Need help w/ considerations of managing an OpenVPN Server

b1ggjoe

Hello Everyone,

I'm brand-new to OpenVPN, among other things so please go easy on me. Long story short:

I recently inherited what *appeared* to be a small/pet project from my employer. Basically, it's a tiny company that would like to provide their mobile sales force with a 'workplace perk' of offering the sales employees their own 'VPN Service account'. The main thing here is so that when these mobile sales folks connect to a public Wi-Fi (Starbucks being the main perp), that they can browse the internet more securely.

So, some of the folks in management were looking into the countless 'VPN Providers' out there, such as 'Private Internet Access' and etc. They were (probably still are) considering negotiating a deal with these providers to purchase a few dozen licenses/accounts and be able to offer this to each sales person.

My boss thought that this could be a bit pricey, so in an attempt to save the company $, decided to investigate the possibility of running/managing our own OpenVPN Server.

So, of course in true typical management fashion, the project landed on my lap, the one with more to do than anyone else...lol.

So after a lot of reading, I managed to finally setup an OpenVPN Server on Ubuntu 64-bit 14.04. Thus far, all is well and working flawlessly...or so I think. I bumped up the RSA key to 2048 bit encryption and thus far, everything is working perfectly.

Anyway, in researching some of the VPN providers as well and comparing the costs of everything...I started to become concerned about the underlying legal and potential liability issues of running/managing such a server.

So here's where I would love to get some help. Since my questions and issues affect everyone that runs their own OpenVPN Server...here's where I'm lost and would love some guidance:

- To log or not to log? So many providers advertise 'No Logging'. Is this real? How the hell can one prove that they are logging or not? Did I happen to 'enable' or 'disable' logging without even knowing it?

- What are the potential liability issues for either myself or the company, if we log or do not log? What if we get a court order asking for logs? If I say, 'Nope sorry, we here don't keep no logs', will I then get arrested? Am I legally required to keep logs?

- Also, from what I read, OpenVPN (SSL VPN) is the best all-around method of providing VPN Service, much more superior and efficient that PPTP, L2TP and IP-SEC. Is there a reason that I should consider installing/enabling these other VPN protocols, in addition to OpenVPN? These other providers seem to do so, so should I do this for our employees?

- I'm thinking that we should come up with some sort of ToS or Disclaimer and have these sales folks agree and sign before they are granted such a service. Any thoughts on this?

- I was planning on just using the free OpenVPN clients and come up with a few short 'DIY Install Methods'. Any recommendations on this?

- I also heard about the potential exposure if the OpenVPN Client disconnects while the employee is away. I'm looking into 3rd-party freeware like 'VPN Check' for this. Any thoughts?

As you can see, there is a lot that I don't know...so your help will be greatly appreciated.

Thank you,

BJ

Traffic

You need Legal advice not technical support ..

* Off Topic *

b1ggjoe

Hello Traffic,

Yes, you're absolutely right. I realized that after posting the message and doing some more research, so I have brought this to my management's attention and we are going to start looking into it.

In the meantime, here are a few technical questions for everyone:

1. - I was looking at my OpenVPN's 'server.conf' file. Under verb (verbosity) it is set to #3. How can I tell if log's have been enabled to go to ' Ubuntu syslog' rather than on some separate file?

2. - From what I read, OpenVPN (SSL VPN) is the best all-around method of providing VPN Service, much more superior and efficient that PPTP, L2TP and IP-SEC. Is there a reason that I should consider installing/enabling these other VPN protocols, in addition to OpenVPN? These other providers seem to do so, so should I do this for our employees? Are there any technical advantages to enabling some of these other protocols, in addition to OpenVPN?

3. - I also heard about the potential exposure if the OpenVPN Client disconnects while the employee is away. I'm looking into 3rd-party freeware like 'VPN Check' for this. Any thoughts on this?

4. - How can we figure out how many maximum users we should have per VPN Server? For example, after X amount of users, should we perhaps scale the Server to a more powerful configuration or possibly just create an entirely new Server?

Thank you,

BJ

xauen

1. - I was looking at my OpenVPN's 'server.conf' file. Under verb (verbosity) it is set to #3. How can I tell if log's have been enabled to go to ' Ubuntu syslog' rather than on some separate file?

from default openvpn server config:

# Output a short status file showing
# current connections, truncated
# and rewritten every minute.
status openvpn-status.log

# By default, log messages will go to the syslog (or
# on Windows, if running as a service, they will go to
# the "\Program Files\OpenVPN\log" directory).
# Use log or log-append to override this default.
# "log" will truncate the log file on OpenVPN startup,
# while "log-append" will append to it. Use one
# or the other (but not both).
;log openvpn.log
;log-append openvpn.log

# Set the appropriate level of log
# file verbosity.
#
# 0 is silent, except for fatal errors
# 4 is reasonable for general usage
# 5 and 6 can help to debug connection problems
# 9 is extremely verbose
verb 3

2. - From what I read, OpenVPN (SSL VPN) is the best all-around method of providing VPN Service, much more superior and efficient that PPTP, L2TP and IP-SEC. Is there a reason that I should consider installing/enabling these other VPN protocols, in addition to OpenVPN? These other providers seem to do so, so should I do this for our employees? Are there any technical advantages to enabling some of these other protocols, in addition to OpenVPN?

If you dont want to install anything you can use PPTP or L2TP. They are built into any operating system.

3. - I also heard about the potential exposure if the OpenVPN Client disconnects while the employee is away. I'm looking into 3rd-party freeware like 'VPN Check' for this. Any thoughts on this?

I think its a great option to have.

4. - How can we figure out how many maximum users we should have per VPN Server? For example, after X amount of users, should we perhaps scale the Server to a more powerful configuration or possibly just create an entirely new Server?

It all depends on the infrastructure you will use plus how your client is using the vpn. Usually you can start by limiting how many concurrent client you can have in a server, then you can adjust this as you go along.
from default openvpn server config:

# The maximum number of concurrently connected
# clients we want to allow.
;max-clients 100

Documentation is here: https://openvpn.net/index.php/open-source/documentation/howto.html

b1ggjoe

Thank you!!!!!!

BJ