3 ms·
Seems like an easy enough edit to the scripts. What would you recommend instead?
by bshep 10y ago
Seems like an easy enough edit to the scripts. What would you recommend instead?
- _joel 10y agoThis has good information - http://docs.hardentheworld.org/Applications/OpenVPN/ http://docs.hardentheworld.org/Applications/OpenVPN/ I noticed DH params do get generated via easy-rsa (although not audited that code, so can't comment on how rigid it is, nor what keysize is being used so that could be defaulting to 1024 which isn't all that great nowadays)
- subliminalpanda 10y agoLooking that the easy-rsa 3 script that now comes bundled with OpenVPN, that value is set to 2048 bits: set_var EASYRSA_KEY_SIZE 2048 # gen-dh backend: gen_dh() { verify_pki_init local out_file="$EASYRSA_PKI/dh.pem" "$EASYRSA_OPENSSL" dhparam -out "$out_file" $EASYRSA_KEY_SIZE || \ die "Failed to build DH params" notice "\ https://github.com/OpenVPN/easy-rsa/blob/master/easyrsa3/easyrsa https://github.com/OpenVPN/easy-rsa/blob/master/easyrsa3/eas...