Join Log in
Score:0
eagr avatar Server

openvpn communication during renegotiation

cn flag
eagr

I'm using openvpn setup where I implement custom authentication on the server with a auth-user-pass-verify script. This script accesses a remote server so the process usually takes 10-40 seconds. Additionally I have reneg-sec configured to renegotiate every 30 minutes.

The problem is that every time the renegotiation starts, the client connection is not working until the reneg ends. It makes a lot of sense to have the connection up until some configurable timeout on the reneg. I tried looking at hand-window or tran-window configs which seemed related but nothing helped.

Is there a way to maintain the connection during openvpn renegotiation process?

38
0 + 0
Score:0
avatar Server
in flag
Lacek

Try using the auth-gen-token 0 option. According to the doc

the OpenVPN server will with this option generate a temporary authentication token and push that to client. On the following renegotiations, the OpenVPN client will pass this token instead of the users password. On the server side the server will do the token authentication internally and it will NOT do any additional authentications against configured external user/password authentication mechanisms.

So this way the renegotiation will occur, but it will not call the long auth process, so it will not stall the connection.

0 + 0
eagr avatar
cn flag
eagr
Thanks for this info, didn't know about that option. Unfortunately I do want to verify on the remote server that the user is still authorized. So using this token is the same for me as not using reneg at all.
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.