 |
Implementing that option looks obvious but it won't fix much. The problem is that a tls_client is either verified against a predefined list of CNs defined in TlsAllowedCN e.g. TlsAllowedCN = CN TlsAllowedCN = AnOtherCN And when that is not set it will always verify the CN against the client FQDN. Breaking that logic might have some security issues. I would try the TlsAllowedCN and put there the CN of the "generic" certificate and see if that saves your problem. |
|
|
`TLSVerifyPeer` is already implemented in Bareos, just not consistently. See for instance "Security enhancements"[1]... The "security issues" are the following: we need encyption, but we don't want authentication (by certificate) because we already do authorization (with Bareos' `Password` directive). [1] http://www.bareos.org/en/HOWTO/articles/new-in-version-1320.html ``` Until now, the verify_peer flag is hardcoded to yes for the console programs. Now, you can set TLS Verify Peer = No in the bconsole.conf bat.conf and bareos-fd.conf configuration files when using TLS. # relaxed tls configuration # has security implications, attention TLS Verify Peer = No ``` |
|
|
Problem is solved by using TLS Allowed CN: Hallo Herr Storz, `TlsAllowedCN = xxxxxx.de` Funktioniert. Das heisst, wir müssen auf den schon ausgerollten Clients das Zertifikat erneuern, aber dies wird uns beim weiteren Ausrollen eine Menge Zeit und Ärger sparen. |
|
|
Fix committed to bareos master branch with changesetid 2703. |
- Anonymous
