OpenVPN User Auth + Static key security?

limecat

I was just curious on the security of the User auth + Static key OpenVPN configuration. I am trying to set up a system that has OpenVPN authenticating against LDAP, and there doesnt seem to be an easy way to use per-user certs.

Is there a big security risk to doing this (other than the potential for a leaked static key)? The clients would be negotiating per-session encryption keys with the server, which should prevent them from being able to decrypt each other's traffic, correct? How does it compare to Cisco VPN client Group auth + user auth (as that is the security bar I am aiming at)?

Thanks in advance.

janjust

if you're using static key encryption then clients can - in theory - decrypt each others traffic.
Normally you'd use something like

client-cert-not-required
plugin <LDAP plugin>

that way the clients do not need a client cert, but the session keys for each client ARE unique.