Hi, at https://bettercrypto.org/faq/ there are some hints for using better crypto in OpenVPN configurations. The recommendation is: [code]tls-cipher DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-CAMELLIA256-SHA:DHE-RSA-AES256-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-RSA-AES128-SHA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA cipher AES-256-CBC auth SHA384[/code] I understand the setting has to be the same on a server and client side. But in Ubuntu's Network Manager and OpenVPN for Android, there are only options for setting cipher and authentication algorithm. But no option for tls-cipher. [b]So my question is, what is tls-cipher option?[/b] Yes, I have read the description in a manual, but my question is: is tls-cipher a server side option only, or does need to be set on a client too (if yes, how)?

OpenVPN crypto hardening

MatejKovacic

Hi,

at https://bettercrypto.org/faq/ there are some hints for using better crypto in OpenVPN configurations.

The recommendation is:

tls-cipher DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-CAMELLIA256-SHA:DHE-RSA-AES256-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-RSA-AES128-SHA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA

cipher AES-256-CBC

auth SHA384

I understand the setting has to be the same on a server and client side. But in Ubuntu's Network Manager and OpenVPN for Android, there are only options for setting cipher and authentication algorithm. But no option for tls-cipher.

So my question is, what is tls-cipher option? Yes, I have read the description in a manual, but my question is: is tls-cipher a server side option only, or does need to be set on a client too (if yes, how)?

MatejKovacic

Thanks for the reply. Just a short notice about Network Manager. In 2008 (bug was reported then), this was true. Network Manager was a "crap" then, missing a lot of features. But in 2014 things has changed.

I personally prefer commandline/text config, but some of my users just want to use GUI.

MatejKovacic

Things clearly have not changed that much:

MatejKovacic wroteBut in Ubuntu's Network Manager and OpenVPN for Android, there are only options for setting cipher and authentication algorithm. But no option for tls-cipher.

[/quote]
Yes, but as you said, tls-cipher option should be set on one side only. So if I set this option on a server - there is no need to set it on a client side, right?

I mean, I agree, Network Manager is still missing a lot of functions, but it seems to me I can overcome that wit more careful server config...