify' script returns a non-zero exit code the client is rejected. therefore, if your 'tls-verify' script does something like

#!/bin/bash

[ $# -lt 2 ] && exit 1

# if the depth is non-zero , continue processing
[ "$1" -ne 0 ] && exit 0

blacklisted_cns=`sed 's/ /_/g' /etc/openvpn/blacklist`
for i in $blacklisted_cns
do
  [ "$2" = "$i" ] && exit 1
done

# catch-all
exit 0

then you're blacklisting all certificate names listed in /etc/openvpn/blacklist.

maikcat

i think user pol uses windows, script that janjust provided (and he should be thanked for that)
is linux based script...

pol did you consider using linux for your server? 😉

Michael.

janjust

nice catch, Michael 😉
did you really want me to write a Windows batch file :mrgreen:

@echo off

if %1 neq 0 goto allow

find %2 blacklist.txt > nul:
if errorlevel 1 goto allow

echo Access denied for %2
if ERRORLEVEL 0 exit /b 1

:allow
rem entry not found in blacklist, return
echo Access granted for %2

Use as follows:

check.bat 0 "/full-cert-DN"

(remember to add quotes!)

pol

Hi

No, I'm using Windows only to generate certificates. I've got Liksys WRT54GL and Asus RT-N16 with Tomato based on Linux.

Config file server.ovpn now contains:

crl-verify /tmp/crl.pem
tls-verify /tmp/blacklist.sh

I've made a file /tmp/blacklist.sh with +x attribute (chmod +x /tmp/blacklist.sh)

#!/bin/bash

[ $# -lt 2 ] && exit 1

# if the depth is non-zero, continue processing
[ "$1" -ne 0 ] && exit 0

blacklisted_cns=`sed 's/ /_/g' /tmp/blacklist.txt`
for i in $blacklisted_cns
do
[ "$2" = "$i" ] && exit 1
done

# catch-all
exit 0

And text file /tmp/blacklist.txt:

SzlendakM

I don't know what is the problem. I can't connect on any certificate. OpenVPN window everytime returns:

read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)

What is wrong?

maikcat

long live janjust!

:mrgreen: :mrgreen: :mrgreen:

janjust

@pol: add some debugging info to the script, e.g. change the first line

#!/bin/bash -vx

this will print lots of output each time the script is triggered - start the server again on the commandline, then connect a client and watch stdout/stderr for any messages.

pol

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

maikcat

can you post the permissions used for blacklist.sh?

Michael.

pol

Sure. Permissions for all files in that dir:

root@RT-BCAEC5C3CF5A:/tmp# ll
-rwxr-xr-x 1 root root 249 Jan 1 1970 blacklist.sh*
-rw-r--r-- 1 root root 10 Jan 1 1970 blacklist.txt
-rw-r--r-- 1 root root 598 Jan 1 1970 crl.pem
drwxr-xr-x 5 root root 600 May 24 09:29 etc/
drwxr-xr-x 3 root root 60 Jan 1 1970 home/
drwxr-xr-x 2 root root 40 Jan 1 1970 mnt/
-rwx------ 1 root root 1621 Jan 1 1970 script_init.sh*
drwxr-xr-x 2 root root 40 Jan 1 1970 share/
drwxr-xr-x 2 root root 40 Jan 1 1970 splashd/
-rwxr-xr-x 1 root root 126 May 24 09:29 stop_transmission.sh*
drwxr-xr-x 11 root root 220 Jan 1 1970 var/

Tom

maikcat

can you add

script-security 2

to your config..

Michael.

pol

OK, I've add new line to config file:

root@RT-BCAEC5C3CF5A:/tmp/etc/openvpn/server1# cat config.ovpn
# Automatically generated configuration
daemon
server-bridge
proto udp
port 1194
dev tap21
comp-lzo adaptive
keepalive 15 60
verb 3
ca ca.crt
dh dh.pem
cert server.crt
key server.key
status-version 2
status status

# Custom Configuration
script-security 2
crl-verify /tmp/crl.pem
tls-verify /tmp/blacklist.sh

And I changed back blacklist.sh (word echo to exit):

root@RT-BCAEC5C3CF5A:/tmp# cat blacklist.sh
#!/bin/bash

[ $# -lt 2 ] && exit 1

# if the depth is non-zero, continue processing
[ "$1" -ne 0 ] && exit 0

blacklisted_cns=`sed 's/ /_/g' /tmp/blacklist.txt`
for i in $blacklisted_cns
do
[ "$2" = "$i" ] && exit 1
done

