Does Unifi ever update their OpenVPN server software?

[HarryH3]

I setup a hand-me-down Ubiquiti Unifi UDR for testing. When I setup the OpenVPN server on it and downloaded the client, I was shocked to see that it still uses SHA1 for auth. I seem to recall this getting updated in Merlin a long time ago, by integrating later versions of OpenVPN Server into his configs. Does anyone attempt to keep Ubiquiti on their toes for stuff like this? IIRC, SHA1 was deprecated as incredibly easy to crack around 2011 or so. I'm also not sure that the cipher AES-256-CBC is supported on later versions of OpenVPN server, but that could just be my failing memory.

I seriously doubt that my VPN use would be incredibly useful to anyone, but it just doesn't seem right that a 1-man code warrior can update his ASUS code so much better than a bazillion dollar corporation does! Do they only treat their lower end routers like this, or do their uber-expensive enterprise grade boxes have this same deficiency?

This is part of the client.opvn file created by the UDR:
auth-user-pass
remote-cert-tls server
cipher AES-256-CBC
comp-lzo
verb 3

auth SHA1
key-direction 1

The UDR has the latest released updates :
Unifi OS: 4.4.11
Network 10.0.162

So yeah, no excuses. Or are there?

Any thoughts? Thanks!

 

[RMerlin]

SHA1 was deprecated as incredibly easy to crack

As an HMAC, SHA1 is still fine. It's not used for security purposes, it's used for integrity purposes, so it's not an issue.

 

[HarryH3]

As an HMAC, SHA1 is still fine. It's not used for security purposes, it's used for integrity purposes, so it's not an issue.

Good to know! I'm still amazed that you manage to integrate newer versions of third-party packages in your firmware than Ubiquiti does in theirs. Well done, sir!

 

[Tech9]

I believe they use 2.5.x version currently. A new UniFi OS update is in Release Candidate stage, don't know what version will be there, if different. I can only guess software complexity, large ecosystem and 3rd party hardware compatibility requires certain level of stability and coordination. They would rather patch specific issues only than replace a package. I have UniFi gateways on residential networks, but also Netgate gateways on business networks. Netgate use similar approach. They did move to 2.6.x though for DCO.