Best practices in storing OpenVPN keys / passwords?

torontob

Hi everyone,

I have over 20 OpenVPN instances running and it's all very confidential stuff on the servers and routers....but at the same time I need a way to be able to reach these devices from anywhere in the world and maybe from any laptop or PC. Right now, I carry my laptop all around and if this thing burns or breaks, I am toasted. TOASTED!

So, I want to know what is it that you guys do when you over 10 different keys to keep them organized? also where do you store them? Do you keep them in you Google Apps account? Do you keep them on a USB key?

What is the best practice in storing keys and keeping them accessible when needed?

Thanks

janjust

if you manage all instances then in theory you can use a single certificate to connect - as long as each server accepts your certificate then you can connect to any VPN.

If these networks are so confidential then store your client certificate on a hardware token; you can then use the OpenVPN pkcs11 interface (which was missing in 2.2.0 but should be back in 2.2.1) to access the client cert.

torontob

Thanks for the feedback.

I thought using a single certificate might be a security risk. I was thinking of connecting all clients to a single server and then connect to that server to in turn connect to the clients....I guess that's still the same as your suggestions.

Can you please elaborate on hardware token? never used it.

Thanks

janjust

hardware tokens or Hardware Security Modules are devices on which you can store a private key in a safe manner: it is not possible to extract the private key from it. There are many solutions out there, an open source package is OpenSC: http://www.opensc-project.org