We host collaborative projects on hosted system (just one Ubuntu node/server) that we'd like to keep "private" within a circle of trusted people. Some domains mapped to this server we want to secure, others we don't. Thinking of securing each "secure" domain via an OpenVPN server on said hosted system. This feasible? Realizing this it outside typical scenario, where a VPN server often makes a "bridge" between VPN clients and set of [b]other[/b] servers on the VPN. In my case, want the VPN server and "secured" domains/server all on the same box/system. I do have at least 2 IP addrs available on said hosted system... if that's of any help. But probably only one physical NIC. Thoughts? Would the procedure be any different than the following, and if so, how? https://help.ubuntu.com/community/OpenVPN If not OpenVPN, got any alternative suggestions/tools/methods/paradigms to enable me to host my "private" collaboration teams?

[quote="Mimiko"]OpenVPN can join different systems (virtual or phisical), but not different applications or virtual names.[/quote] Right, makes sense. However... [b][i]Primary objective: single-system vpn-protect 1 out of 2 IP addrs[/i][/b] With at least 2 IP addresses mapped to my one system (virtual or physical), hoping we can OpenVPN-protect all domains--and said applications--on one IP address (call it "ipaddrA"), and leave all other domains on the other IP address (call it "ipaddrB") exposed. Is this possible? [b][i]Alternative: vpn-protect all ip addrs on single system[/i][/b] If above "split IP addrs" can't work (and am holding out hope it can): how about simply making [u]all[/u] domains/ipaddrs on said system OpenVPN protected? Is [i]this[/i] feasible? An aside: Understood about application-level security. However, trying to specifically avoid app-level security admin/management to reduce overall system complexity for admins, users, etc. Having to inject app-level security is a major effort and takes constant maintenance and care that my team doesn't want to expend. With a VPN, most access-level security concerns are addressed at one point: the VPN server-client relationship. Basically a "one-stop shop" for accessibility. (Hoping this perspective and these goals are reasonably obvious, so won't write details/justification here...)

Yes, RDP is window's remote desktop protocol. :P

"Standalone" VPN server for VPS to "secure itself"

hydrostarr

We host collaborative projects on hosted system (just one Ubuntu node/server) that we'd like to keep "private" within a circle of trusted people. Some domains mapped to this server we want to secure, others we don't.

Thinking of securing each "secure" domain via an OpenVPN server on said hosted system. This feasible?

Realizing this it outside typical scenario, where a VPN server often makes a "bridge" between VPN clients and set of other servers on the VPN. In my case, want the VPN server and "secured" domains/server all on the same box/system. I do have at least 2 IP addrs available on said hosted system... if that's of any help. But probably only one physical NIC.

Thoughts?

Would the procedure be any different than the following, and if so, how?
https://help.ubuntu.com/community/OpenVPN

If not OpenVPN, got any alternative suggestions/tools/methods/paradigms to enable me to host my "private" collaboration teams?

Mimiko

Hi.

Do you have virtual machines on the phisical server? Or one system that holds multiple domains? It's a web server?

Not sure that I understood the logical configuration of your hosted system.

hydrostarr

(Good questions, sorry for not clarifying earlier.)

It's one system that hosts/holds/servers multiple domains, primarily for web serving (http, https) but also other ports (jabber, imap, smtp, etc). Want to control/specify which domains require an OpenVPN tunnel and which do not...all on the same server/system.

Said server system may or may not be itself a virtual machine (if it is a VM, it will be Xen-served) or a physical/dedicated system. Will have root access in any case.

Mimiko- does that answer your question(s)?

Mimiko wroteHi.
Do you have virtual machines on the phisical server? Or one system that holds multiple domains? It's a web server?
Not sure that I understood the logical configuration of your hosted system.

Mimiko

Oke, I've got it.

You want to secure access on Application Layer. But VPN works on Transport Layer. OpenVPN does not know how to idntify your domains, because they are all packets to OpenVPN. And domains are only a virtual naming the same system by different name.

I reccomend use Application's internal security to limit access to different domains. Because only, for example web service, applications are aware about different domains, thus replaying with data from different paths.

OpenVPN can join different systems (virtual or phisical), but not different applications or virtual names.

hydrostarr

Mimiko wroteOpenVPN can join different systems (virtual or phisical), but not different applications or virtual names.

Right, makes sense. However...

