Disable server's distribution of client profiles?

skitee

Is it possible to use the server generated user .conf files without having the server automatically distribute them to users upon login?

Our objective is to make sure that a user can only log in from a single designated machine. The general workflow we're aiming for is:

1. We generate a profile for the user on the server and generate a DMG installer for that user
2. The DMG installer is installed on a user's designated machine and the included profile is 'trusted'
3. User is able to login from that computer but can't copy the conf file to a different machine and thus log in from anywhere

We've been able to do all three of the above and it appears that once installed a user conf file is kept quite secure within OS X (it seems to be placed in a folder under /Library/Application Support/OpenVPN that's well locked down and only readable by root (even an admin needs to sudo su to get into that directory). Our users in this use case are not admins and are all on Macs.

The issue is that if a user simply logs in from another computer the access server is being too helpful and just sending out the locally stored profile. How can we stop that (or alternatively pre-configure .conf files with all the necessary keys without having the server automatically send them to the authenticated user).

Thanks in advance for comments and feedback!

P.S. I realize that the above could also be accomplished using a fully separate External PKI setup with client keys installed into the OS X keychain but A) We've had difficulties getting that to work with OpenVPN (topic for another thread) and B) Simply letting the server generate the fully self-contained .conf files is quite nice... we just don't want it to stop simply sending it down to any random client on a successful login

innogen

skitee wroteIs it possible to use the server generated user .conf files without having the server automatically distribute them to users upon login?

How can we stop that (or alternatively pre-configure .conf files with all the necessary keys without having the server automatically send them to the authenticated user).

Please surf to https://lists.sourceforge.net/lists/listinfo/openvpn-users, subscribe to the mailing list and then re-post your question there.

You will get a response from the OpenVPN experts in no time.

Traffic

* Topic moved From OpenVPN Community Edition to OpenVPN Access Server *

skitee wroteThe issue is that if a user simply logs in from another computer the access server is being too helpful

Please see the Access Server Support Options here:
https://openvpn.net/index.php/login.html

innogen wrotePlease surf to https://lists.sourceforge.net/lists/lis ... nvpn-users, subscribe to the mailing list and then re-post your question there

Please ignore innogen ... Do not post Access Server Questions to any Openvpn Community Edition mailing list, thank you.