Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
Name: ocserv | Distribution: openSUSE:Factory:zSystems |
Version: 1.2.2 | Vendor: openSUSE |
Release: 1.1 | Build date: Sat Sep 30 07:52:54 2023 |
Group: Productivity/Networking/Security | Build host: s390zl2a |
Size: 783615 | Source RPM: ocserv-1.2.2-1.1.src.rpm |
Packager: https://bugs.opensuse.org | |
Url: https://ocserv.gitlab.io/www/ | |
Summary: OpenConnect VPN Server |
OpenConnect server (ocserv) is an SSL VPN server. Its purpose is to be a secure, small, fast and configurable VPN server. It implements the OpenConnect SSL VPN protocol, and has also (currently experimental) compatibility with clients using the AnyConnect SSL VPN protocol. The OpenConnect protocol provides a dual TCP/UDP VPN channel, and uses the standard IETF security protocols to secure it. The server is implemented primarily for the GNU/Linux platform but its code is designed to be portable to other UNIX variants as well. Ocserv's main features are security through privilege separation and sandboxing, accounting, and resilience due to a combined use of TCP and UDP. Authentication occurs in an isolated security module process, and each user is assigned an unprivileged worker process, and a networking (tun) device. That not only eases the control of the resources of each user or group of users, but also prevents data leak (e.g., heartbleed-style attacks), and privilege escalation due to any bug on the VPN handling (worker) process. A management interface allows for viewing and querying logged-in users.
GPL-2.0-only
* Mon Sep 25 2023 Martin Hauke <mardnh@gmx.de> - Update to version 1.2.2 * Fix session and accounting data tracking of ocserv. This reverts fix for #444 (#541) * No longer account ICMP and IGMP data for idle session detection - Update URL * Tue Aug 29 2023 Martin Hauke <mardnh@gmx.de> - Update to version 1.2.1 * Accept the Clavister OneConnect VPN Android client. * No longer require to set device name per vhost. * Account the correct number of points when proxyproto is in use * nuttcp tests were replaced with iperf3 that is available in more environments * occtl: fix duplicate key in `occtl --json show users` output - Update to version 1.2.0 * Add support for Cisco Enterprise phones to authenticate via the /svc endpoint and the 'cisco-svc-client-compat' config option. * Enhanced radius group support to enable radius servers send multiple group class attributes See doc/README-radius.md for more information. * Enhanced the seccomp filters to open files related to FIPS compliance on SuSe. * Added "Camouflage" functionality that makes ocserv look like a web server to unauthorized parties. * Avoid login failure when the end point of server URI contains a query string. * Make sure we print proper JSON with `occtl --debug --json` * Eliminated the need for using the gnulib portability library. - Update to version 1.1.7 * Emit a LOG_ERR error message with plain authentication fails * The bundled inih was updated to r56. * The bundled protobuf-c was updated to 1.4.1. * Enhanced the seccomp filters for ARMv7 compatibility and musl libc * HTTP headers always capitalised as in RFC 9110 * Wed Jan 18 2023 Matthias Gerstner <matthias.gerstner@suse.com> - add ocserv-forwarding.sh: replace the sysctl drop-in file which was wrongly installed into /etc by a more tailored mechanism. Enabling IP routing globally and permanently, just because the package is installed is quite invasive. This new script will be invoked before and after the ocserv service to switch on and off forwarding, if necessary (bsc#1174722). * Sun Aug 14 2022 Michael Du <duyizhaozj321@yahoo.com> - Update to version 1.1.6 * Fixed compatibility with clients on Windows ARM64. * Added futex() to the accepted list of seccomp. It is required by Fedora 36’s libc. * Work around change of returned error code in GnuTLS 3.7.3 for gnutls_privkey_import_x509_raw(). - Changes in version 1.1.5 * Fixed manpage output. - Changes in version 1.1.4 * Added newfstatat() and epoll_pwait() to the accepted list of seccomp calls. This improves compatibility with certain libcs and aarch64. * Do not allow assigning the same IPv6 as tun device address and to the client. This allows using /127 as prefix (#430). * Mon Jun 20 2022 Dominique Leuenberger <dimstar@opensuse.org> - explicitly buildignore libevent-devel, which is pulled in by ubound. We use libev here and can get away with this. * Sat Jun 05 2021 Martin Hauke <mardnh@gmx.de> - Update to version 1.1.3 * No longer close stdin and stdout on worker processes as they are already closed in main process. * Advertise X-CSTP-Session-Timeout. * No longer recommend building with system's libpcl but rather the bundled as it is not a very common shared library. * Corrected busyloop on failed DTLS handshakes. * Emit OWASP best practice headers for HTTP. * Mon Dec 07 2020 Martin Hauke <mardnh@gmx.de> - Update to version 1.1.2 * Allow setup of new DTLS session concurrent with old session. * Fixed an infinite loop on sec-mod crash when server-drain-ms is