Use AES ciphers in our sample configuration files and add a few modern 2.4 examples
PATCH 1/1 Use AES ciphers in our sample configuration files and add a few modern 2.4 examples
--- sample/sample-config-files/client.conf | 8 ++++++-- sample/sample-config-files/server.conf | 23 +++++++++++++++++------ sample/sample-config-files/static-home.conf | 3 +++ sample/sample-config-files/static-office.conf | 3 +++ 4 files changed, 29 insertions(+), 8 deletions(-)
sample/sample-config-files/client.conf +6 -2
@@ -110,12 +110,16 @@ tls-auth ta.key 1 # Select a cryptographic cipher. # If the cipher option is used on the server # then you must also specify it here. -;cipher x +# Note that 2.4 client/server will automatically +# negoiate AES-256-GCM in TLS mode. +# See also the ncp-cipher option in the manpage +cipher AES-256-CBC + # Enable compression on the VPN link. # Don't enable this unless it is also # enabled in the server config file. -comp-lzo +#comp-lzo # Set log file verbosity. verb 3
sample/sample-config-files/server.conf +17 -6
@@ -246,14 +246,21 @@ tls-auth ta.key 0 # This file is secret # Select a cryptographic cipher. # This config item must be copied to # the client config file as well. -;cipher BF-CBC # Blowfish (default) -;cipher AES-128-CBC # AES -;cipher DES-EDE3-CBC # Triple-DES - -# Enable compression on the VPN link. +# Note that 2.4 client/server will automatically +# negoiate AES-256-GCM in TLS mode. +# See also the ncp-cipher option in the manpage +cipher AES-256-CBC + +# Enable compression on the VPN link and push the +# option to the client (2.4+ only, for earlier +# versions see below) +;compress lz4-v2 +;push "compress lz4-v2" + +# For compression compatible with older clients use comp-lzo # If you enable it here, you must also # enable it in the client config file. -comp-lzo +;comp-lzo # The maximum number of concurrently connected # clients we want to allow.
@@ -302,3 +309,7 @@ verb 3 # sequential messages of the same message # category will be output to the log. ;mute 20 + +# Notify the client that when the server restarts so it +# can automatically reconnect. +explicit-exit-notify 1
sample/sample-config-files/static-home.conf +3 -0
@@ -26,6 +26,9 @@ up ./home.up # Our pre-shared static key secret static.key +# Cipher to use +cipher AES-256-CBC + # OpenVPN 2.0 uses UDP port 1194 by default # (official port assignment by iana.org 11/04). # OpenVPN 1.x uses UDP port 5000 by default.
sample/sample-config-files/static-office.conf +3 -0
@@ -23,6 +23,9 @@ up ./office.up # Our pre-shared static key secret static.key +# Cipher to use +cipher AES-256-CBC + # OpenVPN 2.0 uses UDP port 1194 by default # (official port assignment by iana.org 11/04). # OpenVPN 1.x uses UDP port 5000 by default.
Signature · 1 line
2.7.4 (Apple Git-66)
Hi,
Makes sense, feature-ACK.
Quoted 5 lines · Arne Schwabe
sample/sample-config-files/client.conf +0
-0
sample/sample-config-files/client.conf tls-auth ta.key 1 · line 118
Quoted 10 lines
sample/sample-config-files/client.conf +5
-1@@ -110,12 +110,16 @@ tls-auth ta.key 1 # Select a cryptographic cipher. # If the cipher option is used on the server # then you must also specify it here. -;cipher x +# Note that 2.4 client/server will automatically +# negoiate AES-256-GCM in TLS mode. +# See also the ncp-cipher option in the manpage +cipher AES-256-CBC +
Typo in 'negotiate'. And was the extra newline on purpose?
sample/sample-config-files/client.conf tls-auth ta.key 1 · line 122
Quoted 5 lines
sample/sample-config-files/client.conf +1
-1# Enable compression on the VPN link. # Don't enable this unless it is also # enabled in the server config file. -comp-lzo +#comp-lzo
Very good, let's disable compression 'by default' in de samples.
Quoted 7 lines
sample/sample-config-files/server.conf +0
-0@@ -246,14 +246,21 @@ tls-auth ta.key 0 # This file is secret # Select a cryptographic cipher. # This config item must be copied to
sample/sample-config-files/server.conf tls-auth ta.key 0 # This file is secret · line 252
Quoted 10 lines
sample/sample-config-files/server.conf +4
-5# the client config file as well. -;cipher BF-CBC # Blowfish (default) -;cipher AES-128-CBC # AES -;cipher DES-EDE3-CBC # Triple-DES - -# Enable compression on the VPN link. +# Note that 2.4 client/server will automatically +# negoiate AES-256-GCM in TLS mode. +# See also the ncp-cipher option in the manpage +cipher AES-256-CBC
Same typo as above.
Apart from the typo's, ACK.
-Steffan
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
I corrected the typos and removed the added extra blank line, which Steffan noticed.
