terrorfrog
Well to clarify, i work with openvpn for years now, many year.
Still after doing a little bit testing many things in the Access Server doesnt make any sense to me.
First of all the concept seems to me only good if you use external auth.
there it does make sense with its automatic config and cert creation, which is very nice indeed.
but when you use local auth you have to create user on the command line.
well that breaks the hole workflow and idea of having a webinterface, doesnt it?
So now lets focus on external auth.
Th Focus of the users webpage is connect instead of login (and no was to change that)
but for this we have to open (or better pass trough) web/xml to the open.
well this is the first thing that bothers me. i dont really like the idea of having the secure gate exposed to webauth outside. even worse. if you use the openvpn connect client for windows it does not only need the webport but also resend all certificates after every reboot
so at the end max security is https because this is used to send all the security details over and over.
this doesnt make any sense.
of course we can turn it off, lock down the webportal to internal only (really recommended if you ask me)
but then again - the login focus is on connect not login - so you have to advise your users to switch that (we all know how this is gonna work out doesnt we)
and here is the thing.
the openvpn connect client is the only client who has easy cert install (import or by web) and chooseable tcp/udp/automatic mode while the opensource client doenst have any of these.
but it doesnt really work without the webport
well to be fair the connect client doesnt seem to work at all at the moment anyway.
on a default debian install, it softresets all the time after the auth process (still haven an open tiket for that one)
still that all seems to be not cooked well, not really though trough or better we want to make it easier for the user even if it means the hole meaning is now ad adsurdum (i know thats latin)
so here is the thing, i cant really find a real meaningful use for the AS.
if i use my scripted servers i have to make users on the cli but recieve ready to go exe files for cert distribution for the opensourceclient
if i use the AS i get automated configs (which is very very nice) but no distribution tech for the opensource client
i get a more or less useful webinterface but its basically only useful then as a download link which i can do with my own scripts (including authentication to get the file) too
Oh and here is another really od thing.
the webinterface connect client always makes a connection to an openvpn server.
not that i mistrust the openvpn guys but - serisously - REALLY?
i may sound old and conservative but for me the vpn webinterface has to make connect between the user and the server and nobody else no matter what for or why. if its about autoupdates and softwareversions well make a cron task or whatever todo that.... but a webredirect doesnt make the best feeling here.
so anyone has a useful realworld application for the AS server?
somewhere where all the webinterface thingys does make any sense ?
