mirror of
https://github.com/OpenVPN/openvpn.git
synced 2024-09-19 19:42:30 +02:00
Update sample configs to use modern cipher, remove static key examples
Since these are examples, people might use them as a basis for their own configs. In the non-push/pull configs, we should specify a decent cipher. Further, I don't think we should recommend anyone to still use a static key configuration, so remove the static key config examples. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20191109174235.20511-1-steffan@karger.me> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19081.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
This commit is contained in:
parent
46d096074f
commit
ac10391f48
@ -22,5 +22,6 @@ ca sample-keys/ca.crt
|
||||
key sample-keys/client.key
|
||||
cert sample-keys/client.crt
|
||||
tls-auth sample-keys/ta.key 1
|
||||
cipher AES-256-GCM
|
||||
ping 1
|
||||
inactive 120 10000000
|
||||
|
@ -22,5 +22,6 @@ ca sample-keys/ca.crt
|
||||
key sample-keys/server.key
|
||||
cert sample-keys/server.crt
|
||||
tls-auth sample-keys/ta.key 0
|
||||
cipher AES-256-GCM
|
||||
ping 1
|
||||
inactive 120 10000000
|
||||
|
@ -1,75 +0,0 @@
|
||||
#
|
||||
# Sample OpenVPN configuration file for
|
||||
# home using a pre-shared static key.
|
||||
#
|
||||
# '#' or ';' may be used to delimit comments.
|
||||
|
||||
# Use a dynamic tun device.
|
||||
# For Linux 2.2 or non-Linux OSes,
|
||||
# you may want to use an explicit
|
||||
# unit number such as "tun1".
|
||||
# OpenVPN also supports virtual
|
||||
# ethernet "tap" devices.
|
||||
dev tun
|
||||
|
||||
# Our OpenVPN peer is the office gateway.
|
||||
remote 1.2.3.4
|
||||
|
||||
# 10.1.0.2 is our local VPN endpoint (home).
|
||||
# 10.1.0.1 is our remote VPN endpoint (office).
|
||||
ifconfig 10.1.0.2 10.1.0.1
|
||||
|
||||
# Our up script will establish routes
|
||||
# once the VPN is alive.
|
||||
up ./home.up
|
||||
|
||||
# Our pre-shared static key
|
||||
secret static.key
|
||||
|
||||
# Cipher to use
|
||||
cipher AES-256-CBC
|
||||
|
||||
# OpenVPN 2.0 uses UDP port 1194 by default
|
||||
# (official port assignment by iana.org 11/04).
|
||||
# OpenVPN 1.x uses UDP port 5000 by default.
|
||||
# Each OpenVPN tunnel must use
|
||||
# a different port number.
|
||||
# lport or rport can be used
|
||||
# to denote different ports
|
||||
# for local and remote.
|
||||
; port 1194
|
||||
|
||||
# Downgrade UID and GID to
|
||||
# "nobody" after initialization
|
||||
# for extra security.
|
||||
; user nobody
|
||||
; group nobody
|
||||
|
||||
# If you built OpenVPN with
|
||||
# LZO compression, uncomment
|
||||
# out the following line.
|
||||
; comp-lzo
|
||||
|
||||
# Send a UDP ping to remote once
|
||||
# every 15 seconds to keep
|
||||
# stateful firewall connection
|
||||
# alive. Uncomment this
|
||||
# out if you are using a stateful
|
||||
# firewall.
|
||||
; ping 15
|
||||
|
||||
# Uncomment this section for a more reliable detection when a system
|
||||
# loses its connection. For example, dial-ups or laptops that
|
||||
# travel to other locations.
|
||||
; ping 15
|
||||
; ping-restart 45
|
||||
; ping-timer-rem
|
||||
; persist-tun
|
||||
; persist-key
|
||||
|
||||
# Verbosity level.
|
||||
# 0 -- quiet except for fatal errors.
|
||||
# 1 -- mostly quiet, but display non-fatal network errors.
|
||||
# 3 -- medium output, good for normal operation.
|
||||
# 9 -- verbose, good for troubleshooting
|
||||
verb 3
|
@ -1,72 +0,0 @@
|
||||
#
|
||||
