<div dir="ltr"><div>Thanks Guus for the quick answer, I will give a try now.</div><div><br></div><div>Рысь,<br></div><div>In my case we don't want to restart tinc "server" at all, therefore what might </div><div>happen is that the client is still connected to server while its public key was already</div><div>removed from server.</div><div>I will try the signal approach.</div><div>Heng</div><div><br></div><br><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Jul 25, 2016 at 12:42 PM, <span dir="ltr"><<a href="mailto:tinc-request@tinc-vpn.org" target="_blank">tinc-request@tinc-vpn.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">Send tinc mailing list submissions to<br>
<a href="mailto:tinc@tinc-vpn.org">tinc@tinc-vpn.org</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc" rel="noreferrer" target="_blank">https://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:tinc-request@tinc-vpn.org">tinc-request@tinc-vpn.org</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:tinc-owner@tinc-vpn.org">tinc-owner@tinc-vpn.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of tinc digest..."<br>
<br>Today's Topics:<br>
<br>
1. How does tinc server handle the case one client's key file is<br>
removed after connection (Heng Wang)<br>
2. Re: How does tinc server handle the case one client's key<br>
file is removed after connection (Guus Sliepen)<br>
3. Re: Tinc and FIPS mode fails to connect. (Guus Sliepen)<br>
4. Re: Tinc 1.0.24 regulary disconnected (Guus Sliepen)<br>
5. Re: How does tinc server handle the case one client's key<br>
file is removed after connection (Рысь)<br>
<br><br>---------- Forwarded message ----------<br>From: Heng Wang <<a href="mailto:jason.wangh@gmail.com">jason.wangh@gmail.com</a>><br>To: <a href="mailto:tinc@tinc-vpn.org">tinc@tinc-vpn.org</a><br>Cc: <br>Date: Mon, 25 Jul 2016 12:16:36 -0400<br>Subject: How does tinc server handle the case one client's key file is removed after connection<br><div dir="ltr">Hi Guys,<div><br></div><div>Say when tinc is running all good, the "server" contains all the key files of clients. </div><div>If we remove the key file for client A during run, how long before does server find out the key </div><div>file is gone? I see a "KeyExpire" option in the conf file, is this the time?</div><div><br></div><div>In my own experiment, the client will still be able to connect to the tinc network even if the key file is being removed. Of course the connection will be gone if I restart tinc server on the client side.</div><div><br></div><div>Thank you.</div><div>Heng</div></div>
<br><br>---------- Forwarded message ----------<br>From: Guus Sliepen <<a href="mailto:guus@tinc-vpn.org">guus@tinc-vpn.org</a>><br>To: <a href="mailto:tinc@tinc-vpn.org">tinc@tinc-vpn.org</a><br>Cc: <br>Date: Mon, 25 Jul 2016 18:28:23 +0200<br>Subject: Re: How does tinc server handle the case one client's key file is removed after connection<br>On Mon, Jul 25, 2016 at 12:16:36PM -0400, Heng Wang wrote:<br>
<br>
> Say when tinc is running all good, the "server" contains all the key files<br>
> of clients.<br>
> If we remove the key file for client A during run, how long before does<br>
> server find out the key<br>
> file is gone? I see a "KeyExpire" option in the conf file, is this the time?<br>
<br>
KeyExpire is the time used for session keys, it doesn't apply to public<br>
keys loaded from config files.<br>
<br>
Normally tinc should reread the host config file each time a connection<br>
is made. But existing connections will normally be kept alive. To force<br>
tinc to disconnect peers when their host config file is removed, send<br>
the server tincd the HUP signal:<br>
<br>
tincd -n <netname> -kHUP<br>
<br>
--<br>
Met vriendelijke groet / with kind regards,<br>
Guus Sliepen <<a href="mailto:guus@tinc-vpn.org">guus@tinc-vpn.org</a>><br>
<br><br>---------- Forwarded message ----------<br>From: Guus Sliepen <<a href="mailto:guus@tinc-vpn.org">guus@tinc-vpn.org</a>><br>To: <a href="mailto:tinc@tinc-vpn.org">tinc@tinc-vpn.org</a><br>Cc: <br>Date: Mon, 25 Jul 2016 18:37:20 +0200<br>Subject: Re: Tinc and FIPS mode fails to connect.<br>On Wed, Jul 20, 2016 at 04:38:02PM -0500, Boris Reisig wrote:<br>
<br>
> I am using the latest Tinc 1.1 from git (tinc version 1.1pre14-17-g2784a17<br>
> (built Jul 14 2016 14:18:09, protocol 17.7) on a CentOS 7.2 64bit with both<br>
> test servers set it FIPS mode (cat /proc/sys/crypto/fips_enabled to verify<br>
> or add fips=1 to your grub2 command line ). We need our test servers<br>
