Project

General

Profile

Actions

Feature #2904

closed

Add checkbox or default option for "verify_identifier on;" on IPsec RSA VPNs

Added by Jorge Albarenque over 11 years ago. Updated over 10 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
-
Category:
IPsec
Target version:
Start date:
03/24/2013
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Release Notes:

Description

The ASN1DN field on the "peers_identifier" option within racoon.conf can be used to specify which certificate or set of certificates should be allowed to connect. Anyway, for this to take effect, there's an additional option required on the racoon.conf file:

verify_identifier on;

The default value for this is off. I guess this can be set to always on without harm, and increased security. If the ASN1DN values are left blank, they will be taken and verified from the certificates themselves. If you specify an ASN1DN manually, it will be used for verification.

In case I am missing something else that might break by adding this as a default option, a checkbox to enable it will be great.

Check my post about the topic and the racoon.conf man page for more info.

Thanks!

Actions #1

Updated by Doktor Notor over 10 years ago

Guys, this is NOT a feature request, this is a major security issue! Can someone finally fix this?

https://forum.pfsense.org/index.php/topic,65002.0.html

Actions #2

Updated by Renato Botelho over 10 years ago

  • Status changed from New to Feedback
  • % Done changed from 0 to 100
Actions #3

Updated by Doktor Notor over 10 years ago

Yay! Excellent, works just fine.

Actions #4

Updated by Renato Botelho over 10 years ago

  • Status changed from Feedback to Resolved
Actions #5

Updated by Renato Botelho over 10 years ago

  • Category set to IPsec
  • Target version set to 2.1.1
  • Affected Version set to 2.1
Actions

Also available in: Atom PDF