Primary objective: single-system vpn-protect 1 out of 2 IP addrs

With at least 2 IP addresses mapped to my one system (virtual or physical), hoping we can OpenVPN-protect all domains--and said applications--on one IP address (call it "ipaddrA"), and leave all other domains on the other IP address (call it "ipaddrB") exposed. Is this possible?

Alternative: vpn-protect all ip addrs on single system

If above "split IP addrs" can't work (and am holding out hope it can): how about simply making all domains/ipaddrs on said system OpenVPN protected? Is this feasible?

An aside:
Understood about application-level security. However, trying to specifically avoid app-level security admin/management to reduce overall system complexity for admins, users, etc. Having to inject app-level security is a major effort and takes constant maintenance and care that my team doesn't want to expend. With a VPN, most access-level security concerns are addressed at one point: the VPN server-client relationship. Basically a "one-stop shop" for accessibility. (Hoping this perspective and these goals are reasonably obvious, so won't write details/justification here...)

Mimiko

hydrostarr, you must understand that VPN (OpenVPN or other implemmentation) does not make firewalling and application access security. It's only meant to securelly connect two (or more) systems/clients/lans. It does not have other possibilities coded in it.

Althougth its possible to achive your goal using OpenVPN, but its mantenance will be much complex than per application security. But I can give you a simple implementation to achive the minimum needed. For this you will have to use OpenVPN (or may be not) with a firewalling program. There are two different implementation with VPN or with RDP.

For VPN implementation. After installing OpenVPN, you'll have to create two instances of your secured applications (or use same instance but making correct configuration). One of the instances must be configured to bind only to OpenVPN's virtual adapter. The other instance - to bind to all except OpenVPN's virtual adapter. Secured domains must be mapped to application instance that bind only to VPN adapter. Then you must configure firewall to accept connection from clients to OpenVPN only to one external IP (even if both external IPs are on the same adapter). OpenVPN also must be configured to bind only to that IP. Every user, that needs to have access to secured applications and domains, must use their OpenVPN client to connect to IP that is bind to OpenVPN server. And to access, after connecting virtual tunnel, the applications and domains, they must use OpenVPN's virtual adapter IP (which you will configure).

Something like that. But you can use RDP (or SSH, or Terminal) instead of VPN, to let users access privat part of the system, because this protocols are also encrypted. For this, you'll have to configure secured instances of the application to bind to loopback interface (127.0.0.1).

Hope this will be of any help. But you must consider simply using application security access and some firewall.

hydrostarr

Mimiko wrotehydrostarr, you must understand that VPN (OpenVPN or other implemmentation) does not make firewalling and application access security. It's only meant to securelly connect two (or more) systems/clients/lans. It does not have other possibilities coded in it.

Understood. We do believe at this time this meets our objectives. Disclaimer: maybe we'll change our minds once we learn more.

Althougth its possible to achive your goal using OpenVPN, but its mantenance will be much complex than per application security.

Thx for feedback, quite valuable. Alas, we're not yet sold that this is the case. Is it ok if we at least try the openvpn-based config first before concluding the above assessment? We've done app-level security in the past for a public-internet-facing system, and it's a nightmare. Ongoing security patch management (even on a Debian/Ubuntu system) for 5+ web apps, especially with our own custom modifications to said web apps, not to mention email, jabber, conferencing, voip, etc... it's a mess. Would rather secure one app/mechanism (openvpn) than many. So... for the private-collaboration purposes we're at least investigating the vpn route. (Hope everyone understands there's no disrespect intended here at all. Just trying to learn more by attempting the configurations.)

Further, we're also familiar with firewalling, and while masters at that, can address/employ firewall mechanisms as needed.

But I can give you a simple implementation to achive the minimum needed.

Thanks, very much appreciated.

For this you will have to use OpenVPN (or may be not) with a firewalling program. There are two different implementation with VPN or with RDP.

We're not familiar with "RDP" as it relates to VPN. Only with Windows-based, remote desktop protocol. Don't see how RDP relates to VPN; judging by your text, seems like the RDP usage might be akin to a secure ssh tunnel or some such; we are familiar with "ssh tunneling," but that's not what we seek. In any case, we'll just assume VPN for now, thx. (fwiw, we're installing on a Ubuntu 11.x server.)

We'll digest the rest of your notes Mimiko and followup on this thread with any questions as needed. Thx much!

Mimiko

Yes, RDP is window's remote desktop protocol. 😛