mirror of
https://github.com/hwdsl2/docker-ipsec-vpn-server.git
synced 2026-04-26 01:55:53 +03:00
[GH-ISSUE #66] Please use secure ciphers #58
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @songgao on GitHub (Apr 7, 2018).
Original GitHub issue: https://github.com/hwdsl2/docker-ipsec-vpn-server/issues/66
In an old article for openswan, some of these were specifically marked as broken.
Is there a specific reason why old broken ciphers are included in the
ike=list? If there are old platforms that this intends to support, and they only support some of these ciphers, perhaps the docs could mention it.For macOS and iOS, it seems
ike=aes256-sha2;dh14is a sensible choice, as Apple added DH group 14 for both Cisco IPSec and L2TP/IPSec since iOS 9.3 and OS X 10.11.4 (link). I haven't tested on other platforms though.@hwdsl2 commented on GitHub (May 14, 2018):
@songgao Thank you for suggesting more secure ciphers for the VPN configuration. The ciphers in your linked article are not really "broken", although they may be less secure than others.
Unfortunately for compatibility with Windows clients, modp1024 must be enabled. The current group of ciphers trys to maintain compatibility with VPN clients on different platforms.