Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #199790

Re: OpenVPN & Debian Stretch

Show all headers | View raw

On Tue, Sep 04, 2018 at 07:42:58PM -0400, Wayne Sallee wrote:
> Has anyone set up OpenVPN with ssh-keygen -t rsa ?
> 

Technically, you can do that.

In practice, you need to have a CA set up, of which easy-rsa is
the simplest choice.

Why? Revocation.

Let's suppose you have an SSH server. Because you are cautious,
you require SSH key auth. One day your laptop is stolen. It has
an SSH private key on it, so you go over to
~/.ssh/authorized_keys and delete the matching public key. Good, 
you have secured your server against unauthorized use of your
account.

OpenVPN doesn't do that. OpenVPN assumes that any properly
signed certificate is wonderful, and you can't get rid of one
just by removing a cert entry on your side. Instead, you need
to formally revoke the certificate, and keep it revoked until 
it reaches its expiration date.

https://community.openvpn.net/openvpn/wiki/Hardening

-dsr-

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

OpenVPN & Debian Stretch "Josh W." <joshw8104@gmail.com> - 2018-09-05 01:10 +0200
  Re: OpenVPN & Debian Stretch Dan Ritter <dsr@randomstring.org> - 2018-09-05 01:30 +0200
  Re: OpenVPN & Debian Stretch Dan Purgert <dan@djph.net> - 2018-09-05 01:50 +0200
    Re: OpenVPN & Debian Stretch Wayne Sallee <Wayne@WayneSallee.com> - 2018-09-05 02:00 +0200
      Re: OpenVPN & Debian Stretch Dan Ritter <dsr@randomstring.org> - 2018-09-05 02:10 +0200
        Re: OpenVPN & Debian Stretch Dan Purgert <dan@djph.net> - 2018-09-05 02:40 +0200
          Re: OpenVPN & Debian Stretch Dan Ritter <dsr@randomstring.org> - 2018-09-05 12:10 +0200
            Re: OpenVPN & Debian Stretch Dan Purgert <dan@djph.net> - 2018-09-05 12:50 +0200
              Re: OpenVPN & Debian Stretch Wayne Sallee <Wayne@WayneSallee.com> - 2018-09-05 13:00 +0200
                Re: OpenVPN & Debian Stretch Dan Ritter <dsr@randomstring.org> - 2018-09-05 15:00 +0200
                Re: OpenVPN & Debian Stretch Wayne Sallee <Wayne@WayneSallee.com> - 2018-09-06 01:10 +0200
                Re: OpenVPN & Debian Stretch Wayne Sallee <Wayne@WayneSallee.com> - 2018-09-06 17:40 +0200
  Re: OpenVPN & Debian Stretch Wayne Sallee <Wayne@WayneSallee.com> - 2018-09-05 13:00 +0200
    Re: OpenVPN & Debian Stretch deloptes <deloptes@gmail.com> - 2018-09-05 20:00 +0200

csiph-web