Security audit

sammo · 2018-10-31T15:59:55.463Z

So, has anybody audited the custom GL software?
For example openvpn server.

create_certificates() {
# CA Authority

# Server certificate

# Sign request

# Client certificate

# Sign request

# Create Diffie-Hellman Key
**#openssl dhparam -out $DH_KEY 1024 >/dev/null 2>&1**

# Create TLS Key
**# openvpn --genkey --secret $TA_KEY**
return 0

}

So, you dont create a unique Diffie-Hellman Key per device (commented out), but reuse the file /etc/openvpn/cert/dh1024.pem.
Is 1024 bit enough as well as sharing the same file?

https://blog.hqcodeshop.fi/archives/320-Diffie-Hellman-key-exchange-1024-bit-unreliable.html

Why has prefect forwarding not enable with TA keys?

kyson-lok · 2018-11-01T06:59:01.249Z

Thanks for your audit. It is a security issue there. We built-in the DH file as it spent long time to generate it.

lala0 · 2019-02-25T04:18:11.521Z

just appalling really just sloppy work you guys don’t take things seriously enough to much crap you need to release secure version

glitch · 2019-02-25T07:43:19.707Z

lala0:

just appalling really just sloppy work you guys don’t take things seriously enough to much crap you need to release secure version

I think you are expecting too much. And you can always build your own custom firmware if you are not happy with stock.

rk47 · 2019-05-05T10:39:02.940Z

glitch:

I think you are expecting too much…

I like this product, but I need it to improve before I can recommend it to others. And I cant help but notice how you just keep trying to invalidate or trivialize every bug report the users make here. When I see you arguing in favor of weak security too, I have to question your motive and who you are really working for.