[OpenVPN home] [Date Prev] [Date Index] [Date Next]
[OpenVPN mailing lists] [Thread Prev] [Thread Index] [Thread Next]
Web openvpn.net

[Openvpn-users] Authentication solution

  • Subject: [Openvpn-users] Authentication solution
  • From: Steve Finkelstein <sf@xxxxxxxxxxxxx>
  • Date: Wed, 04 Apr 2007 15:37:25 -0400

Hi all,

This question is more educational than an actual technical/configuration
issue. I currently run a small network with an edge c2620 router and a
layer 2 3560G switch which does VLAN trunking to a linux
firewall/gateway for my end hosts.

My firewall, which sits on the DMZ, is also currently running OpenVPN so
users can remotely VPN into the internal network. As this is just
currently a beta network, certificate based authentication is all that's

Now, this is where my slight dilemma falls into place. I need to allow a
set of users to VPN who I don't trust as much. I don't necessarily feel
it's a great idea to give them certificate based auth cause they can
just toss the certificate on any box and be able to open a VPN tunnel
into the internal network. Also, I'm not responsible for security on
their workstations, so if they get compromised, the attacker will have
access to my network.

I'd like to figure out a solution to the above. My end users, located in
an overseas office, do not have access to their gateway.

1) Does it make sense that I create certificates for them and also
require them to authenticate with LDAP or some other username/password

2) Is it possible to have remote users, based on certificate, receive a
particular static tunneled IP so I can firewall them accordingly internally?

3) Can I require certain certificates to be granted access without
username/password auth, while others are required to use LDAP to auth

Thank you!

- Steve
OpenVPN mailing lists