Page MenuHomeVyOS Platform

Openconnect restart on adding users - Aborts all active connections
Closed, ResolvedPublicFEATURE REQUEST

Description

When adding a user to openconnect it will be handled like a change in the configuration of ocserv and causes the ocserv processes to be restarted.

This behaviour is unwanted and a big inconvenience for users since their connection will break and if they are authenticated through MFA (totp) they will get disconnected and required to login again. If they don't use MFA it will just be a minor hickup in the connection while the client silently reconnect using cached credentials.

A much better way to handle this would be to just update the files:

/var/run/ocserv/ocpasswd
/var/run/ocserv/users.oath

and leave the process running if no other change was done to the openconnect configuration.

Details

Difficulty level
Unknown (require assessment)
Version
vyos-1.4-rolling-202212060318-amd64
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Behavior change
Issue type
Improvement (missing useful functionality)

Event Timeline

klase created this object in space S1 VyOS Public.

@klase could you make some changes?

sudo nano -c +253 /usr/libexec/vyos/conf_mode/vpn_openconnect.py

and change

call('systemctl restart ocserv.service')

to:

call('systemctl reload-or-restart ocserv.service')

And restart the server
After this need to check different configs and config changes, different listen IPs, different network setting/ push route changes, and so on
If it works correctly with all settings, we can add it
https://github.com/vyos/vyos-1x/blob/ec6aaf72378d02753ca38ff17adadf785b2b21bd/src/conf_mode/vpn_openconnect.py#L250

Viacheslav changed the subtype of this task from "Task" to "Feature Request".Dec 6 2022, 5:05 PM

I have made the change in my configuration and tested as many configuration changes as I could (I have not tested radius authentication, and other options that are not valid in my setup) and it seems to work with this change without any unwanted side effects.

Viacheslav changed the task status from Open to In progress.Dec 7 2022, 8:18 AM
Viacheslav claimed this task.
Viacheslav changed the task status from In progress to Needs testing.Dec 8 2022, 3:53 AM

@klase It is already in the latest rolling release. Could you re-check?

It works. The user connections persist over a reload and configuration changes causes a reload instead of a restart!
Thank you.

Viacheslav moved this task from Need Triage to Finished on the VyOS 1.4 Sagitta board.