<div dir="ltr">Hello,<div><br></div><div>In my case, I did the OpenVPN testing on a laptop running the testing version of Debian.</div><div>I can extract version if needed.</div><div><br></div><div>Kr,</div><div><br></div>
<div>David</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">2013/11/25 L. Aaron Kaplan <span dir="ltr"><<a href="mailto:kaplan@cert.at" target="_blank">kaplan@cert.at</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im"><br>
On Nov 25, 2013, at 8:52 PM, christian mock <<a href="mailto:cm@coretec.at">cm@coretec.at</a>> wrote:<br>
<br>
> On Mon, Nov 25, 2013 at 08:13:24PM +0100, L. Aaron Kaplan wrote:<br>
><br>
>>> tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA<br>
>> ^^^^ this<br>
>><br>
>> is just used for the control channel and not for the actual stream.<br>
><br>
> noted.<br>
><br>
>>> Is your openvpn built with gnutls?<br>
>> With openssl<br>
>><br>
>>> Because mine (Debian Wheezy) shows<br>
>>> the openssl names with --list-tls (e.g. DHE-RSA-AES256-SHA)...<br>
>>><br>
>> wierd. Mine says:<br>
>><br>
>> # /usr/sbin/openvpn --show-tls<br>
>> Available TLS Ciphers,<br>
>> listed in order of preference:<br>
>><br>
>> TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384<br>
> [...]<br>
>> Which version of openvpn du you use?<br>
><br>
> $ openvpn --version<br>
> OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Jun 18 2013<br>
> Originally developed by James Yonan<br>
> Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <<a href="mailto:sales@openvpn.net">sales@openvpn.net</a>><br>
><br>
> $ ./configure --build=x86_64-linux-gnu --prefix=/usr --includedir=${prefix}/include --mandir=${prefix}/share/man --infodir=${prefix}/share/info --sysconfdir=/etc --localstatedir=/var --libexecdir=${prefix}/lib/openvpn --disable-maintainer-mode --disable-dependency-tracking CFLAGS=-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security CPPFLAGS=-D_FORTIFY_SOURCE=2 CXXFLAGS=-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security FFLAGS=-g -O2 LDFLAGS=-fPIE -pie -Wl,-z,relro -Wl,-z,now --enable-password-save --host=x86_64-linux-gnu --build=x86_64-linux-gnu --prefix=/usr --mandir=${prefix}/share/man --with-ifconfig-path=/sbin/ifconfig --with-route-path=/sbin/route<br>
><br>
> Compile time defines: ENABLE_CLIENT_SERVER ENABLE_DEBUG ENABLE_EUREPHIA ENABLE_FRAGMENT ENABLE_HTTP_PROXY ENABLE_MANAGEMENT ENABLE_MULTIHOME ENABLE_PASSWORD_SAVE ENABLE_PORT_SHARE ENABLE_SOCKS USE_CRYPTO USE_LIBDL USE_LZO USE_PF_INET6 USE_PKCS11 USE_SSL<br>
><br>
><br>
</div># /usr/sbin/openvpn --version<br>
OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Jun 18 2013<br>
<div class="im">Originally developed by James Yonan<br>
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <<a href="mailto:sales@openvpn.net">sales@openvpn.net</a>><br>
</div>Compile time defines: enable_crypto=yes enable_debug=yes enable_def_auth=yes enable_dependency_tracking=no enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_eurephia=yes enable_fast_install=yes enable_fragment=yes enable_http_proxy=yes enable_iproute2=no enable_libtool_lock=yes enable_lzo=yes enable_lzo_stub=no enable_maintainer_mode=no enable_management=yes enable_multi=yes enable_multihome=yes enable_pam_dlopen=no enable_password_save=yes enable_pedantic=no enable_pf=yes enable_pkcs11=yes enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_small=no enable_socks=yes enable_ssl=yes enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=no enable_win32_dll=yes enable_x509_alt_username=no with_crypto_library=openssl with_gnu_ld=yes with_ifconfig_path=/sbin/ifconfig with_mem_check=no with_plugindir='${prefix}/lib/openvpn' with_route_path=/sbin/route with_sysroot=no<br>
