Even when setting log verbosity to 9, I can see no indication in my logs that the [b]tls-version-min 1.3[/b] option I have set has been used by OpenVPN. Is there any way to verify this?

You are [i]probably[/i] blind but without your log I cannot confirm that rumour ..

[code]verbosity = 4[/code] That ^^^ is not used because of systemd. Check this file and remove the --verb and --suppress-timestamps parts: [code]/usr/lib/systemd/system/openvpn-server@.service[/code] Restart the server instance: [code]sudo systemctl restart openvpn-server@openvpn[/code] [b]If[/b] the config file was called "server.conf" then it would be: [code]sudo systemctl restart openvpn-server@server[/code]

[quote=Pippin post_id=91021 time=1586545650 user_id=32724] [code]verbosity = 4[/code] That ^^^ is not used because of systemd. [/quote]The openvpn config is loaded after systemd so --[b]verb 4[/b] [i]is used[/i], as the openvpn log states. The difference with --suppress-timestamps is that once it is set by systemd it cannot be unset by openvpn config because there is no switch to turn timestamps back on.

To clarify this discussion: It is [b]the last option[/b] in the order that each is listed which [i]Wins[/i] the game. Examples: [list][*]Command line: No matter what is in server.conf, --[b]verb 0[/b] wins because it is processed last. [code]$ openvpn --verb 4 --config server1.conf --verb 0[/code] [*]Systemd unit: No matter what is in %i.conf, --[b]verb 0[/b] wins because it is processed last. [code]ExecStart=/usr/sbin/openvpn --verb 4 --config %i.conf --verb 0[/code] [/list]The only exception to the rule (that I know of) is --[b]suppress-timestamps[/b] because once it is set there is no [i]toggle switch[/i] to unset it.

No indication that tls-version-min parsed

aduty

Even when setting log verbosity to 9, I can see no indication in my logs that the tls-version-min 1.3 option I have set has been used by OpenVPN. Is there any way to verify this?

TinCanTech

Check your log files at verb 4 from start to finish.

aduty

Maybe I'm blind, but I looked through line-by-line at both verb 4 and verb 9 and still don't see it.

TinCanTech

You are probably blind but without your log I cannot confirm that rumour ..

aduty

Current Parameter Settings:

config = '/etc/openvpn/openvpn.conf'
mode = 1
persist_config = DISABLED
persist_mode = 1
show_ciphers = DISABLED
show_digests = DISABLED
show_engines = DISABLED
genkey = DISABLED
key_pass_file = '[UNDEF]'
show_tls_ciphers = DISABLED
connect_retry_max = 0
Connection profiles [0]:
proto = udp
local = '[UNDEF]'
local_port = '1194'
remote = '[UNDEF]'
remote_port = '1194'
remote_float = DISABLED
bind_defined = DISABLED
bind_local = ENABLED
bind_ipv6_only = DISABLED
connect_retry_seconds = 5
connect_timeout = 120
socks_proxy_server = '[UNDEF]'
socks_proxy_port = '[UNDEF]'
tun_mtu = 1500
tun_mtu_defined = ENABLED
link_mtu = 1500
link_mtu_defined = DISABLED
tun_mtu_extra = 0
tun_mtu_extra_defined = DISABLED
mtu_discover_type = -1
fragment = 0
mssfix = 1450
explicit_exit_notification = 1
Connection profiles END
remote_random = DISABLED
ipchange = '[UNDEF]'
dev = 'tun'
dev_type = '[UNDEF]'
dev_node = '[UNDEF]'
lladdr = '[UNDEF]'
topology = 3
ifconfig_local = '10.8.0.1'
ifconfig_remote_netmask = '255.255.255.0'
ifconfig_noexec = DISABLED
ifconfig_nowarn = DISABLED
ifconfig_ipv6_local = '[UNDEF]'
ifconfig_ipv6_netbits = 0
ifconfig_ipv6_remote = '[UNDEF]'
shaper = 0
mtu_test = 0
mlock = DISABLED
keepalive_ping = 10
keepalive_timeout = 120
inactivity_timeout = 0
ping_send_timeout = 10
ping_rec_timeout = 240
ping_rec_timeout_action = 2
ping_timer_remote = DISABLED
remap_sigusr1 = 0
persist_tun = ENABLED
persist_local_ip = DISABLED
persist_remote_ip = DISABLED
persist_key = ENABLED
passtos = DISABLED
resolve_retry_seconds = 1000000000
resolve_in_advance = DISABLED
username = 'nobody'
groupname = 'nobody'
chroot_dir = '[UNDEF]'
cd_dir = '[UNDEF]'
writepid = '/run/openvpn.pid'
up_script = '[UNDEF]'
down_script = '[UNDEF]'
down_pre = DISABLED
up_restart = DISABLED
up_delay = DISABLED
daemon = ENABLED
inetd = 0
log = ENABLED
suppress_timestamps = DISABLED
machine_readable_output = DISABLED
nice = 0
verbosity = 4
mute = 0
gremlin = 0
status_file = '[UNDEF]'
status_file_version = 1
status_file_update_freq = 60
occ = ENABLED
rcvbuf = 0
sndbuf = 0
mark = 0
sockflags = 0
fast_io = DISABLED
comp.alg = 0
comp.flags = 0
route_script = '[UNDEF]'
route_default_gateway = '10.8.0.2'
route_default_metric = 0
route_noexec = DISABLED
route_delay = 0
route_delay_window = 30
route_delay_defined = DISABLED
route_nopull = DISABLED
route_gateway_via_dhcp = DISABLED
allow_pull_fqdn = DISABLED
management_addr = '[UNDEF]'
management_port = '[UNDEF]'
management_user_pass = '[UNDEF]'
management_log_history_cache = 250
management_echo_buffer_size = 100
management_write_peer_info_file = '[UNDEF]'
management_client_user = '[UNDEF]'
management_client_group = '[UNDEF]'
management_flags = 0
shared_secret_file = '[UNDEF]'
key_direction = not set
ciphername = 'BF-CBC'
ncp_enabled = ENABLED
ncp_ciphers = 'AES-256-GCM:AES-128-GCM'
authname = 'SHA1'
prng_hash = 'SHA1'
prng_nonce_secret_len = 16
keysize = 0
engine = DISABLED
replay = ENABLED
mute_replay_warnings = DISABLED
replay_window = 64
replay_time = 15
packet_id_file = '[UNDEF]'
use_iv = ENABLED
test_crypto = DISABLED
tls_server = ENABLED
tls_client = DISABLED
key_method = 2
ca_file = '[UNDEF]'
ca_path = '[UNDEF]'
dh_file = '/etc/openvpn/pki/dh4096.pem'
cert_file = '[UNDEF]'
extra_certs_file = '[UNDEF]'
priv_key_file = '[UNDEF]'
pkcs12_file = '/etc/openvpn/pki/server.pfx'
cipher_list = '[UNDEF]'
cipher_list_tls13 = '[UNDEF]'
tls_cert_profile = '[UNDEF]'
tls_verify = '[UNDEF]'
tls_export_cert = '[UNDEF]'
verify_x509_type = 0
verify_x509_name = '[UNDEF]'
crl_file = '[UNDEF]'
ns_cert_type = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_eku = '[UNDEF]'
ssl_flags = 256
tls_timeout = 2
renegotiate_bytes = -1
renegotiate_packets = 0
renegotiate_seconds = 3600
handshake_window = 60
transition_window = 3600
single_session = DISABLED
push_peer_info = DISABLED
tls_exit = DISABLED
tls_auth_file = '[UNDEF]'
tls_crypt_file = '/etc/openvpn/pki/ta.key'
server_network = 10.8.0.0
server_netmask = 255.255.255.0
server_network_ipv6 = ::
server_netbits_ipv6 = 0
server_bridge_ip = 0.0.0.0
server_bridge_netmask = 0.0.0.0
server_bridge_pool_start = 0.0.0.0
server_bridge_pool_end = 0.0.0.0
push_entry = 'redirect-gateway def1 bypass-dhcp'
push_entry = 'route-gateway 10.8.0.1'
push_entry = 'topology subnet'
push_entry = 'ping 10'
push_entry = 'ping-restart 120'
ifconfig_pool_defined = ENABLED
ifconfig_pool_start = 10.8.0.2
ifconfig_pool_end = 10.8.0.253
ifconfig_pool_netmask = 255.255.255.0
ifconfig_pool_persist_filename = 'ipp.txt'
ifconfig_pool_persist_refresh_freq = 600
ifconfig_ipv6_pool_defined = DISABLED
ifconfig_ipv6_pool_base = ::
ifconfig_ipv6_pool_netbits = 0
n_bcast_buf = 256
tcp_queue_limit = 64
real_hash_size = 256
virtual_hash_size = 256
client_connect_script = '[UNDEF]'
learn_address_script = '[UNDEF]'
client_disconnect_script = '[UNDEF]'
client_config_dir = '[UNDEF]'
ccd_exclusive = DISABLED
tmp_dir = '/tmp'
push_ifconfig_defined = DISABLED
push_ifconfig_local = 0.0.0.0
push_ifconfig_remote_netmask = 0.0.0.0
push_ifconfig_ipv6_defined = DISABLED
push_ifconfig_ipv6_local = ::/0
push_ifconfig_ipv6_remote = ::
enable_c2c = DISABLED
duplicate_cn = DISABLED
cf_max = 0
cf_per = 0
max_clients = 1024
max_routes_per_client = 256
auth_user_pass_verify_script = '[UNDEF]'
auth_user_pass_verify_script_via_file = DISABLED
auth_token_generate = DISABLED
auth_token_lifetime = 0
port_share_host = '[UNDEF]'
port_share_port = '[UNDEF]'
client = DISABLED
pull = DISABLED
auth_user_pass_file = '[UNDEF]'
OpenVPN 2.4.8 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Feb  7 2020
library versions: OpenSSL 1.1.1d  10 Sep 2019, LZO 2.10
Diffie-Hellman initialized with 2048 bit key
Failed to extract curve from certificate (UNDEF), using secp384r1 instead.
ECDH curve secp384r1 added
Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
TLS-Auth MTU parms [ L:1621 D:1156 EF:94 EB:0 ET:0 EL:3 ]
TUN/TAP device tun0 opened
TUN/TAP TX queue length set to 100
do_ifconfig, tt->did_ifconfig_ipv6_setup=0
/sbin/ip link set dev tun0 up mtu 1500
/sbin/ip addr add dev tun0 10.8.0.1/24 broadcast 10.8.0.255
Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
Could not determine IPv4/IPv6 protocol. Using AF_INET
Socket Buffers: R=[212992->212992] S=[212992->212992]
UDPv4 link local (bound): [AF_INET][undef]:1194
UDPv4 link remote: [AF_UNSPEC]
GID set to nobody
UID set to nobody
MULTI: multi_init called, r=256 v=256
IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=0
IFCONFIG POOL LIST
Initialization Sequence Completed

