OpenVPN confusion...

[frowertr]

Have been playing with OpenVPN for a couple days and I find it confusing. Especially when it comes to users/certs. Here is what I have done:

1. Installed OpenVPN onto Ubuntu 13.10 Server
2. Uploaded a purchased CA SSL cert to the OpenVPN webserver so that I can connect to the server from the internet and the browser won't complain it's not trusted.
3. Add users to the user authentication area and use PAM
4. After I download the client to a remote computer/phone I can connect to my server by putting in my PAM credentials and I then have LAN and internet access through the VPN which is the goal.

My question has to do with certs. I keep reading all over the place about PKI and setting up a CA in order to sign client certs. I have no idea what the hell any of that is. I didn't do any of that. I just added my user name to the User Management area of OpenVPN server and I log on with my linux username/password.

I'm assuming the way I am currently doing it is not secure. Someone could easily brute force the username/password against the server in order to gain access to my entire LAN (which would be bad).

Are using the cert files in OpenVPN similiar to how SSH can be used with keys? For example, I have SSH locked down so that you cannot log onto my Linux boxes with usernames/passwords. You must use keyfiles that are associated with the servers public key.

What is the recommended way to login to OpenVPN servers?

 

[CubanlB]

There are 2 certificate and a private key usually used by OpenVPN on the client. These are somewhat similar, but both the client and server have a Public and private key pair.

The generated CA cert (ca.crt usually, this also has a private key which should never leave the server)
The client cert (Whatevernameyouchose.crt)
The client key (Whatevernameyouchose.key this is the part that needs to be protected)

The certs are usually generated on the OpenVPN server, as there are scripts you can run to generate them. You are using an issued cert co you would want to make sure you just put the Cert on the client, and not also put the server private key on the client.

You can also generate a symmetrical key for TLS auth (which secures the TLS negotiation on the initial connection). This is usually ta.key when generated on the OpenVPN server.

I us AD user auth, certs and a TA.key for my OpenVPN setup. There are good instructions on getting this all setup from OpenVPN.

I am not familiar with browser integration for OpenVPN, so can't really help you there.

 

[frowertr]

CubanlB,

Thanks for the response. I guess I have more reading to do.

Is there simply no way for OpenVPN server to work like SSH can as far as authenticated with key use only? In other words, so one doesn't have to type in a username/pass in order to connect to the VPN server?

 

[CubanlB]

You can certainly just uses Cert/Key pairs instead of user auth.

It's actually easier to setup.

 

[frowertr]

You can certainly just uses Cert/Key pairs instead of user auth.

It's actually easier to setup.

This is what I want to do. Feels more secure to do it this way as nothing can be brute forced and if a client key is ever compromosed (stolen phone/laptop) then it can be revoked on the server side.

You wouldn't happen to have any links showing how to do this would you?

 

[CubanlB]

https://openvpn.net/index.php/open-source/documentation/howto.html
(Documentation from OpenVPN)

https://docs.google.com/viewer?a=v&...W5kc29uaW5mb3RlY2h8Z3g6NGY4ZWNjYTdmNDFiYzY2Yw
(Something I made for other students some time ago, might not be 100% accurate)

 

[frowertr]

Great. I'll check them out!