--reneg-sec clarification in man page.

Should be added to 2.0.x branch as well.

git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@1606 e7ae566f-a301-0410-adde-c780ea21d3b5

diff --git a/openvpn.8 b/openvpn.8
index 48ae4305334372a5cd3893b758d2435b5893653b..c52d1c14757cedf3eaba5e0bc556b0999d0af60f 100644 (file)
--- a/openvpn.8
+++ b/openvpn.8
@@ -3860,6 +3860,19 @@ packets sent and received (disabled by default).
 Renegotiate data channel key after
 .B n
 seconds (default=3600).
+
+When using dual-factor authentication, note that this default value may
+cause the end user to be challenged to reauthorize once per hour.
+
+Also, keep in mind that this option can be used on both the client and server,
+and whichever uses the lower value will be the one to trigger the renegotiation.
+A common mistake is to set
+.B --reneg-sec
+to a higher value on either the client or server, while the other side of the connection
+is still using the default value of 3600 seconds, meaning that the renegotiation will
+still occur once per 3600 seconds.  The solution is to increase --reneg-sec on both the
+client and server, or set it to 0 on one side of the connection (to disable), and to
+your chosen value on the other side.
 .\"*********************************************************
 .TP
 .B --hand-window n