Re: [pfSense] OpenVPN Support Forum • Critical denial of service vulnerability in OpenVPN servers : Announcements

2014-12-04 Thread Vick Khera
On Tue, Dec 2, 2014 at 10:55 AM, Adrian Zaugg a...@ente.limmat.ch wrote:

 You also can find details here:

 https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-97597e732b



So basically unless you give out TLS certificates to your openvpn to
unknown/untrustworthy entities, your risk is pretty low.
___
List mailing list
List@lists.pfsense.org
https://lists.pfsense.org/mailman/listinfo/list

Re: [pfSense] OpenVPN Non-admin users.

2014-12-04 Thread Karl Fife

Somehow I overlooked that option. Needless fussing.

Enabling the OpenVPNManager by default seems like it could be a 
reasonable option considering that all supported versions of Windows 
(Vista/7/8/[10]) require users (even admins) to elevate the OpenVPN 
client (and/or create an elevated shortcut).


Is this not default because it's currently incompatible with the 64-bit 
OpenVPN installer?  If so, is there any practical downside to running 
the 32 bit installer on a 64 bit system?  Is there a practical downside 
to running the OpenVPNManager in lieu of an elevated shortcut?




On 12/2/2014 5:57 PM, Chris Buechler wrote:

On Tue, Dec 2, 2014 at 3:47 AM, Marijn Hofstra m.hofs...@detamboer.nl wrote:

   We add them to the Windows built-in Network Configuration
Operators

Do you know this to work with Windows 8 Enterprise (or Win 10
for that matter)?  I've seen this work in some versions of
Windows, but when we tried it in Win 8 Enterprise, it didn't
seem to work.  We didn't probe further, suspecting that it
was due to security changes in Windows =8.


I dealt with this issue recently, so I'll chime in for my $0.02.

This works for WinXP, but for Vista and newer, you really need the OpenVPN GUI 
add-on. IIRC, the particular security group no longer provides the desired 
permissions in Vista and newer.

With the GUI add-on, basically you ensure that the openvpn service is running 
(autostart) and add a few lines to your .ovpn config, something the likes of:



You can skip all that if you're using our OpenVPN Client Export
package, just check the OpenVPN Manager box and it takes care of all
that automatically.
___
List mailing list
List@lists.pfsense.org
https://lists.pfsense.org/mailman/listinfo/list


___
List mailing list
List@lists.pfsense.org
https://lists.pfsense.org/mailman/listinfo/list