style(readme): format markdown
This commit is contained in:
Stanislas Lange
parent
08aeed2c5b
commit
af3bf12bb6
37
README.md
37
README.md
|
|
@ -42,6 +42,7 @@ If you have any question, head to the [FAQ](#faq) first. Please read everything
|
|||
It's also possible to run the script headless, e.g. without waiting for user input, in an automated manner.
|
||||
|
||||
Example usage:
|
||||
|
||||
```bash
|
||||
AUTO_INSTALL=y ./openvpn-install.sh
|
||||
|
||||
|
|
@ -79,6 +80,7 @@ The headless install is more-or-less idempotent, in that it has been made safe t
|
|||
It's also possible to automate the addition of a new user. Here, the key is to provide the (string) value of the `MENU_OPTION` variable along with the remaining mandatory variables before invoking the script.
|
||||
|
||||
The following Bash script adds a new user `foo` to an existing OpenVPN configuration
|
||||
|
||||
```bash
|
||||
#!/bin/bash
|
||||
export MENU_OPTION="1"
|
||||
|
|
@ -111,15 +113,15 @@ The script supports these OS and architectures:
|
|||
|
||||
| | i386 | amd64 | armhf | arm64 |
|
||||
| --------------- | ---- | ----- | ----- | ----- |
|
||||
| Amazon Linux 2 | ❔ | ✅ | ❔ | ❔ |
|
||||
| Arch Linux | ❔ | ✅ | ❔ | ✅ |
|
||||
| CentOS 7 | ❔ | ✅ | ❌ | ✅ |
|
||||
| CentOS 8 | ❌ | ✅ | ❔ | ❔ |
|
||||
| Debian 8 | ✅ | ✅ | ❌ | ❌ |
|
||||
| Debian >= 9 | ❌ | ✅ | ✅ | ✅ |
|
||||
| Fedora >= 27 | ❔ | ✅ | ❔ | ❔ |
|
||||
| Ubuntu 16.04 | ✅ | ✅ | ❌ | ❌ |
|
||||
| Ubuntu >= 18.04 | ❌ | ✅ | ✅ | ✅ |
|
||||
| Amazon Linux 2 | ❔ | ✅ | ❔ | ❔ |
|
||||
| Arch Linux | ❔ | ✅ | ❔ | ✅ |
|
||||
| CentOS 7 | ❔ | ✅ | ❌ | ✅ |
|
||||
| CentOS 8 | ❌ | ✅ | ❔ | ❔ |
|
||||
| Debian 8 | ✅ | ✅ | ❌ | ❌ |
|
||||
| Debian >= 9 | ❌ | ✅ | ✅ | ✅ |
|
||||
| Fedora >= 27 | ❔ | ✅ | ❔ | ❔ |
|
||||
| Ubuntu 16.04 | ✅ | ✅ | ❌ | ❌ |
|
||||
| Ubuntu >= 18.04 | ❌ | ✅ | ✅ | ✅ |
|
||||
|
||||
To be noted:
|
||||
|
||||
|
|
@ -141,9 +143,9 @@ More Q&A in [FAQ.md](FAQ.md).
|
|||
|
||||
**A:** I recommend these:
|
||||
|
||||
- [Vultr](https://goo.gl/Xyd1Sc): Worldwide locations, IPv6 support, starting at $3.50/month
|
||||
- [Vultr](https://goo.gl/Xyd1Sc): Worldwide locations, IPv6 support, starting at \$3.50/month
|
||||
- [PulseHeberg](https://goo.gl/76yqW5): France, unlimited bandwidth, starting at €3/month
|
||||
- [Digital Ocean](https://goo.gl/qXrNLK): Worldwide locations, IPv6 support, starting at $5/month
|
||||
- [Digital Ocean](https://goo.gl/qXrNLK): Worldwide locations, IPv6 support, starting at \$5/month
|
||||
|
||||
---
|
||||
|
||||
|
|
@ -173,17 +175,16 @@ More Q&A in [FAQ.md](FAQ.md).
|
|||
|
||||
More Q&A in [FAQ.md](FAQ.md).
|
||||
|
||||
## One-stop solutions for public cloud
|
||||
## One-stop solutions for public cloud
|
||||
|
||||
Solutions that provision a ready to use OpenVPN server based on this script in one go are available for:
|
||||
|
||||
- AWS using Terraform at [`openvpn-terraform-install`](https://github.com/dumrauf/openvpn-terraform-install)
|
||||
- AWS using Terraform at [`openvpn-terraform-install`](https://github.com/dumrauf/openvpn-terraform-install)
|
||||
|
||||
## Contributing / Code formatting
|
||||
|
||||
We use [shellcheck](https://github.com/koalaman/shellcheck) and [shfmt](https://github.com/mvdan/sh) to enforce bash styling guidelines and good practices. They are executed for each commit / PR with GitHub Actions, so you can check the configuration [here](https://github.com/angristan/openvpn-install/blob/master/.github/workflows/push.yml).
