NethServer 6

• certificate management with web UI
• web ui plugin to enable/disable VPN access for system users

See nethserver-vpn for more information.

• nethserver-vpn-1.0.0-1.ns6.noarch.rpm

1. try to enable/disable VPN access for an existing (or new) user and check the value of VPNClientAccess prop values changes accordingly
2. create a certificate and check all files are created inside /var/lib/nethserver/certs/ directory: <index>.pem, <name>.crt, <name>.key, <name>.csr
3. revoke a certificate and check it is no more valid in /var/lib/nethserver/certs/certindex file

• If the user tries to create a certificate with an already existing name, there are two scenarios:
  • if the previous certificate is expired, the system will create a new one without error (the old one will not be visible inside the table view)
  • if the previous certificate is still valid, the system will silently fail: no new certificate is created
• Revoked certificates will be not deleted
• The certificate name is not validated (which rules can we apply?)

Test 1 PASS

Try to enable/disable VPN access for an existing (or new) user and check the value of VPNClientAccess prop values changes accordingly

Created new user01 with defaults:

    # db accounts show user01
user01=user
    City=
    Company=
    Department=
    FirstName=Primo
    LastName=Utente
    PhoneNumber=
    Street=
    Uid=5000
    __state=active

Enabled "VPN access":

# db accounts show user01
user01=user
    City=
    Company=
    Department=
    FirstName=Primo
    LastName=Utente
    PhoneNumber=
    Shell=/usr/libexec/openssh/sftp-server
    Street=
    Uid=5000
    VPNClientAccess=yes
    __state=active

Disabled "VPN access":

# db accounts show user01
user01=user
    City=
    Company=
    Department=
    FirstName=Primo
    LastName=Utente
    PhoneNumber=
    Shell=/usr/libexec/openssh/sftp-server
    Street=
    Uid=5000
    VPNClientAccess=no
    __state=active

Test 2 NEEDINFO, FAILED

Create a certificate and check all files are created inside /var/lib/nethserver/certs/ directory: <index>.pem, <name>.crt, <name>.key, <name>.csr

Files are there, BUT..:

     ll /var/lib/nethserver/certs/cert??.*
-rw-r--r--. 1 root root    0 Aug 30 10:38 /var/lib/nethserver/certs/cert01.crt
-rw-r--r--. 1 root root 1070 Aug 30 10:38 /var/lib/nethserver/certs/cert01.csr
-rw-r--r--. 1 root root 1704 Aug 30 10:38 /var/lib/nethserver/certs/cert01.key

... But are world-readable. Is that correct?

• CA-related files (e.g. /var/lib/nethserver/vpn/)
• certificates (e.g. /var/lib/nethserver/vpn/certs/)

Also the script exits with code 1. In /var/log/messages:

Aug 30 11:04:47 davidep2 httpd-admin: [ERROR] NethServer\Module\VPN\Certificates\Create: /usr/bin/sudo /usr/libexec/nethserver/pki-vpn-gencert davide01 command failed

Launching it on the command line:

    # /usr/bin/sudo /usr/libexec/nethserver/pki-vpn-gencert davide02
[...]
    # echo $?
1

Test 3 FAIL

Revoke a certificate and check it is no more valid in /var/lib/nethserver/certs/certindex file

Seems OK, but somtimes the revocation fails.

    # /usr/libexec/nethserver/pki-vpn-revoke cert07
Using configuration from /var/lib/nethserver/certs/ca.cnf
unable to load certificate
140340791342920:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:698:Expecting: TRUSTED CERTIFICATE
Using configuration from /var/lib/nethserver/certs/ca.cnf
    # echo $?
1

It happens that a *.crt file has a zero-length. I don't know why it is empty and how to reproduce.

    # ll /var/lib/nethserver/certs/cert07.*
-rw-r--r--. 1 root root    0 Aug 30 11:04 /var/lib/nethserver/certs/cert07.crt
-rw-r--r--. 1 root root 1070 Aug 30 11:04 /var/lib/nethserver/certs/cert07.csr
-rw-r--r--. 1 root root 1704 Aug 30 11:04 /var/lib/nethserver/certs/cert07.key

About NOTES:

The certificate name is not validated (which rules can we apply?)

I've tried to create a certificate with name "../db/prova":

    # ll /var/lib/nethserver/db
total 24
-rw-r-----. 1 root admin  410 Aug 30 10:29 accounts
-rw-r-----. 1 root admin 2235 Aug 30 10:23 configuration
-rw-r-----. 1 root admin  409 Aug 29 09:00 networks
-rw-r--r--. 1 root root  1387 Aug 30 10:54 prova.crt
-rw-r--r--. 1 root root  1078 Aug 30 10:54 prova.csr
-rw-r--r--. 1 root root  1704 Aug 30 10:54 prova.key

A name validator is mandatory!

... But are world-readable. Is that correct?

Only crt files should be world readable. All the rest will be readable only from root user and admin group.

Also the script exits with code 1. In /var/log/messages:[...]

The script fails if user tries to generate a certificate with a name of a valid and already existing certificate.

Revoke a certificate and check it is no more valid in /var/lib/nethserver/certs/certindex file

Seems OK, but somtimes the revocation fails.[...]

I'll try to reproduce it.

A name validator is mandatory!

I agree. We can use username validator.

• web ui: validate certificate CN using username validator
• pki-vpn-revoke: check if certificate is already revoked
• pki-vpn-gencert: check if certificate already exists, change mode and owner to private key file (mode 0640, root:admin). Also fix wrong exit code.

New package in nethserver-testing: nethserver-vpn-1.0.0-3.0git91b39fa4.ns6.noarch.rpm

Re-check test 2 and 3.

VERIFIED

Verify modifications since nethserver-vpn|0ce2c20a

VERIFIED

nethserver-vpn-1.0.0-27.0git3d3df062.ns6.noarch
nethserver-openvpn-0.0.1-37.0git7154fc0c.ns6.noarch

In nethserver-updates:
nethserver-vpn-1.1.0-1.ns6.noarch.rpm