Changes between Version 14 and Version 15 of Openvpn24ManPage

Timestamp:

02/21/19 07:44:05 (5 years ago)

Author:

Samuli Seppänen

Comment:

--

Openvpn24ManPage

@@ -760 +760 @@
 IP address changes due to DHCP, we should configure
 our IP address change script (see man page for
-<B><A HREF="/cgi-bin/man/man2html?8+dhcpcd">dhcpcd</A></B>(8)
+<B><A HREF="/man/man2html?8+dhcpcd">dhcpcd</A></B>(8)
 
 ) to deliver a
@@ -949 +949 @@
 of the TAP-Win32 driver.  When used on *nix, requires that the tun
 driver supports an
-<B><A HREF="/cgi-bin/man/man2html?8+ifconfig">ifconfig</A></B>(8)
+<B><A HREF="/man/man2html?8+ifconfig">ifconfig</A></B>(8)
 
 command which sets a subnet instead of a remote endpoint IP address.
@@ -1082 +1082 @@
 <P>
 This option, while primarily a proxy for the
-<B><A HREF="/cgi-bin/man/man2html?8+ifconfig">ifconfig</A></B>(8)
+<B><A HREF="/man/man2html?8+ifconfig">ifconfig</A></B>(8)
 
 command, is designed to simplify TUN/TAP
@@ -1151 +1151 @@
 This option is intended as
 a convenience proxy for the
-<B><A HREF="/cgi-bin/man/man2html?8+route">route</A></B>(8)
+<B><A HREF="/man/man2html?8+route">route</A></B>(8)
 
 shell command,
@@ -1441 +1441 @@
 <B>local</B>
 
-flag if both OpenVPN servers are directly connected via a common subnet,
+flag if both OpenVPN peers are directly connected via a common subnet,
 such as with wireless.  The
 <B>local</B>
@@ -2752 +2752 @@
 <DD>
 Use this option when OpenVPN is being run from the inetd or
-<B><A HREF="/cgi-bin/man/man2html?8+xinetd">xinetd</A>(8)</B>
+<B><A HREF="/man/man2html?8+xinetd">xinetd</A>(8)</B>
 
 server.
@@ -3094 +3094 @@
 framing for compression will still be enabled, allowing a different
 setting to be pushed later.
+<P>
+<B>Security Considerations</B>
+
+<P>
+Compression and encryption is a tricky combination.  If an attacker knows or is
+able to control (parts of) the plaintext of packets that contain secrets, the
+attacker might be able to extract the secret if compression is enabled.  See
+e.g. the CRIME and BREACH attacks on TLS which also leverage compression to
+break encryption.  If you are not entirely sure that the above does not apply
+to your traffic, you are advised to *not* enable compression.
+<P>
 
 <DT><B>--comp-lzo [mode]</B>
@@ -3737 +3748 @@
 supports AES-GCM-128 and AES-GCM-256.
 <P>
-IV_UI_VER=&lt;gui_id&gt; &lt;version&gt; -- the UI version of a UI if one is
+IV_GUI_VER=&lt;gui_id&gt; &lt;version&gt; -- the UI version of a UI if one is
 running, for example &quot;de.blinkt.openvpn 0.5.47&quot; for the
 Android app.
@@ -5988 +5999 @@
 
 <DD>
-A list
+
+<BR>
+
+
+<DT>
+
+<B>--tls-ciphersuites l</B>
+
+<DD>A list
 <B>l</B>
 
 of allowable TLS ciphers delimited by a colon (&quot;:&quot;).
 <P>
-This setting can be used to ensure that certain cipher suites are used (or
+These setting can be used to ensure that certain cipher suites are used (or
 not used) for the TLS connection.  OpenVPN uses TLS to secure the control
 channel, over which the keys that are used to protect the actual VPN traffic
@@ -6002 +6021 @@
 documentation for details on the cipher list interpretation.
 <P>
+For OpenSSL, the
+<B>--tls-cipher</B>
+
+is used for TLS 1.2 and below. For TLS 1.3 and up, the
+<B>--tls-ciphersuites</B>
+
+setting is used. mbed TLS has no TLS 1.3 support yet and only the
+<B>--tls-cipher</B>
+
+setting is used.
+<P>
 Use
 <B>--show-tls</B>
@@ -6010 +6040 @@
 <B>--tls-cipher</B>
 
-is an expert feature, which - if used correcly - can improve the security of
-your VPN connection.  But it is also easy to unwittingly use it to carefully
+and
+<B>--tls-ciphersuites</B>
+
+are expert features, which - if used correcly - can improve the security of
+your VPN connection.  But it is also easy to unwittingly use them to carefully
 align a gun with your foot, or just break your connection.  Use with care!
 <P>
@@ -6018 +6051 @@
 &quot;DEFAULT:!EXP:!LOW:!MEDIUM:!kDH:!kECDH:!DSS:!PSK:!SRP:!kRSA&quot; when using
 OpenSSL.
+<P>
+The default for --tls-ciphersuites is to use the crypto library's default.
 
