Hi all,
Once in a while it is handy to review all you've been doing and wonder if what
you do it is still wise, or you are just giving yourself a false sense of
security.
One of the things that kept me awake was the diffie-hellman-parameter.
I (like probably a lot of people around here) just used the info from the
man-pages or how2 to get a properly working openvpn and I took a precaution to
use a longer DH (2K in stead of the default 1K).
But I noticed that my co-workers are still using the same DH I made several
years ago.
So I wonder
a) What kind of length is supposed to be safe (presume 2K is still good
and fast enough to generate)
b) Should one use different DH's for each vpn-process
c) How often should one re-new the DH? (never, yearly, monthly, weekly,
at boot-time, at process-start-up?
Is it wise to tighten up, or am I victim of snowdon-paranoia :)
And before mentioning it, I did read:
http://security.stackexchange.com/questions/42415/openvpn-dhparam
http://security.stackexchange.com/questions/38206/can-someone-explain-a-little-better-what-exactly-is-accomplished-by-generation-o/38207#38207
http://security.stackexchange.com/questions/38206/can-someone-explain-a-little-better-what-exactly-is-accomplished-by-generation-o/38252#38252
hw
______________________________________________________________________
Dit bericht kan informatie bevatten die niet voor u is bestemd. Indien u niet
de geadresseerde bent of dit bericht abusievelijk aan u is toegezonden, wordt u
verzocht dat aan de afzender te melden en het bericht te verwijderen. De Staat
aanvaardt geen aansprakelijkheid voor schade, van welke aard ook, die verband
houdt met risico's verbonden aan het electronisch verzenden van berichten.
This message may contain information that is not intended for you. If you are
not the addressee or if this message was sent to you by mistake, you are
requested to inform the sender and delete the message. The State accepts no
liability for damage of any kind resulting from the risks inherent in the
electronic transmission of messages.
------------------------------------------------------------------------------
WatchGuard Dimension instantly turns raw network data into actionable
security intelligence. It gives you real-time visual feedback on key
security issues and trends. Skip the complicated setup - simply import
a virtual appliance and go from zero to informed in seconds.
http://pubads.g.doubleclick.net/gampad/clk?id=123612991&iu=/4140/ostg.clktrk
_______________________________________________
Openvpn-users mailing list
Openvpn-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/openvpn-users
