TeleBoss 850 2.06.280_STD User Manual
Page 80
items
o
certificate
o
key
o
CA certificate
o
DH parameters
The idea behind this paradigm is that you do something (an action) on something (an item).
The command line arguments that specify actions and items are:
-e Specify item: certificate
-k Specify item: key
-r Specify item: CA certificate
-t Specify item: TLS-auth key
-h Specify item: DH parameters
-l
Specify action: list item
-a Specify action: add item
-d Specify action: delete item
You must also specify which VPN you want this applied to with the "-v" command line argument:
-v x Specify VPN x, where x is 1 or 2
For example, to load the CA certificate for VPN 1, enter
SSLC -a -r -v 1
The unit cannot generate its own SSL authentication key/certificate. You must do this with another OpenVPN
server installation and load the certificates/keys, DH parameters, and possibly TLS-auth key (if you choose the
extra layer of security that TLS-auth provides), on the unit with the SSLC command. It is recommended you use
the SSLC command either in a trusted network environment via Telnet or via SSH. This is for two reasons:
1. The data you upload is text format, and is accepted without any application layer protocol like Xmodem.
Therefore to make eliminate communcation errors, use the protocol on a TCP-based command processor
(like Telnet or SSH).
2. Some of the things you must transfer using the SSLC command are secret data (the key and the TLS-
auth key). "Secret" means that only the unit knows about it (and possibly the server as well, if that is kept
in a secure location), and if this key is compromised then the security of the entire VPN is compromised.
The CA certificate is the certificate of the certificate authority that both the unit and the server trust. The CA signs
both the certificate for the server and the certificate for the unit. The CA certificate must exist on both machines.
The "DH parameters" item represents the Diffie Hellman parameters. By default the unit comes with 1024-bit
parameters.
So it works through NAT-ting routers, that means it uses TCP or UDP, right?
It can use either UDP or TCP, although it works optimally with UDP. Change this to suit your firewall access
policies with the
net.vpn[x].ssl.proto
key (its values are "TCP" and "UDP"), and the
net.vpn[x].ssl.port
keys (its value is an integer for the TCP/UDP port you choose).
I'm paranoid about security, how do I make it as secure as possible?
There are three things you can do to improve security with OpenVPN.
1. Add more HMAC authentication using a pre-shared key called a TLS-auth key. This is manipulated with
the SSLC command with the "TLS-auth key" item. The key must be generated by another OpenVPN
server installation.
2. Configure a cipher you are comfortable with. See the next question for how to configure the cipher.
3. Use a server certificate with the "server" nsCertType value, and configure the client to require a "server"
nsCertType certificate (more on this in the next section).
I already have an OpenVPN client configuration in mind...how do I make the unit cooperate?
The client is configured with a text configuration file; this is the first place to look to figure out what you need to
configure on the unit. The unit essentially maintains the same configuration file, but you cannot edit it directly.
Summary of Contents for Teleboss 850
Page 6: ......
