[PATCH] Disallow OpenVPN DH params less than 1024 bits

[IT Superhack <itsuperhack@web.de>]

[-- Attachment #1: Type: text/plain, Size: 2198 bytes --]

The OpenVPN CGI offers to create a DH param. The patch below disables
the generation of 1024 bit params and marks 2048 bit params as
weak/insecure.

It is recommended to use DH params with at least 3072 bits, shorter ones
are considered as insecure. The patch does not affect systems where
already DH params were created.

Sorry for the crappy line breaks by my mail agent, but it cannot switch
this off and git send-email does not work on my system (starttls issues).

Signed-off-by: Timmothy Wilson <itsuperhack(a)web.de>
---
 html/cgi-bin/ovpnmain.cgi | 3 +--
 langs/de/cgi-bin/de.pl    | 1 +
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi
index 62af54e..4813128 100644
--- a/html/cgi-bin/ovpnmain.cgi
+++ b/html/cgi-bin/ovpnmain.cgi
@@ -1313,8 +1313,7 @@ END
 		<form method='post'><input type='hidden' name='AREUSURE' value='yes' />
 		<input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
 			<select name='DHLENGHT'>
-				<option value='1024' $selected{'DHLENGHT'}{'1024'}>1024
$Lang::tr{'bit'}</option>
-				<option value='2048' $selected{'DHLENGHT'}{'2048'}>2048
$Lang::tr{'bit'}</option>
+				<option value='2048' $selected{'DHLENGHT'}{'2048'}>2048
$Lang::tr{'bit'} ($Lang::tr{'insecure'})</option>
 				<option value='3072' $selected{'DHLENGHT'}{'3072'}>3072
$Lang::tr{'bit'}</option>
 				<option value='4096' $selected{'DHLENGHT'}{'4096'}>4096
$Lang::tr{'bit'}</option>
 			</select>
diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl
index 2bca854..bfed92b 100644
--- a/langs/de/cgi-bin/de.pl
+++ b/langs/de/cgi-bin/de.pl
@@ -1291,6 +1291,7 @@
 'incorrect password' => 'Fehlerhaftes Passwort',
 'info' => 'Info',
 'init string' => 'Initialisierung:',
+'insecure' => 'unsicher',
 'insert floppy' => 'Legen Sie eine formatierte Diskette in das
Floppy-Laufwerk in IPFire und klicken auf <i>Datensicherung auf
Diskette</i>, um die Systemeinstellungen zu sichern.  Überprüfen Sie das
Ergebnis sorgfältig, um sicher zu sein, dass die Datensicherung
vollständig und erfolgreich abgeschlossen wurde.',
 'install' => 'Installieren',
 'install new update' => 'Installiere neues Update:',
-- 
1.8.4.5



[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 455 bytes --]