Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Match Client config to server config, and allow client config statements #189

Open
jgitlin-p21 opened this issue May 11, 2021 · 2 comments · May be fixed by #190
Open

Match Client config to server config, and allow client config statements #189

jgitlin-p21 opened this issue May 11, 2021 · 2 comments · May be fixed by #190
Labels
Feature Request Enhancement to existing functionality or new functionality

Comments

@jgitlin-p21
Copy link
Contributor

🙍‍♂️ Problem Statement

When supplying server options like cipher, and auth, the client config does not get the same options leading to warnings in the OpenVPN log. Also, there's no way to configure clients with options like static-challenge without using push options. Some options, like compression, conflict because the client template has comp-lzo hard coded.

This could arguably be a bug report too 🤷

Example openVPN warnings:

Mon May 10 16:27:50 2021 47.134.251.53:20381 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1550', remote='link-mtu 1542'
Mon May 10 16:27:50 2021 47.134.251.53:20381 WARNING: 'cipher' is used inconsistently, local='cipher AES-256-GCM', remote='cipher BF-CBC'
Mon May 10 16:27:50 2021 47.134.251.53:20381 WARNING: 'auth' is used inconsistently, local='auth [null-digest]', remote='auth SHA1'
Mon May 10 16:27:50 2021 47.134.251.53:20381 WARNING: 'keysize' is used inconsistently, local='keysize 256', remote='keysize 128'

❔ Possible Solution

I would like templates/client.conf.erb to allow comp-lzo, cipher, auth, keysize and others to be configurable using variables (ideally matching the same as the node attributes from the server side, if set) and allow me to specify other options, like static-challenge

⤴️ Describe alternatives you've considered

I have considered simply generating my own client configs using template resources in my wrapper cookbooks, but submitting a PR upstream seems like a more sensible approach

➕ Additional context

N/A
@jgitlin-p21 jgitlin-p21 added the Feature Request Enhancement to existing functionality or new functionality label May 11, 2021
@jgitlin-p21
Copy link
Contributor Author

I'm about to start on a PR for this issue, because I need the change for myself. Will update issue with PR when ready!

@jgitlin-p21
Copy link
Contributor Author

I almost have my code ready for a PR. Thanks to help in #sous-chefs I realized that the "allow me to specify other options, like static-challenge" portion of my request is actually possible, using a node attribute I didn't realize how to use. So I'll address that portion with a README update.

I hope to submit a PR within the next few days

jgitlin-p21 added a commit to jgitlin-p21/openvpn that referenced this issue May 14, 2021
@jgitlin-p21
Make client settings match server settings and improve docs (sous-che…
b15a454 
…fs#189)

As described in issue sous-chefs#198, make settings in the client configs (E.G.
`auth`, `cipher`, `compress`, etc) match their server counterparts. This
eliminates warnings in the OpenVPN log about inconsistent option usage.

In addition, document how the `openvpn_user` resource works, including
showing how aditional configuration options can be added to client conf
files (using `additional_vars` and `cookbook_user_conf`)

Squashed commit of the following:

commit eda83e5
Author: Josh Gitlin <jgitlin@pinnacle21.com>
Date:   Fri May 14 12:05:37 2021 -0400

    Added documentation for vpn_user resource

commit 61172d8
Author: Josh Gitlin <jgitlin@pinnacle21.com>
Date:   Thu May 13 21:48:09 2021 -0400

    Make client settings match server settings

commit c14d15a
Author: Josh Gitlin <jgitlin@pinnacle21.com>
Date:   Tue May 11 21:36:18 2021 -0400

    Add compression to client configs

Signed-off-by: Josh Gitlin <jgitlin@pinnacle21.com>
jgitlin-p21 added a commit to jgitlin-p21/openvpn that referenced this issue May 14, 2021
@jgitlin-p21
Make client settings match server settings and improve docs (sous-che…
b69bfeb 
…fs#189)

As described in issue sous-chefs#198, make settings in the client configs (E.G.
`auth`, `cipher`, `compress`, etc) match their server counterparts. This
eliminates warnings in the OpenVPN log about inconsistent option usage.

In addition, document how the `openvpn_user` resource works, including
showing how aditional configuration options can be added to client conf
files (using `additional_vars` and `cookbook_user_conf`)

Squashed commit of the following:

commit dab2949
Author: Josh Gitlin <jgitlin@pinnacle21.com>
Date:   Fri May 14 14:33:29 2021 -0400

    Cookstyle fixes

commit d587ae1
Author: Josh Gitlin <jgitlin@pinnacle21.com>
Date:   Fri May 14 14:31:33 2021 -0400

    MDL fixes

commit eda83e5
Author: Josh Gitlin <jgitlin@pinnacle21.com>
Date:   Fri May 14 12:05:37 2021 -0400

    Added documentation for vpn_user resource

commit 61172d8
Author: Josh Gitlin <jgitlin@pinnacle21.com>
Date:   Thu May 13 21:48:09 2021 -0400

    Make client settings match server settings

commit c14d15a
Author: Josh Gitlin <jgitlin@pinnacle21.com>
Date:   Tue May 11 21:36:18 2021 -0400

    Add compression to client configs

Signed-off-by: Josh Gitlin <jgitlin@pinnacle21.com>
@jgitlin-p21 jgitlin-p21 linked a pull request May 14, 2021 that will close this issue
Open
3 tasks
jgitlin-p21 added a commit to jgitlin-p21/openvpn that referenced this issue May 14, 2021
@jgitlin-p21
Match client and server conf; improve docs (sous-chefs#189)
88cf4a5 
As described in issue sous-chefs#198, make settings in the client configs (E.G.
`auth`, `cipher`, `compress`, etc) match their server counterparts. This
eliminates warnings in the OpenVPN log about inconsistent option usage.

In addition, document how the `openvpn_user` resource works, including
showing how additional configuration options can be added to client conf
files (using `additional_vars` and `cookbook_user_conf`)

Squashed commit of the following:

commit 91542b9
Author: Josh Gitlin <jgitlin@pinnacle21.com>
Date:   Fri May 14 15:04:28 2021 -0400

    Add changelog entry

commit 858f41c
Author: Josh Gitlin <jgitlin@pinnacle21.com>
Date:   Fri May 14 15:00:21 2021 -0400

    Bugfix node name

commit dab2949
Author: Josh Gitlin <jgitlin@pinnacle21.com>
Date:   Fri May 14 14:33:29 2021 -0400

    Cookstyle fixes

commit d587ae1
Author: Josh Gitlin <jgitlin@pinnacle21.com>
Date:   Fri May 14 14:31:33 2021 -0400

    MDL fixes

commit eda83e5
Author: Josh Gitlin <jgitlin@pinnacle21.com>
Date:   Fri May 14 12:05:37 2021 -0400

    Added documentation for vpn_user resource

commit 61172d8
Author: Josh Gitlin <jgitlin@pinnacle21.com>
Date:   Thu May 13 21:48:09 2021 -0400

    Make client settings match server settings

commit c14d15a
Author: Josh Gitlin <jgitlin@pinnacle21.com>
Date:   Tue May 11 21:36:18 2021 -0400

    Add compression to client configs

Signed-off-by: Josh Gitlin <jgitlin@pinnacle21.com>
@ramereth ramereth linked a pull request Jun 17, 2021 that will close this issue
Make client settings match server settings and improve docs (#189) #190
Open
3 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Feature Request Enhancement to existing functionality or new functionality
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Make client settings match server settings and improve docs (#189) jgitlin-p21/openvpn
1 participant
@jgitlin-p21