I'm trying to harden the L2TP/IPSec VPN on an El Capitan server. All the resources I can find either just walk you through the basic setup (adding a shared key, etc.) or are for third-party servers. The closest I found was this question, but it only talks about the defaults, not about how to override them.
Specifically, I'm trying to make the following changes to the allowed ciphers:
- Symmetric cipher - AES only (nothing DES-based due to the short block size), CBC if that's the best available but GCM preferred if possible.
- Hash: SHA2 family if possible, especially if unable to use GCM.
- Key exchange: Use a 2048-bit Diffie-Hellman group (or larger), or use ECDH, or at least don't use the default 1024-bit group as it should be presumed compromised by the NSA or similarly-equipped groups already (see WeakDH).
I can't find anything on changing the default ciphers supported by the Mac OS Server for VPN. I'm new to Mac servers (though comfortable on a Unix command line).
The closest things I found are /Library/Server/Configuration/services.mobileconfig
, which includes some basic details about VPN and IPSec configuration but nothing that looked like it controlls ciphers, and /Library/Server/Preferences/com.apple.servermgrd.plist
, which includes a list of forbiddenSSLCipherSuites
(by integer ID only) but nothing about IPSec.