OpenVPN is een robuuste en gemakkelijk in te stellen opensource-vpn-daemon waarmee verschillende private networks aan elkaar geknoopt kunnen worden door een encrypted tunnel via internet. Voor de beveiliging wordt gebruikgemaakt van de OpenSSL-library, waarmee alle encryptie, authenticatie en certificatie kunnen worden afgehandeld. De ontwikkelaars hebben versie 2.6 uitgebracht en de belangrijkste veranderingen daarin zijn hieronder voor je op een rijtje gezet.
- Keying Material Exporters (RFC 5705) based key generation
As part of the cipher negotiation OpenVPN will automatically prefer the RFC5705 based key material generation to the current custom OpenVPN PRF. This feature requires OpenSSL or mbed TLS 2.18+.
Compatibility with OpenSSL in FIPS modeOpenVPN will now work with OpenSSL in FIPS mode. Note, no effort has been made to check or implement all the requirements/recommendation of FIPS 140-2. This just allows OpenVPN to be run on a system that be configured OpenSSL in FIPS mode.
mlockwill now check if enough memlock-able memory has been reserved,and if less than 100MB RAM are available, use setrlimit() to upgrade the limit. See Trac #1390. Not available on OpenSolaris.
Certificate pinning/verify peer fingerprintThe
TLS mode with self-signed certificates--peer-fingerprintoption has been introduced to give users an easy to use alternative to thetls-verifyfor matching the fingerprint of the peer. The option takes use a number of allowed SHA256 certificate fingerprints.
See the man page section "Small OpenVPN setup with peer-fingerprint" for a tutorial on how to use this feature. This is also available online under https://github.com/openvpn/openvpn/blob/master/doc/man-sections/example-fingerprint.rstWhen
Deferred auth support for scripts--peer-fingerprintis used, the--caand--capathoption become optional. This allows for small OpenVPN setups without setting up a PKI with Easy-RSA or similar software.The
Pending auth support for plugins and scripts--auth-user-pass-verifyscript supports now deferred authentication.Both auth plugin and script can now signal pending authentication to the client when using deferred authentication. The new
Compatibility mode (client-crresponsescript option andOPENVPN_PLUGIN_CLIENT_CRRESPONSEplugin function can be used to parse a client response to aCR_TEXTtwo factor challenge.
Seesample/sample-scripts/totpauth.pyfor an example.--compat-mode)The modernisation of defaults can impact the compatibility of OpenVPN 2.6.0 with older peers. The options
OpenSSL 3.0 support--compat-modeallows UIs to provide users with an easy way to still connect to older servers.OpenSSL 3.0 has been added. Most of OpenSSL 3.0 changes are not user visible but improve general compatibility with OpenSSL 3.0.
Optional ciphers in--tls-cert-profile insecurehas been added to allow selecting the lowest OpenSSL security level (not recommended, use only if you must). OpenSSL 3.0 no longer supports the Blowfish (and other deprecated) algorithm by default and the new option--providersallows loading the legacy provider to renable these algorithms.--data-ciphersCiphers in
Improved--data-cipherscan now be prefixed with a?to mark those as optional and only use them if the SSL library supports them.--mssfixand--fragmentcalculationThe
Cookie based handshake for UDP server--mssfixand--fragmentoptions now allow an optionalmtuparameter to specify that different overhead for IPv4/IPv6 should taken into account and the resulting size is specified as the total size of the VPN packets including IP and UDP headers.Instead of allocating a connection for each client on the initial packet OpenVPN server will now use an HMAC based cookie as its session id. This way the server can verify it on completing the handshake without keeping state. This eliminates the amplification and resource exhaustion attacks. For tls-crypt-v2 clients, this requires OpenVPN 2.6 clients or later because the client needs to resend its client key on completing the hand shake. The tls-crypt-v2 option allows controlling if older clients are accepted.
Data channel offloading with ovpn-dco
By default the rate of initial packet responses is limited to 100 per 10s interval to avoid OpenVPN servers being abused in reflection attacks (see--connect-freq-initial).2.6.0+ implements support for data-channel offloading where the data packets are directly processed and forwarded in kernel space thanks to the ovpn-dco kernel module. The userspace openvpn program acts purely as a control plane application. Note that DCO will use DATA_V2 packets in P2P mode, therefore, this implies that peers must be running 2.6.0+ in order to have P2P-NCP which brings DATA_V2 packet support.
Session timeoutIt is now possible to terminate a session (or all) after a specified amount of seconds has passed session commencement. This behaviour can be configured using
Inline auth username and password--session-timeout. This option can be configured on the server, on the client or can also be pushed.Username and password can now be specified inline in the configuration file within the <auth-user-pass></auth-user-pass> tags. If the password is missing OpenVPN will prompt for input via stdin. This applies to inline'd http-proxy-user-pass too.
Tun MTU can be pushedThe client can now also dynamically configure its MTU and the server will try to push the client MTU when the client supports it. The directive
Improved control channel packet size control (--tun-mtu-maxhas been introduced to increase the maximum pushable MTU size (defaults to 1600).max-packet-size)The size of control channel is no longer tied to
--link-mtu/--tun-mtuand can be set using--max-packet-size. Sending large control channel frames is also optimised by allowing 6 outstanding packets instead of just 4.max-packet-sizewill also setmssfixto try to limit data-channel packets as well.
:fill(white):strip_exif()/i/2003549196.jpeg?f=thumbmedium)
:strip_icc():strip_exif()/u/164007/crop57c1b40e5f54f.jpeg?f=community){kind=small}
.
/u/176086/crop5f0823fa5e8d6_cropped.png?f=community){kind=small}
:strip_icc():strip_exif()/u/21673/crop65674aee06c6d_cropped.jpg?f=community){kind=small}
:strip_icc():strip_exif()/u/44677/crop6883c59d038d7_cropped.jpg?f=community){kind=small}