On 15/12/16 20:55, Dreetjeh D wrote: > > Sorry, i forgot cc > > Hi, > > I have a question about this: > > Op 14-12-2016 om 21:06 schreef Steffan Karger: >> >> You're using TLS-auth to protect against mitm attacks on your TLS >> connection, which is very good. *key-directing 1 means you are using >> different keys for client-server >> and server-client traffic*, which is >> good too. >> > key-direction also works when ta.key is the same on both sides. > > It is intended that no warning/info message appears in logs when using > the same key?
You can use
(1) --tls-auth ta.key
or
(2) --tls-auth ta.key {0,1}
In (1) you will get a connection, and I believe both sides will use the
same subkey in ta.key (haven't checked the code yet, so don't trust me
fully yet).
In (2) client and server must use different values, otherwise you will
see "packet HMAC authentication failed" errors in the log. If server
uses 0, the client must use 1 ... or vice versa. In this mode, the
client and server uses different sub-keys from ta.key.
--
kind regards,
David Sommerseth
OpenVPN Technologies, Inc
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, SlashDot.org! http://sdm.link/slashdot
_______________________________________________ Openvpn-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-users
