Tinfoil Hat config check/verification

wpdn69

Here is my v2.2 server config. (Yes, I know blowfish with sha1 is more efficient and "good enough") but I'm wearing my tinfoil hat on this config.
Actually in my quick testing the performance isn't that bad with aes256 & sha512. So far it is keeping up with blowfish & sha1 in my very limited testing (so far at least).

What am I missing? Has anything I changed made security worse? Is there anything else I can change to increase security? (yes, even at the expense of performance)

Thanks (and no this isn't for the NSA or anything illegal - I just don't want anyone getting onto my network)

server XXX.XXX.XXX.XXX 255.255.255.0
topology subnet
writepid vpn.pid
status vpn.status 10
local --------------------
port --------------------
proto udp
dev tun
ifconfig-pool-persist ipp.txt
dh keys/dh2048.pem
ca keys/ca.crt
cert --------------------
key --------------------
tls-auth keys/ta.key 0 (is there a way to set the size of the key on this?)
comp-lzo
persist-key
persist-tun
key-method 2
cipher AES-256-CBC
auth RSA-SHA512
tls-server
keepalive 10 60
opt-verify
script-security 1
user nobody
group nogroup
chroot /empty/

Thanks again everyone!

[edit]
Also I'm looking into adding client password authentication, but didn't include it here because I'm thinking about more of a unmanaged site-to-site configuration.

Anything else I need to change?

Thanks again

janjust

tls-auth keys/ta.key 0 (is there a way to set the size of the key on this?)

the parameter 0/1 is only for the direction; the size of the key is 160 bits, IIRC

cipher AES-256-CBC
auth RSA-SHA512

try

cipher AES-256
auth SHA512

you can view the available ciphers and hashes using

openvpn --show-ciphers
openvpn --show-digests