# Sample OpenVPN configuration file for
|
||||
# office using a pre-shared static key.
|
||||
#
|
||||
# '#' or ';' may be used to delimit comments.
|
||||
|
||||
# Use a dynamic tun device.
|
||||
# For Linux 2.2 or non-Linux OSes,
|
||||
# you may want to use an explicit
|
||||
# unit number such as "tun1".
|
||||
# OpenVPN also supports virtual
|
||||
# ethernet "tap" devices.
|
||||
dev tun
|
||||
|
||||
# 10.1.0.1 is our local VPN endpoint (office).
|
||||
# 10.1.0.2 is our remote VPN endpoint (home).
|
||||
ifconfig 10.1.0.1 10.1.0.2
|
||||
|
||||
# Our up script will establish routes
|
||||
# once the VPN is alive.
|
||||
up ./office.up
|
||||
|
||||
# Our pre-shared static key
|
||||
secret static.key
|
||||
|
||||
# Cipher to use
|
||||
cipher AES-256-CBC
|
||||
|
||||
# OpenVPN 2.0 uses UDP port 1194 by default
|
||||
# (official port assignment by iana.org 11/04).
|
||||
# OpenVPN 1.x uses UDP port 5000 by default.
|
||||
# Each OpenVPN tunnel must use
|
||||
# a different port number.
|
||||
# lport or rport can be used
|
||||
# to denote different ports
|
||||
# for local and remote.
|
||||
; port 1194
|
||||
|
||||
# Downgrade UID and GID to
|
||||
# "nobody" after initialization
|
||||
# for extra security.
|
||||
; user nobody
|
||||
; group nobody
|
||||
|
||||
# If you built OpenVPN with
|
||||
# LZO compression, uncomment
|
||||
# out the following line.
|
||||
; comp-lzo
|
||||
|
||||
# Send a UDP ping to remote once
|
||||
# every 15 seconds to keep
|
||||
# stateful firewall connection
|
||||
# alive. Uncomment this
|
||||
# out if you are using a stateful
|
||||
# firewall.
|
||||
; ping 15
|
||||
|
||||
# Uncomment this section for a more reliable detection when a system
|
||||
# loses its connection. For example, dial-ups or laptops that
|
||||
# travel to other locations.
|
||||
; ping 15
|
||||
; ping-restart 45
|
||||
; ping-timer-rem
|
||||
; persist-tun
|
||||
; persist-key
|
||||
|
||||
# Verbosity level.
|
||||
# 0 -- quiet except for fatal errors.
|
||||
# 1 -- mostly quiet, but display non-fatal network errors.
|
||||
# 3 -- medium output, good for normal operation.
|
||||
# 9 -- verbose, good for troubleshooting
|
||||
verb 3
|
@ -4,12 +4,9 @@
|
||||
#
|
||||
# '#' or ';' may be used to delimit comments.
|
||||
|
||||
# Use a dynamic tun device.
|
||||
# For Linux 2.2 or non-Linux OSes,
|
||||
# you may want to use an explicit
|
||||
# unit number such as "tun1".
|
||||
# OpenVPN also supports virtual
|
||||
# ethernet "tap" devices.
|
||||
# Use a dynamic tun device. For non-Linux OSes, you may want to use an
|
||||
# explicit unit number such as "tun1".
|
||||
# OpenVPN also supports virtual ethernet "tap" devices.
|
||||
dev tun
|
||||
|
||||
# Our OpenVPN peer is the office gateway.
|
||||
@ -37,6 +34,9 @@ cert home.crt
|
||||
# Our private key
|
||||
key home.key
|
||||
|
||||
# Our data channel cipher (must match peer config)
|
||||
cipher AES-256-GCM
|
||||
|
||||
# OpenVPN 2.0 uses UDP port 1194 by default
|
||||
# (official port assignment by iana.org 11/04).
|
||||
# OpenVPN 1.x uses UDP port 5000 by default.
|
||||
|
@ -37,6 +37,9 @@ cert office.crt
|
||||
# Our private key
|
||||
key office.key
|
||||
|
||||
# Our data channel cipher (must match peer config)
|
||||
cipher AES-256-GCM
|
||||
|
||||
# OpenVPN 2.0 uses UDP port 1194 by default
|
||||
# (official port assignment by iana.org 11/04).
|
||||
# OpenVPN 1.x uses UDP port 5000 by default.
|
||||
|
Loading…
Reference in New Issue
Block a user