TinCanTech

TinCanTech wrote Check your log files at verb 4 from start to finish

start to finish would include a client connect/disconnect.

Look for something like this:

Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 384 bit EC, curve: secp384r1

verb 9 will not help.

Pippin

verbosity = 4

That ^^^ is not used because of systemd.

Check this file and remove the --verb and --suppress-timestamps parts:

/usr/lib/systemd/system/openvpn-server@.service

Restart the server instance:

sudo systemctl restart openvpn-server@openvpn

If the config file was called "server.conf" then it would be:

sudo systemctl restart openvpn-server@server

TinCanTech

Pippin wrote

verbosity = 4

That ^^^ is not used because of systemd.

The openvpn config is loaded after systemd so --verb 4 is used, as the openvpn log states.

The difference with --suppress-timestamps is that once it is set by systemd it cannot be unset by openvpn config because there is no switch to turn timestamps back on.

Pippin

Yes the log states verb 4 but the output shown above doesn't look like verb 4.
In my experience changing verb in config will not override systemd, at least not on Mint (systemd version 229).

TiTex

that depends on how does openvpn handle it's options, and afaik the options provided on the command line overwrite those in the config file

it's not about the os or systemd version

it would be easier if he just started the server from the shell with openvpn --config server.con

TinCanTech

To clarify this discussion:

It is the last option in the order that each is listed which Wins the game.

Examples:

Command line:
No matter what is in server.conf, --verb 0 wins because it is processed last.

$ openvpn --verb 4 --config server1.conf --verb 0

Systemd unit:
No matter what is in %i.conf, --verb 0 wins because it is processed last.

ExecStart=/usr/sbin/openvpn --verb 4 --config %i.conf --verb 0

The only exception to the rule (that I know of) is --suppress-timestamps
because once it is set there is no toggle switch to unset it.

Pippin

I can confirm the above, tested last night.