Discussion:
[Openvpn-users] Any way to determine CID from management interface?
Joe Patterson
2017-03-02 16:35:46 UTC
Permalink
I haven't seen anything, but I figured I'd ask before making any
conclusions: Is there any way to determine the CID of clients in the
management interface? It doesn't seem to be part of the output of
'status'. Or does the CID only exist within ">CLIENT:" notifications?

The boring details are: I'm writing a little program to do management of
my openvpn processes (managing authentication and doing some other useful
ancillary stuff) and whenever I authenticate a client I'm saving a fair
amount of state information about that client internally, and then when a
client disconnects, I'm undoing whatever needs undone for the client and
removing all the state info. The problem I'm trying to solve is that, if I
restart my program, I lose all that state. I could write it out to a file
occasionally and pick it back up on restart, and I'd be guaranteed that no
new clients would sneak in while I was restarting (because there'd be
nothing to issue the client-auth), but there's always the possibility that
a client would disconnect while I'm restarting and I'd miss it, thereby
having a bunch of state lying around for a client that's no longer
connected. The only alternative I can see is to, when I start up, load all
my state from disk, then issue a 'status' command and go through removing
clients that don't have their virtual address in my the client list, which
is probably effective, but just seems ugly. :)

Thanks in advance for any help!

-Joe
Selva Nair
2017-03-02 16:55:06 UTC
Permalink
Hi,
Post by Joe Patterson
I haven't seen anything, but I figured I'd ask before making any
conclusions: Is there any way to determine the CID of clients in the
management interface? It doesn't seem to be part of the output of
'status'. Or does the CID only exist within ">CLIENT:" notifications?
Try "status 2"

Selva
Joe Patterson
2017-03-02 17:01:04 UTC
Permalink
Status 2 looks like it gives me 3 tables, none with a CID. I do get both
the client CN, username, and virtual address together, which is handy, but
no CID:

HEADER,CLIENT_LIST,Common Name,Real Address,Virtual Address,Bytes
Received,Bytes Sent,Connected Since,Connected Since (time_t),Username

HEADER,ROUTING_TABLE,Virtual Address,Common Name,Real Address,Last Ref,Last
Ref (time_t)

GLOBAL_STATS,Max bcast/mcast queue length,0
Post by Joe Patterson
Hi,
I haven't seen anything, but I figured I'd ask before making any
conclusions: Is there any way to determine the CID of clients in the
management interface? It doesn't seem to be part of the output of
'status'. Or does the CID only exist within ">CLIENT:" notifications?
Try "status 2"
Selva
Selva Nair
2017-03-02 17:50:08 UTC
Permalink
Hi,
Aha! I'm running 2.3.4. That's very useful information to know!
2.3.4 is ancient... upgrade to 2.4 :)

Selva
Post by Joe Patterson
Status 2 looks like it gives me 3 tables, none with a CID. I do get both
the client CN, username, and virtual address together, which is handy, but
HEADER,CLIENT_LIST,Common Name,Real Address,Virtual Address,Bytes
Received,Bytes Sent,Connected Since,Connected Since (time_t),Username
HEADER,ROUTING_TABLE,Virtual Address,Common Name,Real Address,Last
Ref,Last Ref (time_t)
GLOBAL_STATS,Max bcast/mcast queue length,0
HEADER,CLIENT_LIST,Common Name,Real Address,Virtual Address,Virtual IPv6
Address,Bytes Received,Bytes Sent,Connected Since,Connected Since
(time_t),Username,Client ID,Peer ID
CLIENT_LIST,home-router,174.116.201.36:57808,10.9.0.2,
2600:xx:xx::1000,8015805,4356712,Fri Feb 24 20:45:17
2017,1487987117,xxxx,13959,2
CID is the second last.
Selva
Joe Patterson
2017-03-02 18:36:26 UTC
Permalink
Ancient it may be, but it's still what's shipping with current stable
Debian. But, maybe I should go ahead and bite the bullet and upgrade
anyway. (Though I seem to recall a mention that 2.4 is more picky about
having fresh crl's than 2.3 was, and I know I'll need to be cautious about
that...)

Thanks!

-Joe
Hi,
Aha! I'm running 2.3.4. That's very useful information to know!
2.3.4 is ancient... upgrade to 2.4 :)
Selva
Status 2 looks like it gives me 3 tables, none with a CID. I do get both
the client CN, username, and virtual address together, which is handy, but
HEADER,CLIENT_LIST,Common Name,Real Address,Virtual Address,Bytes
Received,Bytes Sent,Connected Since,Connected Since (time_t),Username
HEADER,ROUTING_TABLE,Virtual Address,Common Name,Real Address,Last
Ref,Last Ref (time_t)
GLOBAL_STATS,Max bcast/mcast queue length,0
HEADER,CLIENT_LIST,Common Name,Real Address,Virtual Address,Virtual IPv6
Address,Bytes Received,Bytes Sent,Connected Since,Connected Since
(time_t),Username,Client ID,Peer ID
CLIENT_LIST,home-router,174.116.201.36:57808,10.9.0.2,2600:xx:xx::1000,8015805,4356712,Fri
Feb 24 20:45:17 2017,1487987117,xxxx,13959,2
CID is the second last.
Selva
Loading...