> running in FIPS mode due to a minimum requirement for our project. OpenSSL<br>
> in CentOS/RHEL has FIPS support compiled in OpenSSL. FIPS will *only* allow<br>
> high end encryption to be used and fail for one's that aren't FIPS<br>
> compatible. When having the server set in FIPS mode, I have the following<br>
> set in tinc.conf<br>
<br>
Unfortunately, the protocol for tinc 1.0 requires Blowfish to be used<br>
during authentication, regardless of the Cipher setting. However, if you<br>
only have 1.1 nodes, you should not get this problem.<br>
<br>
However, I should warn you that the new protocol in tinc 1.1 will work<br>
regardless of what OpenSSL supports, because it includes its own copy of<br>
Ed25519 and Chacha-Poly1305. But those algorithms are not in FIPS as far<br>
as I know.<br>
<br>
So in short, tinc is not FIPS compatible.<br>
<br>
--<br>
Met vriendelijke groet / with kind regards,<br>
Guus Sliepen <<a href="mailto:guus@tinc-vpn.org">guus@tinc-vpn.org</a>><br>
<br><br>---------- Forwarded message ----------<br>From: Guus Sliepen <<a href="mailto:guus@tinc-vpn.org">guus@tinc-vpn.org</a>><br>To: <a href="mailto:tinc@tinc-vpn.org">tinc@tinc-vpn.org</a><br>Cc: <br>Date: Mon, 25 Jul 2016 18:41:40 +0200<br>Subject: Re: Tinc 1.0.24 regulary disconnected<br>On Sat, Jul 16, 2016 at 07:04:08AM +0700, John Lewis wrote:<br>
<br>
> Promox 4.2 running on 2 nodes + 1 quorum = total 3 servers.<br>
> All of them have tinc 1.0.24 running.<br>
><br>
> On very rare occasions (every few days or 1~2 weeks), my website hosted on<br>
> this proxmox node will throw cloudflare 522 connection timed out for few<br>
> seconds or few minutes:<br>
> <a href="https://support.cloudflare.com/hc/en-us/articles/200171906-Error-522-Connection-timed-out" rel="noreferrer" target="_blank">https://support.cloudflare.com/hc/en-us/articles/200171906-Error-522-Connection-timed-out</a><br>
><br>
> This problem has been driving me crazy. I'm not sure, but I suspect this is<br>
> caused by tinc vpn that somehow got disconnected.<br>
<br>
I don't see anything wrong with your configuration. I'd first make sure<br>
that it is actually tinc that got disconnected. Start tinc with<br>
debugging enabled (at least debug level 1, which logs (dis)connections,<br>
although level 3 may be more informative). If there is no disconnection<br>
going on when you get the connection timeouts, then try to find out what<br>
is going on during that time.<br>
<br>
--<br>
Met vriendelijke groet / with kind regards,<br>
Guus Sliepen <<a href="mailto:guus@tinc-vpn.org">guus@tinc-vpn.org</a>><br>
<br><br>---------- Forwarded message ----------<br>From: "Рысь" <<a href="mailto:lynx@lynxlynx.tk">lynx@lynxlynx.tk</a>><br>To: <a href="mailto:tinc@tinc-vpn.org">tinc@tinc-vpn.org</a><br>Cc: <br>Date: Mon, 25 Jul 2016 23:32:57 +0700<br>Subject: Re: How does tinc server handle the case one client's key file is removed after connection<br>On Mon, 25 Jul 2016 12:16:36 -0400<br>
Heng Wang <<a href="mailto:jason.wangh@gmail.com">jason.wangh@gmail.com</a>> wrote:<br>
<br>
> Hi Guys,<br>
><br>
> Say when tinc is running all good, the "server" contains all the key<br>
> files of clients.<br>
> If we remove the key file for client A during run, how long before<br>
> does server find out the key<br>
> file is gone? I see a "KeyExpire" option in the conf file, is this<br>
> the time?<br>
><br>
> In my own experiment, the client will still be able to connect to the<br>
> tinc network even if the key file is being removed. Of course the<br>
> connection will be gone if I restart tinc server on the client side.<br>
><br>
> Thank you.<br>
> Heng<br>
<br>
Usually you manually tell tinc that a particular client has gone by<br>
sending a SIGHUP signal to it. There probably no configurable option to<br>
automatically remove a client from network once it's config (key) file<br>
was removed.<br>
<br>
But does not it happen automatically? Tinc tries to open<br>
config file on next connection attempt, and if that fails - denies it.<br>
At least on 1.0.x.<br>
<br>
--<br>
<a href="http://lynxlynx.tk/" rel="noreferrer" target="_blank">http://lynxlynx.tk/</a><br>
Power electronics made simple<br>
Unix and simple KISS C code<br>
<br>
<br>_______________________________________________<br>
tinc mailing list<br>
<a href="mailto:tinc@tinc-vpn.org">tinc@tinc-vpn.org</a><br>
<a href="https://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc" rel="noreferrer" target="_blank">https://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc</a><br>
<br></blockquote></div><br></div></div>