Server and client configuration: new openvpn user

flyboy

Hello, everyone!

I have just set up an OpenVPN server and it's succesfully working.

But since i'm new to this, i wanna check if my configuration is secure, because (i'm paranoid) i got overwhelmed by so many possibilities and options.

DH key = 2048bit (i'm considering changing for a 4096bit key)

SERVER SIDE
tls-auth ta.key 0
cipher AES-256-CBC
tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA256
auth SHA512

CLIENT SIDE
tls-auth ta.key 1
cipher AES-256-CBC
tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA256
auth SHA512

My server and clients are running version 2.3.14 .
Is there a more secure setup for cipher, auth and tls-cipher?

Thank you!

mwandelaar

I think you have a pretty secure setup. As you are running 2.3.14 you have the options of forcing TLS-levels using the options

--tls-version-min version ['or-highest']
--tls-version-max version

as described in the manual. This options can force you to use TLS1.2 or 1.3 and blocking the older 1.0 and 1.1

flyboy

Do you have any tips for the new 2.4.0 version? My configuration is the same but looking at the log, i've noticed some things:

1- No mention about the HMAC authentication and the cipher is different.

I used to to see this in the connection log:

TLS: Username/Password authentication succeeded for username 'XXXX'
Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Data Channel Encrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Data Channel Decrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA256, 2048 bit RSA

Now it's showing only this:

TLS: Username/Password authentication succeeded for username 'XXXX'
Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA256, 2048 bit RSA
Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key