Changes between Initial Version and Version 1 of Hardening

Timestamp:

11/25/13 23:27:16 (10 years ago)

Author:

JoshC

Comment:

--

Hardening

@@ +1 @@
+[[TOC(depth=2)]]
+
+= Hardening OpenVPN =
+
+This is a work in progress.
+
+A number of things can be done to harden OpenVPN's security. This is a non-exclusive list of ways to harden OpenVPN on a number of levels.
+
+== X.509 key size ==
+
+For asymmetric keys, general wisdom is that 1024-bit keys are no longer sufficient to protect against well-equipped adversaries. Use of 2048-bit is a good minimum. It is wise to ensure all keys across your active PKI (including the CA root keypair) are using at least 2048-bit keys.
+
+Up to 4096-bit is accepted by nearly all RSA systems (including OpenVPN,) but use of keys this large will dramatically increase generation time, TLS handshake delays, and CPU usage for TLS operations; the benefit beyond 2048-bit keys is small enough not to be of great use at the current time. It is often a larger benefit to consider lower validity times than more bits past 2048, but that is for you to decide.
+
+== Use of --tls-cipher ==
+
+By default, OpenVPN accepts a wide range of possible TLS cipher-suites; hardened systems should limit this to an acceptable list (which can be just 1) cipher as shown with `openvpn --show-tls`. As of OpenVPN 2.3.2, only TLSv1.0 RSA ciphers are usable. You should use a DHE cipher-suite as well for forward-secrecy.
+
+A git-master (slated to be included in >=2.3.3) enables support for TLSv1.2 cipher-suites, but note that requiring only TLSv1.2 cipher-suites is not backwards-compat with <=2.3.2 clients; your server/client may accept both a TLSv1.0 and TLSv1.2 option though.
+
+It's wise to use as small of a list as possible for your `--tls-cipher` option. Exceptions could include if you wish to provide the client their choice of several acceptable options.
+
+Limiting to TLSv1.0 DHE + RSA choices yields the following list, suitable for <=2.3.2 peers. The choices with SHA256 are preferred; DES choices are best avoided, '''especially''' single-DES (known very weak.)
+* TLS-DHE-RSA-WITH-AES-256-CBC-SHA256
+* TLS-DHE-RSA-WITH-AES-256-CBC-SHA
+* TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA
+* TLS-DHE-RSA-WITH-3DES-EDE-CBC-SHA
+* TLS-DHE-RSA-WITH-AES-128-CBC-SHA256
+* TLS-DHE-RSA-WITH-AES-128-CBC-SHA
+* TLS-DHE-RSA-WITH-SEED-CBC-SHA
+* TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA
+* TLS-DHE-RSA-WITH-DES-CBC-SHA
+  * ^Avoid: known very week^
+
+The following are TLSv1.2 DHE + RSA choices, requiring a compatible peer (git-master today, and targeted for a future >=2.3.3 version.):
+
+* TLS-DHE-RSA-WITH-AES-256-GCM-SHA384
+* TLS-DHE-RSA-WITH-AES-128-GCM-SHA256
+
+Today, OpenVPN does not support ECDHE or more exotic cipher-suites as there is no elliptic curve support currently.