FLipMode2k6
Hello guys,
I'm on the edge of desparation
I set an OpenVPN AS up and configured that is important (to my knowledge)
Authentication via LDAP works fine, connected users get the right IP, etc....
but one Thing Mocks me...the freaking authentication via TLS.
-I built my own CA with the openvpn tool for Windows via cmd.
-I didn't get any Errors, and was confident at what i was doing.
-I copied the ca.crt, Client.crt, Client.key on my Client (is there a Special place this should be ?) and doubleklicked both certificates
-I uploaded ca.crt, Server.crt and Server.key to my Webserver (via GUI)
The Connection via TLS 1.0 works perfectly, but if I set the Minimum TLS Protocol Version accepted by OVPN Server to higher than that (1.1 and 1.2) it just tries to connect for Ages and tells me afterwards that the Connection timed out.
Pinging obviously works and everything else as well....
any suggestions ?
The Johan
If you build your own CA with the openvpn tools, then we can't help you. TLS authentication is already automatically enabled and in use on the Access Server. If you use that, sure, we can help you. Putting your own keys in on top of that, and we have no idea what will happen, but most likely it will just break.
Regarding TLS 1.0 vs TLS 1.1 and TLS 1.2; the switch is not always automagic. If you make the decision to change this setting, then be prepared to do a reinstall of the Connect Client. Also, if you're using for example OpenVPN on Ubuntu, you will need to ensure you have a more up to date version of OpenVPN. Last time I checked, the version of OpenVPN that comes with Ubuntu 14 was built in December 2014, and did not support TLS 1.1/1.2.
FLipMode2k6
Thanks for the help, I still have some questions about it.
How can I see the certificates the AS made and how am I able to copy the certificates to my client ?
Where is the security if I can just login by Name and Password and get the certificate ? I want a CA in order to create and sign the files there.
The important thing to me is, that someone needs to be physically at the server to get a certificate via USB stick or something like that.
Is there a possibility to manage this ?
The Johan
Certificates are embedded in the connection profiles. You can get them out separately either by copying and pasting them out of the connection profiles, but I'm not sure why you would to. The command line scripts also have the option of generating separate configuration file and certificate sets.
If you don't like the user name / password method, then disable the client web UI and run things manually. This makes you as an administrator responsible for grabbing the connection profiles from the Access Server either via a blocked-off client web UI (only you can access it) or the command line scripts to generate either separate connection profiles or generate installers that come with connection profiles pre-bundled, and distributing them to your users.
FLipMode2k6
Ok, so if I use the access server with GUI, I have to deal with the fact, that everyone who has user credentials gets a certificate from access server ?
Regarding security, this would be complete bullshit. The Access Server should be operating from a DMZ so it's, unlike the rest of my network, reachable...
But having my certificates there makes absolutely no sense....It's like laying my keys in front of my house, or am I mistaking here ? I thought the AS for which I actually have to pay will have more security features than the standard community version of Ovpn...
The Johan
I really don't have the inclination to discuss this, it serves no purpose.
If you want this separation, then configure it to operate that way; it's as simple as that.
Good luck now.
FLipMode2k6
Thanks for your help and sorry for bothering you.
I'm an IT trainee and I worked on this project for a month...now I start to realize that did a big mistake by choosing ovpn as since there aren't any real reasons left to go with it.
I have no real clue on how to continue now and probably wont be able to finish it by now...
so I need to go for half a year more ._.
So sorry for sounding a little bit rude....it's just my mood atm...no intention to discuss or offend you.
Traffic
FLipMode2k6 wrotehaving my certificates there makes absolutely no sense....It's like laying my keys in front of my house, or am I mistaking here ?
So mistaken .. the alternative would be
like bricking up the door way .. :lol:
FLipMode2k6
Welp it's not like ppl wouldn't do that to get into a big company network....
