From: james <james@e7ae566f-a301-0410-adde-c780ea21d3b5>
Date: Sun, 24 Dec 2006 10:38:56 +0000 (+0000)
Subject: --reneg-sec clarification in man page.
X-Git-Tag: v2.1_rc2~5
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9696719a37c16879c5fc9336767bad699b05e744;p=thirdparty%2Fopenvpn.git

--reneg-sec clarification in man page.
Should be added to 2.0.x branch as well.


git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@1606 e7ae566f-a301-0410-adde-c780ea21d3b5
---

diff --git a/openvpn.8 b/openvpn.8
index 48ae43053..c52d1c147 100644
--- a/openvpn.8
+++ b/openvpn.8
@@ -3860,6 +3860,19 @@ packets sent and received (disabled by default).
 Renegotiate data channel key after
 .B n
 seconds (default=3600).
+
+When using dual-factor authentication, note that this default value may
+cause the end user to be challenged to reauthorize once per hour.
+
+Also, keep in mind that this option can be used on both the client and server,
+and whichever uses the lower value will be the one to trigger the renegotiation.
+A common mistake is to set
+.B --reneg-sec
+to a higher value on either the client or server, while the other side of the connection
+is still using the default value of 3600 seconds, meaning that the renegotiation will
+still occur once per 3600 seconds.  The solution is to increase --reneg-sec on both the
+client and server, or set it to 0 on one side of the connection (to disable), and to
+your chosen value on the other side.
 .\"*********************************************************
 .TP
 .B --hand-window n