 <DT><B>--tls-cert-profile profile</B>
@@ -6457 +6492 @@
 client, which replaces the local password with the
 UNIQUE_TOKEN_VALUE.
+<P>
+Newer clients (2.4.7+) will fall back to the original password method
+after a failed auth. Older clients will keep using the token value
+and react acording to
+<B>--auth-retry</B>
+
 
 <DT><B>--tls-verify cmd</B>
@@ -6879 +6920 @@
 option.  This file must be shared with the
 peer over a pre-existing secure channel such as
-<B><A HREF="/cgi-bin/man/man2html?1+scp">scp</A></B>(1)
+<B><A HREF="/man/man2html?1+scp">scp</A></B>(1)
 
 
@@ -6916 +6957 @@
 
 scripts to run the appropriate
-<B><A HREF="/cgi-bin/man/man2html?8+ifconfig">ifconfig</A></B>(8)
+<B><A HREF="/man/man2html?8+ifconfig">ifconfig</A></B>(8)
 
 and
-<B><A HREF="/cgi-bin/man/man2html?8+route">route</A></B>(8)
+<B><A HREF="/man/man2html?8+route">route</A></B>(8)
 
 commands.  These commands can be placed in the the same shell script
@@ -7361 +7402 @@
 
 option.  On non-Windows systems, the
-<B><A HREF="/cgi-bin/man/man2html?8+ifconfig">ifconfig</A></B>(8)
+<B><A HREF="/man/man2html?8+ifconfig">ifconfig</A></B>(8)
 
 command provides similar functionality.
@@ -8719 +8760 @@
 
 option will produce verbose output, similar to the
-<B><A HREF="/cgi-bin/man/man2html?8+tcpdump">tcpdump</A></B>(8)
+<B><A HREF="/man/man2html?8+tcpdump">tcpdump</A></B>(8)
 
 program.  Omit the
@@ -8746 +8787 @@
 to alice over a secure medium such as by
 using the
-<B><A HREF="/cgi-bin/man/man2html?1+scp">scp</A></B>(1)
+<B><A HREF="/man/man2html?1+scp">scp</A></B>(1)
 
 program.
@@ -9056 +9097 @@
 <H2>SEE ALSO</H2>
 
-<B><A HREF="/cgi-bin/man/man2html?8+dhcpcd">dhcpcd</A></B>(8),
-
-<B><A HREF="/cgi-bin/man/man2html?8+ifconfig">ifconfig</A></B>(8),
-
-<B><A HREF="/cgi-bin/man/man2html?1+openssl">openssl</A></B>(1),
-
-<B><A HREF="/cgi-bin/man/man2html?8+route">route</A></B>(8),
-
-<B><A HREF="/cgi-bin/man/man2html?1+scp">scp</A></B>(1)
-
-<B><A HREF="/cgi-bin/man/man2html?1+ssh">ssh</A></B>(1)
+<B><A HREF="/man/man2html?8+dhcpcd">dhcpcd</A></B>(8),
+
+<B><A HREF="/man/man2html?8+ifconfig">ifconfig</A></B>(8),
+
+<B><A HREF="/man/man2html?1+openssl">openssl</A></B>(1),
+
+<B><A HREF="/man/man2html?8+route">route</A></B>(8),
+
+<B><A HREF="/man/man2html?1+scp">scp</A></B>(1)
+
+<B><A HREF="/man/man2html?1+ssh">ssh</A></B>(1)
 
 
@@ -9156 +9197 @@
 <HR>
 This document was created by
-<A HREF="/cgi-bin/man/man2html">man2html</A>,
+<A HREF="/man/man2html">man2html</A>,
 using the manual pages.<BR>
-Time: 07:13:41 GMT, April 24, 2018
+Time: 12:29:12 GMT, February 20, 2019
 }}}