Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote -1 down vote favorite

Is it a security issue not using the tls-remote option in OpenVPN? That is not verifying the server's common name. Is a MITM attack possible? Could this be an issue, especially with services like dyndns.org?

share|improve this question
"This question meets quality standards." -- what? Also, this would likely be better suited at IT Security. – Chris Down Dec 14 '12 at 9:25
There was a message, the question would not meet the Quality Standards. So I had to tell the message board that it does. – chris Dec 14 '12 at 10:06

1 Answer

up vote 0 down vote

tls-remote restricts OpenVPN to connect to a machine with a specific name. This isn't a very common option, and it mostly makes sense on the client side. Usually, you will want the flexibility of accepting connections from any peer that has a key from an accepted CA (specified by the ca option).

If you don't perform any verification on the client side, then indeed you risk a MITM attack.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.