Changes between Version 12 and Version 13 of Openvpn24ManPage

Timestamp:

03/01/18 08:04:15 (6 years ago)

Author:

Samuli Seppänen

Comment:

Update man-page to OpenVPN 2.4.5

Openvpn24ManPage

@@ -1998 +1998 @@
 <P>
 This option can be used on both client and server side, but it is
-in enough to add this on the server side as it will push appropriate
+enough to add this on the server side as it will push appropriate
 <B>--ping</B>
 
@@ -3134 +3134 @@
 compression for a period of time until the next re-sample test.
 
-<DT><B>--management IP port [pw-file]</B>
-
-<DD>
-Enable a TCP server on
-<B>IP:port</B>
-
-to handle daemon management functions.
-<B>pw-file,</B>
-
-if specified,
-is a password file (password on first line)
-or &quot;stdin&quot; to prompt from standard input.  The password
-provided will set the password which TCP clients will need
-to provide in order to access management functions.
-<P>
-The management interface can also listen on a unix domain socket,
-for those platforms that support it.  To use a unix domain socket, specify
-the unix socket pathname in place of
-<B>IP</B>
-
-and set
-<B>port</B>
-
-to 'unix'.  While the default behavior is to create a unix domain socket
-that may be connected to by any process, the
+<DT><B>--management socket-name unix [pw-file] &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(recommended)</B>
+
+<DD>
+
+<BR>
+
+
+<DT>
+
+<B>--management IP port [pw-file]</B>
+
+<DD>Enable a management server on a
+<B>socket-name</B>
+
+Unix socket on those platforms supporting it, or on
+a designated TCP port.
+<P>
+<B>pw-file</B>
+
+, if specified, is a password file where the password must be on first line.
+Instead of a filename it can use the keyword stdin which will prompt the user
+for a password to use when OpenVPN is starting.
+<P>
+For unix sockets, the  default  behaviour  is to create a unix domain socket
+that may be connected to by any process.  Use the
 <B>--management-client-user</B>
 
@@ -3164 +3164 @@
 <B>--management-client-group</B>
 
-directives can be used to restrict access.
-<P>
-The management interface provides a special mode where the TCP
-management link can operate over the tunnel itself.  To enable this mode,
-set
-<B>IP</B>
-
-= &quot;tunnel&quot;.  Tunnel mode will cause the management interface
-to listen for a TCP connection on the local VPN address of the
-TUN/TAP interface.
-<P>
-While the management port is designed for programmatic control
-of OpenVPN by other applications, it is possible to telnet
-to the port, using a telnet client in &quot;raw&quot; mode.  Once connected,
-type &quot;help&quot; for a list of commands.
-<P>
-For detailed documentation on the management interface, see
-the management-notes.txt file in the
-<B>management</B>
-
-folder of
-the OpenVPN source distribution.
-<P>
-It is strongly recommended that
-<B>IP</B>
-
-be set to 127.0.0.1
-(localhost) to restrict accessibility of the management
-server to local clients. 
+directives to restrict access.
+<P>
+The management interface provides a special mode where the TCP management link
+can operate over the tunnel itself.  To enable this mode, set IP to
+<B>tunnel.</B>
+
+Tunnel mode will cause the  management interface to listen for a
+TCP connection on the local VPN address of the TUN/TAP interface.
+<P>
+<B>BEWARE</B>
+
+of enabling the management interface over TCP.  In  these cases you should
+<I>ALWAYS</I>
+
+make use of
+<B>pw-file</B>
+
+to password protect the management interface.  Any user who can connect to this
+TCP
+<B>IP:port</B>
+
+will be able to manage and control (and interfere with) the OpenVPN process.
+It is also strongly recommended to set IP to 127.0.0.1 (localhost) to restrict
+accessibility of the management server to local clients.
+<P>
+While the management port is designed for  programmatic control of OpenVPN by
+other applications, it is possible to telnet to the port, using a telnet client
+in &quot;raw&quot; mode.  Once  connected, type &quot;help&quot; for a list of commands.
+<P>
+For detailed documentation on the management interface, see the
+<I>management-notes.txt</I>
+
+file in the management folder of the OpenVPN source distribution.
+<P>
 <DT><B>--management-client</B>
 
@@ -5982 +5987 @@
 &quot;DEFAULT:!EXP:!LOW:!MEDIUM:!kDH:!kECDH:!DSS:!PSK:!SRP:!kRSA&quot; when using
 OpenSSL.
+
+<DT><B>--tls-cert-profile profile</B>
+
+<DD>
+Set the allowed cryptographic algorithms for certificates according to
+<B>profile</B>.
+
+<P>
+The following profiles are supported:
+<P>
+<B>legacy</B>
+
+(default): SHA1 and newer, RSA 2048-bit+, any elliptic curve.
+<P>
+<B>preferred</B>
+
+: SHA2 and newer, RSA 2048-bit+, any elliptic curve.
+<P>
+<B>suiteb</B>
+
+: SHA256/SHA384, ECDSA with P-256 or P-384.
+<P>
+This option is only fully supported for mbed TLS builds.  OpenSSL builds use
+the following approximation:
+<P>
+<B>legacy</B>
+
+(default): sets &quot;security level 1&quot;
+<P>
+<B>preferred</B>
+
+: sets &quot;security level 2&quot;
+<P>
+<B>suiteb</B>
+
+: sets &quot;security level 3&quot; and --tls-cipher &quot;SUITEB128&quot;.
+<P>
+OpenVPN will migrate to 'preferred' as default in the future.  Please ensure
+that your keys already comply.
 
 <DT><B>--tls-timeout n</B>
@@ -7085 +7129 @@
 <B>DNS addr --</B>
 
-Set primary domain name server IPv4 address.  Repeat
+Set primary domain name server IPv4 or IPv6 address.  Repeat
 this option to set secondary DNS server addresses.
 <P>
-<B>DNS6 addr --</B>
-
-Set primary domain name server IPv6 address.  Repeat
-this option to set secondary DNS server IPv6 addresses.
-<P>
-Note: currently this is handled using netsh (the
-existing DHCP code can only do IPv4 DHCP, and that protocol only
-permits IPv4 addresses anywhere).  The option will be put into the
-environment, so an
+Note: DNS IPv6 servers are currently set using netsh (the existing
+DHCP code can only do IPv4 DHCP, and that protocol only permits IPv4
+addresses anywhere).  The option will be put into the environment, so
+an
 <B>--up</B>
 
@@ -9021 +9060 @@
 <H2>COPYRIGHT</H2>
 
-Copyright (C) 2002-2017 OpenVPN Technologies, Inc. This program is free software;
+Copyright (C) 2002-2018 OpenVPN Inc This program is free software;
 you can redistribute it and/or modify
 it under the terms of the GNU General Public License version 2
@@ -9088 +9127 @@
 <A HREF="/cgi-bin/man/man2html">man2html</A>,
 using the manual pages.<BR>
-Time: 09:28:23 GMT, September 26, 2017
+Time: 07:23:06 GMT, March 01, 2018
 }}}