<div class="HOEnZb"><div class="h5"><br>
<br>
>> BTW: mine does not understand --list-tls, only --show-tls<br>
><br>
> that was a typo, it's --show-tls.<br>
><br>
>><br>
>> a.<br>
>><br>
>>> cm.<br>
>>><br>
>>> --<br>
>>> Christian Mock Wiedner Hauptstr. 15<br>
>>> Senior Security Engineer 1040 Wien<br>
>>> CoreTEC IT Security Solutions GmbH <a href="tel:%2B43-1-5037273" value="+4315037273">+43-1-5037273</a><br>
>>> FN 214709 z<br>
>>><br>
>>> .-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.<br>
>>> CoreTEC: Web Application Audit - Damit so etwas nicht passiert!<br>
>>><br>
>>> <a href="http://heise.de/-1260559" target="_blank">http://heise.de/-1260559</a><br>
>>><br>
>>> .-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.<br>
>>> _______________________________________________<br>
>>> Ach mailing list<br>
>>> <a href="mailto:Ach@lists.cert.at">Ach@lists.cert.at</a><br>
>>> <a href="http://lists.cert.at/cgi-bin/mailman/listinfo/ach" target="_blank">http://lists.cert.at/cgi-bin/mailman/listinfo/ach</a><br>
>><br>
>> ---<br>
>> // L. Aaron Kaplan <<a href="mailto:kaplan@cert.at">kaplan@cert.at</a>> - T: <a href="tel:%2B43%201%205056416%2078" value="+431505641678">+43 1 5056416 78</a><br>
>> // CERT Austria - <a href="http://www.cert.at/" target="_blank">http://www.cert.at/</a><br>
>> // Eine Initiative der <a href="http://nic.at" target="_blank">nic.at</a> GmbH - <a href="http://www.nic.at/" target="_blank">http://www.nic.at/</a><br>
>> // Firmenbuchnummer 172568b, LG Salzburg<br>
>><br>
>><br>
>><br>
>><br>
><br>
><br>
><br>
> --<br>
> Christian Mock Wiedner Hauptstr. 15<br>
> Senior Security Engineer 1040 Wien<br>
> CoreTEC IT Security Solutions GmbH <a href="tel:%2B43-1-5037273" value="+4315037273">+43-1-5037273</a><br>
> FN 214709 z<br>
><br>
> .-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.<br>
> CoreTEC: Web Application Audit - Damit so etwas nicht passiert!<br>
><br>
> <a href="http://heise.de/-1260559" target="_blank">http://heise.de/-1260559</a><br>
><br>
> .-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.<br>
> _______________________________________________<br>
> Ach mailing list<br>
> <a href="mailto:Ach@lists.cert.at">Ach@lists.cert.at</a><br>
> <a href="http://lists.cert.at/cgi-bin/mailman/listinfo/ach" target="_blank">http://lists.cert.at/cgi-bin/mailman/listinfo/ach</a><br>
<br>
---<br>
// L. Aaron Kaplan <<a href="mailto:kaplan@cert.at">kaplan@cert.at</a>> - T: <a href="tel:%2B43%201%205056416%2078" value="+431505641678">+43 1 5056416 78</a><br>
// CERT Austria - <a href="http://www.cert.at/" target="_blank">http://www.cert.at/</a><br>
// Eine Initiative der <a href="http://nic.at" target="_blank">nic.at</a> GmbH - <a href="http://www.nic.at/" target="_blank">http://www.nic.at/</a><br>
// Firmenbuchnummer 172568b, LG Salzburg<br>
<br>
<br>
<br>
<br>
</div></div><br>_______________________________________________<br>
Ach mailing list<br>
<a href="mailto:Ach@lists.cert.at">Ach@lists.cert.at</a><br>
<a href="http://lists.cert.at/cgi-bin/mailman/listinfo/ach" target="_blank">http://lists.cert.at/cgi-bin/mailman/listinfo/ach</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br>David DURVAUX
</div>