# catch-all
exit 0

On Windows client I have:

read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)

Router logs, when I was connecting as normal client to OpenVPN:

May 24 15:14:37 RT-BCAEC5C3CF5A daemon.notice openvpn[751]: MULTI: multi_create_instance called
May 24 15:14:37 RT-BCAEC5C3CF5A daemon.notice openvpn[751]: 80.51.xxx.xxx:64841 Re-using SSL/TLS context
May 24 15:14:37 RT-BCAEC5C3CF5A daemon.notice openvpn[751]: 80.51.xxx.xxx:64841 LZO compression initialized
May 24 15:14:37 RT-BCAEC5C3CF5A daemon.notice openvpn[751]: 80.51.xxx.xxx:64841 Control Channel MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
May 24 15:14:37 RT-BCAEC5C3CF5A daemon.notice openvpn[751]: 80.51.xxx.xxx:64841 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
May 24 15:14:37 RT-BCAEC5C3CF5A daemon.notice openvpn[751]: 80.51.xxx.xxx:64841 TLS: Initial packet from 80.51.xxx.xxx:64841, sid=0b719af3 bff5b16d
May 24 15:14:37 RT-BCAEC5C3CF5A daemon.err openvpn[751]: 80.51.xxx.xxx:64841 Verify command failed to execute: /tmp/blacklist.sh 1 /C=PL/ST=Podlaskie/L=City/O=*****/CN=*****-CA/emailAddress=*****@*****.com.pl
May 24 15:14:37 RT-BCAEC5C3CF5A daemon.notice openvpn[751]: 80.51.xxx.xxx:64841 Exiting

Tom

maikcat

stupid question..

is there a /bin/bash?

Michael.

pol

Omg... I didn't realize that there is no bash :/
Look:

root@RT-BCAEC5C3CF5A:/# cd /bin/
root@RT-BCAEC5C3CF5A:/bin# ls
ash      dd       grep     mkdir    ntpc     pwd      sync     watch
busybox  df       gunzip   mknod    ntpstep  rm       tar      zcat
cat      dmesg    gzip     more     ntpsync  rmdir    touch
chmod    eapd     kill     mount    nvram    rstats   true
chown    echo     ln       mv       pidof    sed      umount
cp       egrep    login    netstat  ping     sh       uname
cstats   fgrep    ls       nice     ping6    sleep    usleep
date     fsync    mdu      ntfs-3g  ps       stty     vi

I've checked build-in scripts. They have:

#!/bin/sh

Now I changed also to "#!/bin/sh" but it is not blocking connections from restricted certificate.
It passes everyone...

Router logs:

