SlackwareThis Forum is for the discussion of Slackware Linux.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
After yesterday's openvpn update, none of my connection works anymore.
I have a dozen of different configs, most are coming from pfsense firewalls, some from mikrotik appliances.
Code:
# sudo /usr/sbin/openvpn config.ovpn
2023-03-09 09:01:31 WARNING: file 'cert.p12' is group or others accessible
2023-03-09 09:01:31 OpenVPN 2.6.0 x86_64-slackware-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
2023-03-09 09:01:31 library versions: OpenSSL 3.0.8 7 Feb 2023, LZO 2.10
Enter Auth Username:fabio
Enter Auth Password:
2023-03-09 09:01:59 WARNING: --ns-cert-type is DEPRECATED. Use --remote-cert-tls instead.
Enter Private Key Password:
2023-03-09 09:02:04 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2023-03-09 09:02:04 OpenSSL: error:0308010C:digital envelope routines::unsupported
2023-03-09 09:02:04 OpenSSL: error:11800071:PKCS12 routines::mac verify failure
2023-03-09 09:02:04 Decoding PKCS12 failed. Probably wrong password or unsupported/legacy encryption
2023-03-09 09:02:04 Error: private key password verification failed
2023-03-09 09:02:04 Exiting due to fatal error
So, openssl3 disabled support for some legacy crypto providers
This can be reenabled (at the expense of security) in /etc/ssl/openssl.cnf adding the following values:
Code:
[provider_sect]
default = default_sect
# add legacy provider
legacy = legacy_sect
...
# enable both the default and the legacy providers
[default_sect]
activate = 1
[legacy_sect]
activate = 1
A more long term solution is to reencrypt the certificate keyfiles with the new openssl:
After yesterday's openvpn update, none of my connection works anymore.
I have a dozen of different configs, most are coming from pfsense firewalls, some from mikrotik appliances.
Code:
# sudo /usr/sbin/openvpn config.ovpn
2023-03-09 09:01:31 WARNING: file 'cert.p12' is group or others accessible
2023-03-09 09:01:31 OpenVPN 2.6.0 x86_64-slackware-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
2023-03-09 09:01:31 library versions: OpenSSL 3.0.8 7 Feb 2023, LZO 2.10
Enter Auth Username:fabio
Enter Auth Password:
2023-03-09 09:01:59 WARNING: --ns-cert-type is DEPRECATED. Use --remote-cert-tls instead.
Enter Private Key Password:
2023-03-09 09:02:04 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2023-03-09 09:02:04 OpenSSL: error:0308010C:digital envelope routines::unsupported
2023-03-09 09:02:04 OpenSSL: error:11800071:PKCS12 routines::mac verify failure
2023-03-09 09:02:04 Decoding PKCS12 failed. Probably wrong password or unsupported/legacy encryption
2023-03-09 09:02:04 Error: private key password verification failed
2023-03-09 09:02:04 Exiting due to fatal error
I don't have time to debug this right now, will probably do it later.
Downgrading to the previous package works.
It seems that openvpn needs to be recompiled against openssl 3 (that's what others do: fedora, arch, opensuse)
Is the issue with Openvpn only if you have installed Openvpn Source? I updated Slackware current - about a week ago - and am running Opevnpn 2.6.0 and Openssl 1.1.1 on the Servers. I don't seem to have openssl3 installed on my Slackware systems. My openvpn connections are working perfectly and are using openssl 1.1.1, although admittedly the clients are still running Openvpn 2.5.8. My openvpn is installed along with all the other Slackware packages, so is updated every time I run slackpkg upgrade-all.
I have looked at the documentation of Openvpn and it's really unclear when Openvpn uses Openssl 3 and when it uses Openssl 1.1.1. I don't know if its the version of the server or the client package that is important here or something else that makes openvpn use 1.1.1 or ver 3?
I created my certificates/keys last year using openssl 1.1.1. I only updated slackware Serviers about a week ago and no issues with anyone connecting to any of the Openvpn Servers.
Is the issue with Openvpn only if you have installed Openvpn Source?
Nope, the problem is the use of legacy ciphers that have been disabled by default on openssl3.
These ciphers can be used both for encrypting the connection or, if you use a certificate, to encrypt the private key.
To determine the openvpn/openssl version you are using, just look at the start of the connection log:
Nope, the problem is the use of legacy ciphers that have been disabled by default on openssl3.
These ciphers can be used both for encrypting the connection or, if you use a certificate, to encrypt the private key.
To determine the openvpn/openssl version you are using, just look at the start of the connection log:
I understand why the error is occurring. What I was asking is under what circumstances does Opevnpn use Openssl 3 as opposed to Openssl 1.1.1?
My servers are running Openvpn 2.6.0 (exactly like your version). Yet my system is using Openssl 1.1.1. Why is mine using openssl 1.1.1 and yours is using Openssl 3, when we are both running the same server version?
I understand why the error is occurring. What I was asking is under what circumstances does Opevnpn use Openssl 3 as opposed to Openssl 1.1.1?
My servers are running Openvpn 2.6.0 (exactly like your version). Yet my system is using Openssl 1.1.1. Why is mine using openssl 1.1.1 and yours is using Openssl 3, when we are both running the same server version?
This is a very good question!
How about you open your own thread about this problem and stop derailing this changelog thread?
l/serf-1.3.9-x86_64-8.txz: Rebuilt.
Recompiled against openssl-3.0.8.
Implicit declaration of ERR_GET_FUNC (no more available on openssl-3) while compiling, so subversion fails to link:
Code:
buckets/ssl_buckets.c:1329:24: warning: implicit declaration of function 'ERR_GET_FUNC'; did you mean 'ERR_GET_LIB'? [-Wimplicit-function-declaration]
1329 | ERR_GET_FUNC(err),
| ^~~~~~~~~~~~
| ERR_GET_LIB
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
