Intermediate-CA's and White-lists

cathnan

After searching for a solution for days now, I'd like to ask here if someone has an idea what could be the problem.

I plan to establish a VPN Connection to several remote locations. This locations can be put in two categories. I'd like to set up one Server for each category since they need access to different networks. I also wanted to create two intermediate CA's from the same root CA to keep them separate and prevent that Clients of one category can connect to the Server of the other one. Server and Clients of the same category get their certificates from the same intermediate CA. As far as I know, for a Client to connect to a Server using intermediate CA's, the client and the server both need the root CA and the intermediate CA combined in one file and certificates from this intermediate CA. The new file is used as ca file in the OpenVPN config. Set up like this, only clients using certificates from the same intermediate CA should be able to connect to the server.

The problem I have is, that in my tests I tried different combinations of ca and cert files on the Server and Clients. In this tests I also tried combinations of ca and cert of both intermediate CA's and in most cases (10/16) a connection was established and I have no idea why. How can I prevent that a Client from one category can connect to the Server from the other.

Another problem I have is the following. I also want to establish a white-list of common names which are allowed to connect. The only way I know to realise this is by running a perl script with tls-verify. Unfortunately I couldn't find a way yet how I can start the script while using chroot at the same time. I assume that the perl script can't be executed because the interpreter can't be found. Is there a way to copy the interpreter in the set chroot directory, or can a white-list be realised in a different way?

The Server will be Ubuntu 14.04 LTS. The clients will be several different Routers. For testing I'm using Ubuntu 14.04 as client and Server.

My config files for testing are as follows:

Server:

server 10.8.0.0 255.255.0.0
port 1194
proto udp
dev tun
chroot /home/openvpn1/Schreibtisch/intermediate-test/
ca /home/openvpn1/Schreibtisch/intermediate-test/intermediate-2/inter1/kette1.crt
cert /home/openvpn1/Schreibtisch/intermediate-test/intermediate-2/inter1/server1.crt
key /home/openvpn1/Schreibtisch/intermediate-test/intermediate-2/inter1/server1.key # This file should be kept secret
tls-auth /etc/openvpn/config/keys/ta.key 0
tls-server
tls-verify "/intermediate-2/verify-cn /intermediate-2/cnfile"
script-security 2
dh /etc/openvpn/config/keys/dh4096.pem
persist-key
persist-tun
cipher AES-256-CBC
reneg-sec 1800
user openvpn
group openvpn
remote-cert-tls client
comp-lzo yes
push "comp-lzo yes"
keepalive 5 30
push "redirect-gateway def1 bypass-dhcp"
push "explicit-exit-notify 3"
push "route 10.112.128.0 255.255.192.0"
client-config-dir clients
route 192.168.10.0 255.255.255.0
route 10.117.128.80 255.255.255.240
verb 4
status /home/openvpn/openvpn-logs/openvpn-status.log
log-append /home/openvpn/openvpn-logs/openvpn-log.log

Client:

client
remote 192.168.1.5
port 1194
proto udp
dev tun
ca /home/ovpn-gast1/Schreibtisch/intermediate-2/inter1/kette1.crt
cert /home/ovpn-gast1/Schreibtisch/intermediate-2/inter1/client1.crt
key /home/ovpn-gast1/Schreibtisch/intermediate-2/inter1/client1.key # This file should be kept secret
tls-auth /home/ovpn-gast1/Schreibtisch/intermediate-2/ta.key 1
tls-client
cipher AES-256-CBC
reneg-sec 1800
remote-cert-tls server
comp-lzo yes
push "comp-lzo yes"
keepalive 5 30
pull
verb 4
status /home/ovpn-gast1/Schreibtisch/intermediate-2/openvpn-status.log
log-append /home/ovpn-gast1/Schreibtisch/intermediate-2/openvpn-log.log

Traffic

cathnan wroteThe problem I have is, that in my tests I tried different combinations of ca and cert files on the Server and Clients. In this tests I also tried combinations of ca and cert of both intermediate CA's and in most cases (10/16) a connection was established and I have no idea why

I presume you have read this:
https://community.openvpn.net/openvpn/wiki/Using_Certificate_Chains

cathnan wrote I also want to establish a white-list of common names which are allowed to connect. The only way I know to realise this is by running a perl script with tls-verify

Using --ccd-exclusive ought to address this issue ..

cathnan wroteI couldn't find a way yet how I can start the script while using chroot at the same time

I suggest you address these issues one at a time .. using --chroot is fraught with problems so leave it till last.

cathnan

Hello Traffic and thanks for your answer.

