Nikos Mavrogiannopoulos
e2585b2f26
unix-conn-file -> listen-file
2014-09-26 08:54:41 +02:00
Nikos Mavrogiannopoulos
bdcd27d13e
optional-certificate was renamed to certificate[optional]
2014-09-25 10:36:46 +02:00
Nikos Mavrogiannopoulos
365ca267d4
added new authentication mode optional-certificate
...
That mode allows having only specific group of users that are required
to present a certificate.
2014-09-24 12:41:31 +02:00
Nikos Mavrogiannopoulos
30bcf35576
Revert "license upgraded to GPLv3"
...
This reverts commit 213f9a63ee
2014-09-24 11:34:15 +02:00
Nikos Mavrogiannopoulos
f08612126d
doc update
2014-09-23 22:40:37 +02:00
Nikos Mavrogiannopoulos
4ea5a56ace
Allow the CSTP layer to operate without TLS
...
That also introduces a unix domain socket under which connections to the
server can occur.
2014-09-23 16:08:29 +02:00
Nikos Mavrogiannopoulos
b52c49f133
doc update
2014-08-28 09:58:51 +02:00
Nikos Mavrogiannopoulos
c781bea7cd
user-profile is now allowed in per-user configuration
2014-07-31 14:57:09 +02:00
Nikos Mavrogiannopoulos
6079cdb833
doc update
2014-06-28 22:59:29 +02:00
Nikos Mavrogiannopoulos
eb6e3fea81
doc update
2014-06-28 22:57:16 +02:00
Nikos Mavrogiannopoulos
def560ec75
doc: do not explicitly set serial number in generated certificate
...
That would allow certtool to use a random one.
2014-06-28 22:48:51 +02:00
Nikos Mavrogiannopoulos
caa98a05fd
document how to convert key to pkcs12 file
2014-06-26 08:29:54 +02:00
Nikos Mavrogiannopoulos
4117bf2661
Use a more terse, but with more dynamic information version string.
2014-06-23 21:09:43 +02:00
Nikos Mavrogiannopoulos
70623591d5
Seccomp is now compiled in by default, and can be enabled at run-time.
2014-06-12 15:35:45 +02:00
Nikos Mavrogiannopoulos
4a91581d92
doc update
2014-06-10 20:49:34 +02:00
Nikos Mavrogiannopoulos
28dca2aa0c
Added support for session control (relevant for PAM for now)
...
That in effect will utilize the pam_open_session() and pam_close_session().
It is disabled by default as it requires more resources from the security module.
2014-06-10 15:16:40 +02:00
Nikos Mavrogiannopoulos
01db3e5817
Include the SID into the cookie and store it in proc_st.
2014-06-10 10:41:10 +02:00
Nikos Mavrogiannopoulos
7ccdba8234
doc update
2014-05-27 16:04:53 +02:00
Nikos Mavrogiannopoulos
25fbdfbf70
Keep track of cookies internally.
...
That allows to restrict the cookie validity time to the absolutely minimum
required to establish and reconnect a recently disconnected session.
That deprecates the cookie-validity option and introduces the cookie-timeout
option.
2014-05-27 16:00:57 +02:00
Nikos Mavrogiannopoulos
7ba0fffb07
Added the configuration option deny-roaming.
...
That required moving the read of the group configuration during the
cookie authentication phase.
2014-05-25 10:17:28 +02:00
Nikos Mavrogiannopoulos
78132e2a6d
Added auto group listing on PAM authentication as well.
...
In addition a configuration option to print group IDs over a
certain number was added.
2014-05-23 16:36:48 +02:00
Nikos Mavrogiannopoulos
213f9a63ee
license upgraded to GPLv3
2014-05-23 11:50:56 +02:00
Nikos Mavrogiannopoulos
d51a7cb7e7
re-use the string replace API for route add/del replacements.
2014-05-23 11:32:07 +02:00
Nikos Mavrogiannopoulos
57d848d228
The replaced keywords were put into brackets.
2014-05-23 11:19:42 +02:00
Nikos Mavrogiannopoulos
0a1f5f0f55
The custom header options allows %U and %G.
2014-05-23 11:07:39 +02:00
Nikos Mavrogiannopoulos
28943341db
Added the proxy-url option to allow sending a proxy URL.
...
This corresponds to the X-CSTP-MSIE-Proxy-Pac-URL CSTP header.
2014-05-23 11:04:30 +02:00
Nikos Mavrogiannopoulos
2276acf57b
limit the cookie validity time to 3 hours in the configuration examples.
