On 12/10/17 02:18, Yevgeny Kosarzhevsky wrote: > On 11 October 2017 at 18:29, David Sommerseth > <[email protected] > <mailto:[email protected]>> wrote: > > On 11/10/17 10:05, Yevgeny Kosarzhevsky wrote: > > Hello, > > > > what is going to replace key-direction in future versions? > > Or will use use direction 2 by default without any alternatives? > > > --key-direction is not on the list of deprecated features [1]. > > That said, only --tls-auth uses that option, but the --key-direction can > also be provided via the --tls-auth as well. > > The --tls-crypt option will handle the --key-direction automatically and > does not depend on that at all. [...snip...] > > Hello, > > thank you for clarification, however I would like to point out the > --key-direction is not only used with --tls-auth but also with --secret > option.
Ahh! Thanks! I forgot about static key tunnels, but you are right. But as with --tls-auth, --secret can also take a second argument (after the file name) which can also indicate key direction. So there are four ways to use both --secret and --tls-auth * Single line ---------------------------------------------- secret file 0|1 tls-auth file 0|1 ---------------------------------------------- * multiple lines ---------------------------------------------- secret file tls-auth file key-direction 0|1 ---------------------------------------------- * inlined with explicit --key-direction ---------------------------------------------- key-direction 0|1 <secret> -----BEGIN OpenVPN Static key V1----- .... -----END OpenVPN Static key V1----- </secret> key-direction 0|1 <tls-auth> -----BEGIN OpenVPN Static key V1----- .... -----END OpenVPN Static key V1----- </tls-auth> ---------------------------------------------- * inlined using --secret/--tls-auth to indicate key-direction ---------------------------------------------- secret [inline] 0|1 <secret> -----BEGIN OpenVPN Static key V1----- .... -----END OpenVPN Static key V1----- </secret> tls-auth [inline] 0|1 <tls-auth> -----BEGIN OpenVPN Static key V1----- .... -----END OpenVPN Static key V1----- </tls-auth> ---------------------------------------------- And in addition comes the configuration variants where --key-direction is not used at all. (Of course, you cannot use both --secret and --tls-auth in the same config file; this is purely for demonstration) -- kind regards, David Sommerseth OpenVPN, Inc
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________ Openvpn-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-users