I read the the article you've linked, and if I understand it correctly, I only have to use the intermediate CA's for the ca file in order to only accept certificates signed by this intermediate CA. I've tried this and couldn't establish a connection even if all files were from the same CA. I have the following logs from this test.

Server:

Wed Feb 24 08:47:10 2016 us=886320 MULTI: multi_create_instance called
Wed Feb 24 08:47:10 2016 us=886385 192.168.1.4:1194 Re-using SSL/TLS context
Wed Feb 24 08:47:10 2016 us=886418 192.168.1.4:1194 LZO compression initialized
Wed Feb 24 08:47:10 2016 us=886517 192.168.1.4:1194 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:3 ]
Wed Feb 24 08:47:10 2016 us=886544 192.168.1.4:1194 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:143 ET:0 EL:3 AF:3/1 ]
Wed Feb 24 08:47:10 2016 us=886578 192.168.1.4:1194 Local Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Wed Feb 24 08:47:10 2016 us=886589 192.168.1.4:1194 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Wed Feb 24 08:47:10 2016 us=886610 192.168.1.4:1194 Local Options hash (VER=V4): '162b04de'
Wed Feb 24 08:47:10 2016 us=886635 192.168.1.4:1194 Expected Remote Options hash (VER=V4): '9e7066d2'
Wed Feb 24 08:47:10 2016 us=886666 192.168.1.4:1194 TLS: Initial packet from [AF_INET]192.168.1.4:1194, sid=f05c137f 8c7e7105
Wed Feb 24 08:47:12 2016 us=974968 192.168.1.4:1194 TLS: new session incoming connection from [AF_INET]192.168.1.4:1194
Wed Feb 24 08:47:15 2016 us=90804 192.168.1.4:1194 TLS: new session incoming connection from [AF_INET]192.168.1.4:1194

Client:

Wed Feb 24 09:47:13 2016 us=88093 Restart pause, 2 second(s)
Wed Feb 24 09:47:15 2016 us=89000 WARNING: file '/home/ovpn-gast1/Schreibtisch/intermediate-2/inter1/client1.key' is group or others accessible
Wed Feb 24 09:47:15 2016 us=89538 WARNING: file '/home/ovpn-gast1/Schreibtisch/intermediate-2/ta.key' is group or others accessible
Wed Feb 24 09:47:15 2016 us=89566 Control Channel Authentication: using '/home/ovpn-gast1/Schreibtisch/intermediate-2/ta.key' as a OpenVPN static key file
Wed Feb 24 09:47:15 2016 us=89589 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Feb 24 09:47:15 2016 us=89607 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Feb 24 09:47:15 2016 us=89635 LZO compression initialized
Wed Feb 24 09:47:15 2016 us=89724 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:3 ]
Wed Feb 24 09:47:15 2016 us=89794 Socket Buffers: R=[212992->131072] S=[212992->131072]
Wed Feb 24 09:47:15 2016 us=89849 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:143 ET:0 EL:3 AF:3/1 ]
Wed Feb 24 09:47:15 2016 us=89905 Local Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Wed Feb 24 09:47:15 2016 us=89932 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Wed Feb 24 09:47:15 2016 us=89960 Local Options hash (VER=V4): '9e7066d2'
Wed Feb 24 09:47:15 2016 us=89984 Expected Remote Options hash (VER=V4): '162b04de'
Wed Feb 24 09:47:15 2016 us=90003 UDPv4 link local (bound): [undef]
Wed Feb 24 09:47:15 2016 us=90022 UDPv4 link remote: [AF_INET]192.168.1.5:1194
Wed Feb 24 09:47:15 2016 us=91940 TLS Error: Unroutable control packet received from [AF_INET]192.168.1.5:1194 (si=3 op=P_CONTROL_V1)
Wed Feb 24 09:47:15 2016 us=92348 TLS Error: Unroutable control packet received from [AF_INET]192.168.1.5:1194 (si=3 op=P_CONTROL_V1)
Wed Feb 24 09:47:16 2016 us=151658 TLS Error: Unroutable control packet received from [AF_INET]192.168.1.5:1194 (si=3 op=P_CONTROL_V1)
Wed Feb 24 09:47:16 2016 us=151818 TLS Error: Unroutable control packet received from [AF_INET]192.168.1.5:1194 (si=3 op=P_CONTROL_V1)
Wed Feb 24 09:47:17 2016 us=212183 TLS Error: Unroutable control packet received from [AF_INET]192.168.1.5:1194 (si=3 op=P_CONTROL_V1)
Wed Feb 24 09:47:17 2016 us=212736 TLS Error: Unroutable control packet received from [AF_INET]192.168.1.5:1194 (si=3 op=P_CONTROL_V1)
Wed Feb 24 09:47:17 2016 us=213779 TLS Error: Unroutable control packet received from [AF_INET]192.168.1.5:1194 (si=3 op=P_ACK_V1)
Wed Feb 24 09:47:18 2016 us=273386 TLS Error: Unroutable control packet received from [AF_INET]192.168.1.5:1194 (si=3 op=P_CONTROL_V1)
Wed Feb 24 09:47:18 2016 us=273554 TLS Error: Unroutable control packet received from [AF_INET]192.168.1.5:1194 (si=3 op=P_CONTROL_V1)
Wed Feb 24 09:47:19 2016 us=333571 TLS Error: Unroutable control packet received from [AF_INET]192.168.1.5:1194 (si=3 op=P_CONTROL_V1)
Wed Feb 24 09:47:19 2016 us=333672 TLS Error: Unroutable control packet received from [AF_INET]192.168.1.5:1194 (si=3 op=P_CONTROL_V1)
Wed Feb 24 09:47:20 2016 us=394375 TLS Error: Unroutable control packet received from [AF_INET]192.168.1.5:1194 (si=3 op=P_CONTROL_V1)
Wed Feb 24 09:47:21 2016 us=487326 TLS Error: Unroutable control packet received from [AF_INET]192.168.1.5:1194 (si=3 op=P_CONTROL_V1)
Wed Feb 24 09:47:21 2016 us=491011 TLS Error: Unroutable control packet received from [AF_INET]192.168.1.5:1194 (si=3 op=P_ACK_V1)
Wed Feb 24 09:47:22 2016 us=583219 TLS Error: Unroutable control packet received from [AF_INET]192.168.1.5:1194 (si=3 op=P_CONTROL_V1)
Wed Feb 24 09:47:24 2016 us=767264 TLS Error: Unroutable control packet received from [AF_INET]192.168.1.5:1194 (si=3 op=P_CONTROL_V1)
Wed Feb 24 09:47:25 2016 us=860572 TLS Error: Unroutable control packet received from [AF_INET]192.168.1.5:1194 (si=3 op=P_CONTROL_V1)
Wed Feb 24 09:47:26 2016 us=955180 TLS Error: Unroutable control packet received from [AF_INET]192.168.1.5:1194 (si=3 op=P_CONTROL_V1)
Wed Feb 24 09:47:27 2016 us=304967 event_wait : Interrupted system call (code=4)
Wed Feb 24 09:47:27 2016 us=305080 TCP/UDP: Closing socket
Wed Feb 24 09:47:27 2016 us=305883 SIGINT[hard,] received, process exiting

The ccd-exclusive command works perfectly. So I won't have to deal with scripts. Thank you for that 😃 . I still would really like to know if I'm right with the certificates. Should it work the way I said above?