|
||||
|
||||
|
||||
## Security and Encryption
|
||||
|
||||
OpenVPN's default settings are pretty weak regarding encryption. This script aims to improve that.
|
||||
|
|
@ -193,6 +194,7 @@ OpenVPN 2.4 was a great update regarding encryption. It added support for ECDSA,
|
|||
If you want more information about an option mentioned below, head to the [OpenVPN manual](https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage). It is very complete.
|
||||
|
||||
Most of OpenVPN's encryption-related stuff is managed by [Easy-RSA](https://github.com/OpenVPN/easy-rsa). Defaults parameters are in the [vars.example](https://github.com/OpenVPN/easy-rsa/blob/v3.0.6/easyrsa3/vars.example) file.
|
||||
|
||||
### Compression
|
||||
|
||||
By default, OpenVPN doesn't enable compression. This script provides support for LZ0 and LZ4 (v1/v2) algorithms, the latter being more efficient.
|
||||
|
|
@ -230,11 +232,11 @@ By default, OpenVPN uses `BF-CBC` as the data channel cipher. Blowfish is an old
|
|||
>
|
||||
> Using BF-CBC is no longer recommended, because of its 64-bit block size. This small block size allows attacks based on collisions, as demonstrated by SWEET32. See https://community.openvpn.net/openvpn/wiki/SWEET32 for details.
|
||||
|
||||
>Security researchers at INRIA published an attack on 64-bit block ciphers, such as 3DES and Blowfish. They show that they are able to recover plaintext when the same data is sent often enough, and show how they can use cross-site scripting vulnerabilities to send data of interest often enough. This works over HTTPS, but also works for HTTP-over-OpenVPN. See https://sweet32.info/ for a much better and more elaborate explanation.
|
||||
> Security researchers at INRIA published an attack on 64-bit block ciphers, such as 3DES and Blowfish. They show that they are able to recover plaintext when the same data is sent often enough, and show how they can use cross-site scripting vulnerabilities to send data of interest often enough. This works over HTTPS, but also works for HTTP-over-OpenVPN. See https://sweet32.info/ for a much better and more elaborate explanation.
|
||||
>
|
||||
> OpenVPN's default cipher, BF-CBC, is affected by this attack.
|
||||
|
||||
Indeed, AES is today's standard. It's the fastest and more secure cipher available today. [SEED](https://en.wikipedia.org/wiki/SEED) and [Camellia](https://en.wikipedia.org/wiki/Camellia_(cipher)) are not vulnerable to date but are slower than AES and relatively less trusted.
|
||||
Indeed, AES is today's standard. It's the fastest and more secure cipher available today. [SEED](https://en.wikipedia.org/wiki/SEED) and [Camellia](<https://en.wikipedia.org/wiki/Camellia_(cipher)>) are not vulnerable to date but are slower than AES and relatively less trusted.
|
||||
|
||||
> Of the currently supported ciphers, OpenVPN currently recommends using AES-256-CBC or AES-128-CBC. OpenVPN 2.4 and newer will also support GCM. For 2.4+, we recommend using AES-256-GCM or AES-128-GCM.
|
||||
|
||||
|
|
@ -253,7 +255,7 @@ The script supports the following ciphers:
|
|||
|
||||
And defaults to `AES-128-GCM`.
|
||||
|
||||
OpenVPN 2.4 added a feature called "NCP": *Negotiable Crypto Parameters*. It means you can provide a cipher suite like with HTTPS. It is set to `AES-256-GCM:AES-128-GCM` by default and overrides the `--cipher` parameter when used with an OpenVPN 2.4 client. For the sake of simplicity, the script set both the `--cipher` and `--ncp-cipher` to the cipher chosen above.
|
||||
OpenVPN 2.4 added a feature called "NCP": _Negotiable Crypto Parameters_. It means you can provide a cipher suite like with HTTPS. It is set to `AES-256-GCM:AES-128-GCM` by default and overrides the `--cipher` parameter when used with an OpenVPN 2.4 client. For the sake of simplicity, the script set both the `--cipher` and `--ncp-cipher` to the cipher chosen above.
|
||||
|
||||
### Control channel
|
||||
|
||||
|
|
@ -314,6 +316,7 @@ About `tls-crypt`:
|
|||
> Encrypt and authenticate all control channel packets with the key from keyfile. (See --tls-auth for more background.)
|
||||
>
|
||||
> Encrypting (and authenticating) control channel packets:
|
||||
>
|
||||
> - provides more privacy by hiding the certificate used for the TLS connection,
|
||||
> - makes it harder to identify OpenVPN traffic as such,
|
||||
> - provides "poor-man's" post-quantum security, against attackers who will never know the pre-shared key (i.e. no forward secrecy).
|
||||
|
|
|
|||
Loading…
Reference in New Issue