2014-05-22 13:48:09 +02:00
Nikos Mavrogiannopoulos
fce30e0513
doc update
2014-05-21 14:37:50 +02:00
Nikos Mavrogiannopoulos
177c1c95bd
Allow aliases to group names.
2014-05-21 12:25:26 +02:00
Nikos Mavrogiannopoulos
7133a1cf1b
mention the occtl tool instead of who -u
2014-05-20 17:49:12 +02:00
Nikos Mavrogiannopoulos
b6531feee8
Corrected certificate generation instructions.
2014-05-20 15:50:11 +02:00
Nikos Mavrogiannopoulos
2668fe63b4
Added the default-select-group directive.
2014-05-19 20:00:35 +02:00
Nikos Mavrogiannopoulos and Nikos Mavrogiannopoulos
4755ee48c5
Added the select-group and auto-select-group config options.
...
These options allow to prompt the user for a group prior to login.
That in addition enhances the password file format and multiple groups
can be specified on a comma separated list, as:
user:group1,group2,group3:$5$encodedpassword
2014-05-19 18:25:25 +02:00
Nikos Mavrogiannopoulos
6bc625df81
The route configuration directive accepts the keyword 'default'
...
In that case it will return a default route irrespective of any other
route directives. That allows overriding existing routes with a default
route for specific users and groups.
2014-05-19 09:58:37 +02:00
Nikos Mavrogiannopoulos
788560b9ce
Added default-user-config and default-group-config configuration options.
...
These allow setting a configuration file that will be loaded if a
user-specific or group-specific configuration file isn't found.
2014-05-14 13:27:51 +02:00
Nikos Mavrogiannopoulos
3f9a215f53
Allow for random and for predictable IP assignment.
2014-05-14 13:00:11 +02:00
Nikos Mavrogiannopoulos
1465a5922c
Added no-udp group configuration option.
...
That options allows disabling UDP for specific users or groups.
2014-05-12 10:29:29 +02:00
Nikos Mavrogiannopoulos
522a9c35a4
Allow modifying the default occtl socket file.
2014-05-11 14:16:38 +02:00
Nikos Mavrogiannopoulos
b0e10065a0
Support for the unix socket is now configurable.
2014-05-09 16:12:37 +02:00
Nikos Mavrogiannopoulos
d6583945f9
Added the STATS_DURATION script environment variable.
...
This variable reports the duration of the session in seconds.
2014-05-04 11:20:32 +02:00
Nikos Mavrogiannopoulos
d1e3b3f1b7
doc update
2014-05-01 14:11:47 +02:00
Nikos Mavrogiannopoulos
2a0cc77c2e
Export TUN device statistics from the worker process.
...
When a worker process terminates in authenticated state, then
export statistics from the tun device (currently bytes_in and
bytes_out). These statistics are sent to main process using an
informational message just prior to process exit. The statistics
are also exported to the disconnect script using the STATS_BYTES_IN
and STATS_BYTES_OUT environment variables.
2014-04-28 17:32:51 +02:00
Nikos Mavrogiannopoulos
8e73f98502
changed the default DPD time to 90 seconds, to prevent UDP port from changing in several NATs.
2014-04-19 08:30:10 +02:00
Nikos Mavrogiannopoulos
6410f6864c
The tun device will be closed only after the disconnect script has been called.
...
This allows gathering statistics from it. In addition, changed behavior of
script calling, and now will always contain the IP information.
2014-04-12 12:44:13 +02:00
Nikos Mavrogiannopoulos
c1c9680efb
document new behavior in calling disconnect script.
2014-04-12 08:50:28 +02:00
Nikos Mavrogiannopoulos
1185cb07ee
Execute disconnect script for user that their IP was hijacked by a cookie reconnection
...
This will prevent having the script be called to initiate connections
that are never disconnected. This patch also introduces IPV6_LOCAL and
IPV6_REMOTE script environment variables that allow passing both addresses
in case both IPv4 and IPv6 are assigned.
2014-04-12 08:43:10 +02:00
Nikos Mavrogiannopoulos
3137c507e2
doc update
2014-04-08 22:02:12 +02:00
Nikos Mavrogiannopoulos
9b36471d22
corrected name of crl template
2014-04-03 10:32:36 +02:00
Nikos Mavrogiannopoulos
f79fa04a83
doc update
2014-04-02 13:16:10 +02:00
Nikos Mavrogiannopoulos
d00319faf4
Updates in CRL handling.
...
Ensure reload on SIGHUP, and do print an appropriate error
when an empty CRL file is encountered.
2014-04-02 12:55:43 +02:00
