Hello all, currently I have asked all openvpn clients to update their openvpn to 2.3.3. But how can I check it, if some users still use the old version? How can I figure out, on the server side, if users still connect with an old version? I tried [code]status file 60 status-version 3[/code] but I cannot see any version of the clients. The next thing is, that I have no access to the openvpn client itself... Hopefully someone can help me here. best regard, hans

Reading up those topics does not really make me happy: [quote]# Will leave unencrypted password file on your client hard disc[/quote] Also server options to require a minimum client version would be great (both global and/or via the client-config-dir)

SSL heartbleed, how to get OpenVPN client version on Server?

hkais

Hello all,

currently I have asked all openvpn clients to update their openvpn to 2.3.3. But how can I check it, if some users still use the old version?
How can I figure out, on the server side, if users still connect with an old version?

I tried

status file 60
status-version 3

but I cannot see any version of the clients. The next thing is, that I have no access to the openvpn client itself...

Hopefully someone can help me here.

best regard,
hans

maikcat

keep in mind that you still need to replace their certificates as well..

Michael.

hkais

maikcat wrotekeep in mind that you still need to replace their certificates as well..

Michael.

Hello Michael,

thanks for the hint. I know that, but first I have to be sure, that the clients are all on new version. After that I will change the certificates. But how to know if I have an old versioned client?

maikcat

i dont think the client sends that kind of info to server even when debug mode logging... :?

Maybe the developers can respond?

Michael.

hkais

maybe I am to new to OpenVPN, but the push-peer-info does not provide any informations on the server.
I've added push-peer-info in the servers config

push-peer-info

I've added a script which traces all env-variables and all passed params and all content of passed files by params.

client-connect trace-var.sh

But I do not see any details about the client. So I've given a try to understand your link. But what exactly is the management interface? And how to trace client variables on a management interface?
As far as I see the management interface is an unencrypted connection to the backend of openVPN, so for me this is a no go. The connection must be authenticated AND encrypted, to avoid bad "listeners"...

Are there any hints on tracing the client versions?

hkais

Really no help here?
Noone else on the world, who is concerned about the users to use the newer openvpn client?
But how to force it? Or better how to detect the users, who are not following the needed updates of the client?

[deleted]

My guess is that the --push-peer-info is only to push some client info into enviroment variables on the client machine, so not much help for sending info to the server. Maybe you can write a client script that will somehow send this info to the administrator ?

As far as I can see it the best bet at the moment is using --tls-auth and --tls-remote. You won't get a client version, but it's a lot harder to abuse the heartbleed bug.

While you enable it (or renew the --tls-auth certificate) you can also give the users the newest openvpn client (and hope they will install it).

[deleted]

Reading up those topics does not really make me happy:

# Will leave unencrypted password file on your client hard disc

Also server options to require a minimum client version would be great (both global and/or via the client-config-dir)

[deleted]

And maybe the a client option to require a certain server version ?

hkais

Hello all,

are there any updates on the current issue/feature request to get the client version from the server side?

best wishes

hkais

Hello all,

really no updates on this?
Maybe there is a issue/changeset which is trackable to see a progress. If so, there can I find it?

best wishes,
hkais