Your patch has been applied to the following branches
commit 6d036ebc221d933c0751107cea9efe4692c9d559 () commit 0b4707472675e809b924fd8ca907534e0da16dbb (release/2.3)
Author: Arne Schwabe Date: Tue Jul 12 11:14:08 2016 +0200
Use AES ciphers in our sample configuration files and add a few modern 2.4 examples
Acked-by: Steffan Karger <[email protected]...>
Message-Id: [email protected]...
URL: http://www.mail-archive.com/search?l=mid&[email protected]...
Signed-off-by: David Sommerseth <[email protected]...>- --
kind regards,
David Sommerseth
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQIcBAEBAgAGBQJXvziNAAoJEIbPlEyWcf3yB3UQALhcy1mHSUmDcwU3/hZgbjSp ikA7Z4c+UlelHHVNqKXWofovXPPM5g2oDbJoLdkYnKWucoAqdbhFwcqgCoUMhrcO y7XaqWt+YNfapcA3QtdCoYqIdaFyJlOn58tkJlRdPQuLoD+hUsBoJzbTNujGEPCI r/bm8lTtdH46E31VrhJP8RBl6vDe+WWAaISCrMBn8DXBpHxKS4aBcotoH/DUDPRV hctxr8C40fCqqrlI13jv4FHPm+1Qck5xROjLN87uJsYM1mDssIaZ2yHVOYFsuu7f PGtgskLpzbn6ILRRb0x5GBU+uqTzvV7U6FmY0uwGxYBkZWV/0Y45pjW7xxHbdPDi gCmzJqfzciU/ym4xCOORoQMr5Ca2NRia5buArjy/z0RbT3yZPAjWvMhvjGNEN5o4 FFzPsG5ExUJHbjH4mPy3dM0W+o0XPU7jNDNDsC7OMTpt75panCgIyJKxfKnpbQSk abV7jtb2C9YvZf42DCnWH0h9cWWSGo4d3YCgH9goGOCeCLk/RTHVQYMLyl548YHg 8A/7aSK+kGUGBDLCyhIb6Z/QjpBx2X/218EvCCglUVoz7SsxOgGqT613tVGtUeRJ 6BeGAgEwmXXdEqNt5mfrWFB3c0p7MQnxonrD5r2IN2MoG7e6bfwxqQh3LZE27NrZ rZMUmbn/nmkNjghn+hEY
=4DYd
-----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
And my script failed me, the correct master branch commit is bde1b90da0db2d68d13d274102986f0ca7096c00
Quoted 10 lines · David Sommerseth
I corrected the typos and removed the added extra blank line, which Steffan noticed.
Your patch has been applied to the following branches
commit
6d036ebc221d933c0751107cea9efe4692c9d559() commit0b4707472675e809b924fd8ca907534e0da16dbb(release/2.3) Author:
Arne Schwabe Date: Tue Jul 12 11:14:08 2016 +0200
Quoted 6 lines
Use AES ciphers in our sample configuration files and add a few modern 2.4 examples
[email protected]... URL:
http://www.mail-archive.com/search?l=mid&q=1468314848-11820-1-git-send
- [email protected]...
Quoted 2 lines
- --
kind regards,
David Sommerseth
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQIcBAEBAgAGBQJXvzlKAAoJEIbPlEyWcf3yZR4P/R93yBPz0LkJdT0iWqwI1JMT LJQzdHj3+XZWt7SyiA6eh5SiTEvB8B2yJVepRXGNEFYzCv9iKAFkvVEY5Kjibgkv OuhuCcCd3cDISWgkrm0vpubYfYKKrz2CXuo2arPsPkROslNzo5QVf7v608LCVdMg 6e3/6n6j1cqWuw+VxhoxkCJIRvs+mQZEGd9ZGEAlh/nk11hLhzMNXZT6k5CjP17i qBmV4q1NXvn8UJrtcN7iPGXiIRkA11nX9uYjvbTG/xxgr/r03qGRvv2tmjB+rK62 IB9LwepoVgcUi2FdMSJg+dyxQ+1FV3/11t5Khk17w6dGdg3m/vQBbq3p+E5vX8xK pZ1/1ommLhD1KRzhB8/9+z4dVZK9IIEO0iM0CPGwjE5n13qEZL+ad61BnwyFppB+ Se5PBQ2M20rq2nmeI0jQruuaA6JvtNScQBHCAyNsZkw49jEINjlkTJA8yJtlo/QI GZlDFdZ8zh8c7bPgDpirKPu3n1eMIEKATRY9R5bABf19zhx2y7pNVQoFRKkdGyOH X3EY52zxSmlzJbfieGFSHeKxCCtSpA4UgYVQe3IoHFlald+uctqZKrLXzy5GySBq m86uobMMWSzDksurSdhBTe/Ki+t2gSNtI2q5E4dY3Td5zvQHIZbcWrM2UpZXe83t aMjmMAVOWkq3i2hUYfTP
=Y6I1
-----END PGP SIGNATURE-----