May 25 08:11:18 RT-BCAEC5C3CF5A daemon.notice openvpn[764]: MULTI: multi_create_instance called
May 25 08:11:18 RT-BCAEC5C3CF5A daemon.notice openvpn[764]: 80.51.xxx.xxx:57170 Re-using SSL/TLS context
May 25 08:11:18 RT-BCAEC5C3CF5A daemon.notice openvpn[764]: 80.51.xxx.xxx:57170 LZO compression initialized
May 25 08:11:18 RT-BCAEC5C3CF5A daemon.notice openvpn[764]: 80.51.xxx.xxx:57170 Control Channel MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
May 25 08:11:18 RT-BCAEC5C3CF5A daemon.notice openvpn[764]: 80.51.xxx.xxx:57170 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
May 25 08:11:18 RT-BCAEC5C3CF5A daemon.notice openvpn[764]: 80.51.xxx.xxx:57170 TLS: Initial packet from 80.51.xxx.xxx:57170, sid=0c198958 6a4221fa
May 25 08:11:18 RT-BCAEC5C3CF5A daemon.notice openvpn[764]: 80.51.xxx.xxx:57170 VERIFY SCRIPT OK: depth=1, /C=PL/ST=Podlaskie/L=city/O=*****/CN=*****-CA/emailAddress=*****@*****.com.pl
May 25 08:11:18 RT-BCAEC5C3CF5A daemon.notice openvpn[764]: 80.51.xxx.xxx:57170 CRL CHECK OK: /C=PL/ST=Podlaskie/L=city/O=*****/CN=*****-CA/emailAddress=*****@*****.com.pl
May 25 08:11:18 RT-BCAEC5C3CF5A daemon.notice openvpn[764]: 80.51.xxx.xxx:57170 VERIFY OK: depth=1, /C=PL/ST=Podlaskie/L=city/O=*****/CN=*****-CA/emailAddress=*****@*****.com.pl
May 25 08:11:18 RT-BCAEC5C3CF5A daemon.notice openvpn[764]: 80.51.xxx.xxx:57170 VERIFY SCRIPT OK: depth=0, /C=PL/ST=Podlaskie/O=*****/CN=SzlendakM/emailAddress=*****@*****.com.pl
May 25 08:11:18 RT-BCAEC5C3CF5A daemon.notice openvpn[764]: 80.51.xxx.xxx:57170 CRL CHECK OK: /C=PL/ST=Podlaskie/O=*****/CN=SzlendakM/emailAddress=*****@*****.com.pl
May 25 08:11:18 RT-BCAEC5C3CF5A daemon.notice openvpn[764]: 80.51.xxx.xxx:57170 VERIFY OK: depth=0, /C=PL/ST=Podlaskie/O=*****/CN=SzlendakM/emailAddress=*****@*****.com.pl
May 25 08:11:19 RT-BCAEC5C3CF5A daemon.notice openvpn[764]: 80.51.xxx.xxx:57170 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
May 25 08:11:19 RT-BCAEC5C3CF5A daemon.notice openvpn[764]: 80.51.xxx.xxx:57170 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
May 25 08:11:19 RT-BCAEC5C3CF5A daemon.notice openvpn[764]: 80.51.xxx.xxx:57170 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
May 25 08:11:19 RT-BCAEC5C3CF5A daemon.notice openvpn[764]: 80.51.xxx.xxx:57170 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
May 25 08:11:19 RT-BCAEC5C3CF5A daemon.notice openvpn[764]: 80.51.xxx.xxx:57170 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
May 25 08:11:19 RT-BCAEC5C3CF5A daemon.notice openvpn[764]: 80.51.xxx.xxx:57170 [SzlendakM] Peer Connection Initiated with 80.51.xxx.xxx:57170
May 25 08:11:19 RT-BCAEC5C3CF5A daemon.err openvpn[764]: SzlendakM/80.51.xxx.xxx:57170 MULTI: no dynamic or static remote --ifconfig address is available for SzlendakM/80.51.xxx.xxx:57170
May 25 08:11:21 RT-BCAEC5C3CF5A daemon.notice openvpn[764]: SzlendakM/80.51.xxx.xxx:57170 PUSH: Received control message: 'PUSH_REQUEST'
May 25 08:11:21 RT-BCAEC5C3CF5A daemon.notice openvpn[764]: SzlendakM/80.51.xxx.xxx:57170 SENT CONTROL [SzlendakM]: 'PUSH_REPLY,route-gateway dhcp,ping 15,ping-restart 60' (status=1)
May 25 08:11:21 RT-BCAEC5C3CF5A daemon.notice openvpn[764]: SzlendakM/80.51.xxx.xxx:57170 MULTI: Learn: 00:ff:21:a2:4c:d5 -> SzlendakM/80.51.xxx.xxx:57170
May 25 08:11:21 RT-BCAEC5C3CF5A daemon.info dnsmasq-dhcp[780]: DHCPREQUEST(br0) 192.168.1.206 00:ff:21:a2:4c:d5
May 25 08:11:21 RT-BCAEC5C3CF5A daemon.info dnsmasq-dhcp[780]: DHCPACK(br0) 192.168.1.206 00:ff:21:a2:4c:d5 informatyk-dell
May 25 08:11:30 RT-BCAEC5C3CF5A daemon.info dnsmasq-dhcp[780]: DHCPINFORM(br0) 192.168.1.206 00:ff:21:a2:4c:d5
May 25 08:11:30 RT-BCAEC5C3CF5A daemon.info dnsmasq-dhcp[780]: DHCPACK(br0) 192.168.1.206 00:ff:21:a2:4c:d5 informatyk-dell

janjust

add some debugging output to the script, e.g.

#!/bin/sh

echo "argv=[$@]"
[ $# -lt 2 ] && exit 1

# if the depth is non-zero, continue processing
[ "$1" -ne 0 ] && exit 0

echo "DN=[$2]"
blacklisted_cns=`sed 's/ /_/g' /tmp/blacklist.txt`
for i in $blacklisted_cns
do
  echo "   [$i]"
  [ "$2" = "$i" ] && exit 1
done

# catch-all
exit 0

also try running the script on the command line, e.g.

/tmp/blacklist.sh 0 "/C=PL/ST=Podlaskie/O=*****/CN=SzlendakM/emailAddress=*****@*****.com.pl"

etc.