Sephiroth
I am setting up my new company's AD domain and such, and it will be 100% Linux. I will be running multiple virtual machines under XenServer on a PowerEdge 2900. One VM will be Debian Wheezy 7 running the ISC DHCP server, BIND9 for DNS, and SAMBA4 for AD. One will be a file-server, and one will be dedicated to functioning as an OpenVPN server. I have been reading through the documentation and if I understand it correctly I can authenticate against my AD server. If so, I have a few questions regarding security and such.
First, I fully understand how to generate certificates (I normally use 2048bit or 4096bit on my DD-WRT or Tomato routers) and love the security that this method offers. If I use AD for authentication, will I still need certificates? I would prefer to use AD authentication so I do not have to hand out a ton of certificates, and so I can simply add or remove users from an OpenVPN security group in AD. Regardless of this however, does it still offer the encryption and security if I use AD authentication that is offered with certificates?
Next, I have only configured OpenVPN in the past using the GUI in the open-source firmwares that I run on my many routers. I am quite good in the shell with nano and vi, but I have never had to hand-craft a configuration file for something like this. Where should I begin? I will tell you that I am a visual learner. I have been that way my whole life, so pointing me at a manual is less likely to help than pointing me to an example that is broken down with explanations. I am not asking for a hand-out because I want to understand OpenVPN, but I can read a manual multiple times and I may get it or I may not.
Finally, my goal here is to configure a secure VPN connection that will, when active, act as though I am physically on the LAN at my office. This includes access to my DNS server, network printers, workstations (I have to troubleshoot them, and doing so remotely will be nice), and anything else. I will be linking our second location to this one in the future using either another server, or a router at that location. With that in mind, I would not want to pass DHCP requests and such through the tunnel between the LANs, but I will want to pass DHCP to the OpenVPN clients themselves, such as my laptop or the remote router which will join the two LANs.
So, can you help me get up and running?
