Duplicate common name



  • Why are my users allowed to use duplicate common names? It causes the OpenVPN server to alternate between the two connections according to the log, but both clients seem to work fine. How do I enforce a certificate only being used from one client at a time? I thought this was the default, since I didn't add the duplicate-cn option anywhere.



  • The OpenVPN server doesn't seem to be launched with that option set, so I don't know why I'm able to connect with duplicate common names. This is possible with UDP, right?

    
    # ps -x | grep "[o]penvpn"
      487  ??  Ss     0:22.78 openvpn --config /var/etc/openvpn_server0.conf
    # cat /var/etc/openvpn_server0.conf
    writepid /var/run/openvpn_server0.pid
    #user nobody
    #group nobody
    daemon
    keepalive 10 60
    ping-timer-rem
    persist-tun
    persist-key
    dev tun
    proto udp
    cipher BF-CBC
    up /etc/rc.filter_configure
    down /etc/rc.filter_configure
    server 10.3.0.0 255.255.255.0
    client-config-dir /var/etc/openvpn_csc
    push "route 10.4.0.0 255.255.254.0"
    lport 1194
    push "dhcp-option WINS 10.4.0.2"
    ca /var/etc/openvpn_server0.ca
    cert /var/etc/openvpn_server0.cert
    key /var/etc/openvpn_server0.key
    dh /var/etc/openvpn_server0.dh
    comp-lzo
    status /var/log/openvpn-status.log
    log-append  /var/log/openvpn.log
    local 192.168.0.1
    
    


  • The server seems to be doing an "inactivity timeout", restarting the client's connection every minute, alternating between the two duplicates.

    
    Wed Jan 20 16:15:42 2010 Initialization Sequence Completed
    Wed Jan 20 16:17:33 2010 [server] Inactivity timeout (--ping-restart), restarting
    Wed Jan 20 16:17:33 2010 TCP/UDP: Closing socket
    Wed Jan 20 16:17:33 2010 SIGUSR1[soft,ping-restart] received, process restarting
    Wed Jan 20 16:17:33 2010 Restart pause, 2 second(s)
    
    

    I will get this on client A one minute, then client B the next, then again on client A. If client A is connected, I would expect client B to simply fail to connect? Does it not work this way?



  • I figured it out. It was the "keepalive 10 60" option which is put in the server configuration automatically by pfsense. This should really be optional! That option in server mode is equivalent to:

    
    ping 10
    ping-restart 120
    push "ping 10"
    push "ping-restart 60"
    
    

    This tells the client to restart the connection if it goes 60 seconds without a ping from the server. If client A connects, then client B connects with the same common name, client A loses their connection. However, client A doesn't realize it lost its connection until it never receives a ping from the server, which then results in client A restarting. Then the same happens to client B, then back and forth. Why would this be the default? I had to edit openvpn.inc to remove the "keepalive" option, then push "ping-exit" to the client instead of "ping-restart".


Locked