From 9696719a37c16879c5fc9336767bad699b05e744 Mon Sep 17 00:00:00 2001 From: james Date: Sun, 24 Dec 2006 10:38:56 +0000 Subject: --reneg-sec clarification in man page. Should be added to 2.0.x branch as well. git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@1606 e7ae566f-a301-0410-adde-c780ea21d3b5 --- openvpn.8 | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'openvpn.8') diff --git a/openvpn.8 b/openvpn.8 index 48ae430..c52d1c1 100644 --- a/openvpn.8 +++ b/openvpn.8 @@ -3860,6 +3860,19 @@ packets sent and received (disabled by default). Renegotiate data channel key after .B n seconds (default=3600). + +When using dual-factor authentication, note that this default value may +cause the end user to be challenged to reauthorize once per hour. + +Also, keep in mind that this option can be used on both the client and server, +and whichever uses the lower value will be the one to trigger the renegotiation. +A common mistake is to set +.B --reneg-sec +to a higher value on either the client or server, while the other side of the connection +is still using the default value of 3600 seconds, meaning that the renegotiation will +still occur once per 3600 seconds. The solution is to increase --reneg-sec on both the +client and server, or set it to 0 on one side of the connection (to disable), and to +your chosen value on the other side. .\"********************************************************* .TP .B --hand-window n -- cgit v1.2.3