Disable compression

[Harvester57]

Hi everyone :)

For a hardened OpenVPN configuration, compression should be disabled (as stated by an OpenVPN current developper) : BetterCrypto/Applied-Crypto-Hardening#91 (comment)

[Harvester57]

Sorry for the typo in the second commit title... ^^

[Harvester57]

For more informations : https://bettercrypto.org/static/applied-crypto-hardening.pdf

[angristan]

I'm okay with disabling comp-lzo, but the commtt is not complete : you forgot the client conf (/~https://github.com/Angristan/OpenVPN-install/blob/master/openvpn-install.sh#L427)

For the ciphers : I don't see why this is an improvement ^^ This is made to force the use of this unique cipher I put on each mode

[Harvester57]

Nailed it for client-side compression, thanks :)

Concerning the cipher list, It is only to prevent any otential downgrade or loss of connection in case of whatever could happen with only one cipher available :)

[angristan]

Concerning the cipher list, It is only to prevent any otential downgrade or loss of connection in case of whatever could happen with only one cipher available :)

Are you sure about that ? The cipher is included in the client and in the server conf !
Or we can do that : AES-GCM/AES-CBC/CAMELLIA 256 bits for "slow" and AES-GCM/AES-CBC/CAMELLIA 128 bits for "fast"

Note you're using depreciated cipher (OpenVPN < 2.3.3)

[angristan]

i.e. :
TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA for "fast" and

TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256:TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA for "slow"

[Harvester57]

After re-reading the hardening OpenVPN Wiki page, I think my reasoning was wrong : https://community.openvpn.net/openvpn/wiki/Hardening#Useof--tls-cipher

"It's wise to use as small of a list as possible for your --tls-cipher option. Exceptions could include if you wish to provide the client their choice of several acceptable options."

My bad.

Also, do you want me to work on adding tls-auth ? (https://community.openvpn.net/openvpn/wiki/Hardening#Useof--tls-auth)

[angristan]

Okay, no problem !

Why not, but I don't really understand what it adds :/