Disable comp-lzo in templates due to VORACLE attack vulnerability

a6a5132b · Lindsay Harvey · 1240eb12 · a6a5132b · a6a5132b · a6a5132b
Commit a6a5132b authored Jan 05, 2021 by Lindsay Harvey
--- a/config/ovpn-client.conf
+++ b/config/ovpn-client.conf
@@ -6,7 +6,7 @@ proto %%PROTOCOL%%
 nobind

 client
-comp-lzo
+#comp-lzo <- Do not use this option due to VORACLE attack vulnerability
 pkcs12 %%ORGNICK%%-%%USERNAME%%.p12
 remote-cert-tls server
 cipher AES-256-CBC

--- a/config/ovpn-generic-client.conf
+++ b/config/ovpn-generic-client.conf
@@ -6,7 +6,7 @@ proto %%PROTOCOL%%
 nobind

 client
-comp-lzo
+#comp-lzo <- Do not use this option due to VORACLE attack vulnerability
 remote-cert-tls server
 cipher AES-256-CBC
 pull

--- a/config/server.conf
+++ b/config/server.conf
@@ -25,7 +25,7 @@ ifconfig-pool-persist /var/lib/openvpn-server/openvpn/ifconfig-pool.txt

 keepalive 10 90

-comp-lzo
+#comp-lzo <- Do not use this option due to VORACLE attack vulnerability

 persist-key
 persist-tun