set. * Don't apply BanIP checks to clients on the same subnet. * Don't attempt TLS if the client closes the connection with zero data sent. * Increased the maximum configuration line; this allows banner messages longer than 200 characters. * Removed the listen-clear-file config option. This option was incompatible with several clients, and thus is unusable for a generic server. * Mon Sep 21 2020 Martin Hauke <mardnh@gmx.de> - Update to version 1.1.1: * Improved rate-limit-ms and made it dependent on secmod backlog. This makes the server more resilient (and prevents connection failures) on multiple concurrent connections - Added namespace support for listen address by introducing the listen-netns option. - Disable TLS1.3 when cisco client compatibility is enabled. New anyconnect clients seem to supporting TLS1.3 but are unable to handle a client with an RSA key. - Enable a race free user disconnection via occtl. - Added the config option of a pre-login-banner. - Ocserv siwtched to using multiple ocserv-sm processes to improve scale, with the number of ocserv-sm process dependent on maximum clients and number of CPUs. Configuration option sec-mod-scale can be used to override the heuristics. - Fixed issue with group selection on radius servers sending multiple group class attribute. - Update patch: * ocserv-enable-systemd.patch * ocserv.config.patch * Wed Aug 19 2020 Callum Farmer <callumjfarmer13@gmail.com> - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) * Fri Jul 03 2020 Michael Du <duyizhaozj321@yahoo.com> - Update to version 1.1.0: * Switch from fork to fork/exec model to achieve better scaling and ASLR protection. This introduces an ocserv-worker application which should be installed at the same path as ocserv (#285). * When Linux OOM takes control kill ocserv workers before ocserv-main or ocserv-secmod (#283). * Disable TCP queuing on the TLS port. * Fix leak of GnuTLS session when DTLS connection is re-established (#293). - Verify source with keyring before build. * Tue Apr 21 2020 Martin Hauke <mardnh@gmx.de> - Add signature and keyring for source verification - Build with support for maxminddb - Build with support for OATH - Update to version 1.0.1 * Prevent clients that use broken versions of gnutls from connecting using DTLS. * occtl: added machine-readable fields in json output. * occtl: IPs in ban list value is now reflecting the actual banned IPs rather than the database size. - Update to version 1.0.0 * Avoid crash on invalid configuration values. * Updated manpage generation to work with newer versions of ronn. * Ensure scripts have all the information on all disconnection types. * Several updates to further restrict the control that worker processes have on the main process. * Add support for RFC6750 bearer tokens. This adds the "auth=oidc" config option. See doc/README-oidc.md for more information. * Add USER_AGENT, DEVICE_TYPE and DEVICE_PLATFORM environment variables when connect/disconnect scripts execute. * Corrected issue with DTLS-PSK negotiation which prevented it from being enabled. * Improved IPv6 handling of AnyConnect client for Apple ios. * Fixed issue with Radius accounting. - Update to version 0.12.6 * Improved IPv6 support for anyconnect clients. * The 'split-dns' configuration directive can be used per-user. * The max-same-clients=1 configuration option no longer refuses the reconnection of an already connected user. * Added openat() to the accepted list of seccomp calls. This allows ocserv to run under certain libcs. - Update to version 0.12.5 * Added configuration option udp-listen-host. This option supports different listen addresses for tcp and udp such as haproxy for tcp, but support dtls at the same time. * occtl: fixed json output of show status command. Introduced tests for checking its json output using yajl. * occtl: use maxminddb when available. - Update to version 0.12.4 * Added support for radius access-challenge (multifactor) authentication. * Fixed race condition when connect-script and disconnect-script are set, which could potentially cause a crash. * Perform quicker cleanup of sessions which their user explicitly disconnected.
/etc/ocserv /etc/ocserv/README.SUSE /etc/ocserv/certificates /etc/ocserv/certificates/ca.tmpl /etc/ocserv/certificates/server.tmpl /etc/ocserv/certificates/user.tmpl /etc/ocserv/ocpasswd /etc/ocserv/ocserv.conf /usr/bin/occtl /usr/bin/ocpasswd /usr/bin/ocserv-fw /usr/bin/ocserv-script /usr/lib/firewalld /usr/lib/firewalld/services /usr/lib/firewalld/services/ocserv.xml /usr/lib/systemd/system/ocserv.service /usr/lib/systemd/system/ocserv.socket /usr/sbin/ocserv /usr/sbin/ocserv-forwarding /usr/sbin/ocserv-worker /usr/share/doc/packages/ocserv /usr/share/doc/packages/ocserv/AUTHORS /usr/share/doc/packages/ocserv/NEWS /usr/share/doc/packages/ocserv/README.md /usr/share/licenses/ocserv /usr/share/licenses/ocserv/COPYING /usr/share/man/man8/occtl.8.gz /usr/share/man/man8/ocpasswd.8.gz /usr/share/man/man8/ocserv.8.gz
Generated by rpm2html 1.8.1
Fabrice Bellet, Sat Mar 9 12:50:11 2024