Updated according to v2.4.0

[albertony]

Quick update of some outdated descriptions since release of v2.4.0.

Remaining:
The description for manual creation of SSL/TLS Configuration will not work anymore. I see that the gui now uses library directly instead of executing openssl to generate cert. Openssl command-line utility is still included, but from what I can see barrier.conf is not. To generate cert openssl requires a config file.

• Since openssl.exe is still included, would it be an option to add back barrier.conf, to support command-line generation of cert?
• Alternatively, I can add a note in the wiki that users must install OpenSSL to do this.

[shymega]

Yes, for now, add a note saying to install OpenSSL. Soon OpenSSL should be removed from the tarball, as it is out of date, but for now, I think it'll remain using the library. Thanks for the PR!

[albertony]

Done.

[albertony]

Wait a minute.. Fingerprint file format is changed!?

Just from reading the code it seems to me version 2.4.0 uses lines with the following format for the new SHA256 fingerprints:

v2:SHA256:<hex>

And GUI app will write this same format both to Local.txt when generating cert, and to TrustedServers.txt/TrustedClients.txt when adding trust. But I assume, that Local.txt format is still not important, but that when adding to one of the trusted text files one must use this new format.

I will push an updated text soon, but please correct me if I'm wrong with my assumptions.

[albertony]

Done, please take a look.

[shymega]

OK, this looks good. We'll need some external testing of this documentation change though. I'll ask in the IRC.

[albertony]

Sorry, but pushed another commit. Let me know if you would rather have this split into a separate pr.. But the changes are related, and dependent on the previous commit, so thats why I added them here...

Main points:

• Avoid space character at end of fingerprint. Barrier does not trim on read, so whitespace will break things!
• Client identity verification: In contrast to UI, this is enabled by default when running from command-line. This means one will have to generate certificate also on client and copy fingerprint to server, or choose to disable it by adding command-line argument --disable-client-cert-checking.
  • PS1: When using --disable-client-cert-checking it works without having a certificate on client, but it logs error message that is a bit anoying, but can be ignored. I did not mention this in docs.

    ERROR: ssl certificate doesn't exist: C:\Barrier\data\SSL\Barrier.pem
    ERROR: could not load client certificates
    

  • PS2: The section "Fingerprint Trust" in Troubleshooting wiki page does not mention client identity either, but I did not change this now.

[shymega]

I have now left the Barrier project due to organisational issues and now have joined a fork. This PR will need a different assignee and reviewer. Once the PR is merged, it should also be merged into the repository [email protected]:debauchee/barrier.wiki.git.

[shymega]

As a final review, your changes look good to me. I'm going to merge your PR into the fork's wiki as well as here, just because it's a good PR to have both ways - I imagine this PR will also be merged to Barrier's wiki too, but I can't merge it myself.

[mwilck]

While you are at this, could you perhaps add command line instructions for Linux? The cmd.exe syntax is awkward to read for non-Windows users.

Linux instructions might look as follows:

On the server, change the working directory to $XDG_DATA_HOME/barrier/SSL (normally $HOME/.local/share/barrier/SSL) and extract the fingerprint:

umask 077
openssl x509 -in Barrier.pem -fingerprint -sha256 -noout | sed s/.*=/v2:sha256:/ >Fingerprints/Local.txt

Copy the fingerprint to a barrier client:

ssh "$USER@$CLIENT" 'umask 077; cat >> .local/share/barrier/SSL/Fingerprints/TrustedServers.txt' < Fingerprints/Local.txt

[TLATER]

Suggested change

	`%LocalAppData%\Barrier\SSL`. If you have the are planning to keep the SSL files in a
	`%LocalAppData%\Barrier\SSL`. If you are planning to keep the SSL files in a

[TLATER]

Can we use the console style here? It'd make the examples much more readable :)

[TLATER]

For reference, the full generate key + extract fingerprint from it workflow in bash is something like this:

openssl req -new -x509 -subj /CN=Barrier -days 365 -nodes -out Barrier.pem -keyout Barrier.pem # Yes, into the same file
echo 'v2:sha256:'$(openssl x509 -in Barrier.pem -nocert -sha256 -fingerprint | cut -f 2 -d ' ' | cut -f 2 -d '=' | tr -d ':' | tr '[:upper:]' '[:lower:]'

At least, with OpenSSL 1.1.1l