2

I ask you if my clients connect to openvpn server through two files only: client.ovpn and ca.crt, Is this connection secure? Any security problems in this mechanism there? Is the connection encrypted?

Knowing that:

  1. Clients can connect without any problems or warnings,
  2. Openvpn client should connect to server though these four files: client.crt client.key ca.crt client.ovpn ,
  3. client.ovpn as shown:
client
dev tun0
proto tcp
remote IP PORT
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
# cert client.crt
# key client.key
remote-cert-tls server
;tls-auth ta.key 1
cipher AES-128-CBC
comp-lzo
verb 3
auth-user-pass pass

Server configuration:

port port 
proto tcp 
dev tun0 
ca ca.crt 
cert server.crt 
key server.key 
dh dh2048.pem 
server P.P.P.P 255.255.255.0 
ifconfig-pool-persist ipp.txt 
push "dhcp-option DNS 8.8.4.4" push "dhcp-option DNS 8.8.8.8" 
cipher AES-128-CBC 
comp-lzo 
persist-key persist-tun 
status openvpn-status.log verb 3 
client-cert-not-required 
plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so login 
  • What is the corresponding server configuration? Is the user prompted for a password? – vidarlo May 5 '18 at 10:43
  • @vidarlo : The user is promoted for a password which saved in a file, the user has 3 files only(client.ovpn+ca.crt+pass) ------- ** Server Configuration ** ------- port port proto tcp dev tun0 ca ca.crt cert server.crt key server.key dh dh2048.pem server P.P.P.P 255.255.255.0 ifconfig-pool-persist ipp.txt push "dhcp-option DNS 8.8.4.4" push "dhcp-option DNS 8.8.8.8" cipher AES-128-CBC comp-lzo persist-key persist-tun status openvpn-status.log verb 3 client-cert-not-required plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so login – A. suda May 6 '18 at 8:53
  • Please edit your question to include new information. As a sidenote, when a password is used, the connection is authenticated. Is this safe enough? It depends on the purpose of the VPN connection and what it protects. There is no fixed answer. In some instances a unencrypted, unauthenticated VPN may be all fine and dandy. In others, not so. – vidarlo May 6 '18 at 9:04
  • @vidarlo Are the clients connection with server encrypted? – A. suda May 6 '18 at 9:14
3

In the server configuration you have the following lines:

client-cert-not-required 
plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so login 

client-cert-not-required has the following description from man openvpn:

Don't require client certificate, client will authenticate usingu sername/password only. Be aware that using this directive is less secure than requiring certificates from all clients.

The plugin requires authentication against PAM.

The data is encrypted when it transits the VPN. This is shown by the line cipher AES-128-CBC, which specifies which encryption to use. AES is generally regarded as secure.

If you consider this secure enough depends on what you are attempting to protect, and the quality of the passwords. There's no one-stop answer to this; you have to define the threats you find applicable, and what security is acceptable.

Maintaining a CA and distributing certificates may be more work than distributing passwords. This depends on your setup. It also makes it more difficult to setup VPN on a new computer, as you securely have to bring the relatively long key to that computer. The decreased security of password authentication may be a worthwhile trade off in this aspect.

TL;DR: It depends.

  • Can you explain which configurations must be added to authenticate clients using certificates from all clients. I want to allow more clients to use the unique certificate. – A. suda May 6 '18 at 9:32
  • Remove the line client-cert-not-required. – vidarlo May 6 '18 at 9:33
  • Are client-cert-not-required allows many client to use the unique certificate? – A. suda May 6 '18 at 9:43
  • If you remove the client-cert-not-required each client will need a certificate signed by the same CA as the servers certificate. – vidarlo May 6 '18 at 9:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.