--- title: Advanced Security Options for Access Server canonical: https://openvpn.net/as-docs/advanced-security/ product: Access Server Docs description: Explore advanced security options for Access Server and learn how to use the command-line interface for configurations not available in the web-based GUI. --- # Advanced Security Options for Access Server Access Server provides a range of advanced security configuration options that go beyond the web-based Admin Web UI capabilities. These advanced settings require the command-line interface (CLI), allowing administrators to perform extra configurations and fine-tune security settings for their VPN setup. This section covers the advanced security options available through the CLI, providing detailed instructions and examples to help administrators enhance the security and functionality of their Access Server. ## Change the data-channel encryption cipher for the server and client The [data-channel encryption cipher](https://openvpn.net/as-docs/v3/data-channel-encryption-cipher.md) determines how the data packets transmitted through the OpenVPN tunnel are encrypted and decrypted. On the server, ciphers can be specified in order of priority. The first cipher that the client also supports will be used for the VPN session. This allows for backward compatibility so that newer clients capable of better encryption ciphers will prefer to use those, while older clients can still connect using older cipher methods. - [Tutorial: Change the Data-Channel Encryption Cipher](https://openvpn.net/as-docs/tutorials/tutorial--change-encryption-cipher.md) ## Mid-session TLS encryption key renegotiation For security purposes, Access Server renegotiates the TLS session and encryption key used for an OpenVPN session at regular intervals. The server or client can trigger the renegotiation. - [Tutorial: Change the TLS Session Renegotiation Interval](https://openvpn.net/as-docs/tutorials/tutorial--tls-session-renegotiation.md) ## Authentication failure lockout policy Access Server automatically locks out user accounts after repeated failed authentication attempts to prevent brute-force attacks. When locked out, users see messages like "**LOCKOUT**" or "**User temporarily locked out due to multiple authentication failures**." - **Access Server 2.10 and newer:** The lockout triggers after **five** failed attempts within **15 minutes** and expires after **15 minutes**. - **Access Server 2.9 and older:** Lockout triggers after **three** failed attempts and expires after **15 minutes**. - Access Server tracks incorrect passwords in a lockout dictionary (stored as hashes). The dictionary is purged if it reaches its limit. The default settings are usually sufficient, but high-volume environments may require adjustments. - External authentication systems (LDAP, RADIUS, SAML) may have their own lockout policies. - **Exceptions for Access Server 2.9 and older ONLY:** User-locked connection profiles and bootstrap accounts don't trigger lockouts. Admins can modify lockout settings or manually lift a lockout if needed. - [Tutorial: Configure the Authentication Failure Lockout Policy](https://openvpn.net/as-docs/tutorials/tutorial--authentication-failure-lockout-policy.md) ## TLS control channel security You can configure the TLS control channel security in the Admin Web UI or the command line. - [Tutorial: Change the TLS Control Channel Security Setting](https://openvpn.net/as-docs/tutorials/tutorial--change-tls-control-channel-security.md) - [TLS Control Channel](https://openvpn.net/as-docs/tls-control-channel.md) ## TOTP multi-factor authentication Access Server supports TOTP MFA configured in the Admin Web UI. This provides an additional security step for authenticating users you can easily turn on by clicking a toggle. - [Tutorial: Turn on TOTP Multi-Factor Authentication](https://openvpn.net/as-docs/tutorials/tutorial--turn-on-mfa.md) - [Tutorial: How to Manage TOTP MFA from the Command Line](https://openvpn.net/as-docs/tutorials/tutorial--manage-mfa-cli.md) - [TOTP MFA](https://openvpn.net/as-docs/totp-mfa.md) ## Selecting the TLS level for the OpenVPN daemons Current Access Server versions use TLS 1.2 as the default for the OpenVPN daemons. However, older clients may not support TLS 1.1 or newer. For instance, an OpenVPN client from 2014 or earlier will not connect to a server requiring TLS 1.1 or 1.2. If your current setup uses TLS 1.0 and you have many clients with pre-configured profiles and software, it is recommended to stay with TLS 1.0 to avoid disruptions. Conversely, downgrading from TLS 1.1 or later to TLS 1.0 will also require updating client profiles or software. - [Tutorial: Select the TLS Level for the OpenVPN Daemons](https://openvpn.net/as-docs/tutorials/tutorial--openvpn-daemons-tls-level.md) ## Connecting without client certificates Access Server supports connections without client certificates using a server-locked profile for scenarios where you may need to connect without one. - [Tutorial: How to Connect Without a Client Certificate](https://openvpn.net/as-docs/tutorials/tutorial--connecting-without-certificate.md) --- Prev: [User Lockout](https://openvpn.net/as-docs/authentication-failure-lockout-policy.md) Next: [Logging](https://openvpn.net/as-docs/logging.md) Index: https://openvpn.net/as-docs/llms.txt