How can I rotate the server's password?

cjs226

I'm being asked to rotate the server's password that is used in conjunction with certificates (not to be confused with a challenge password for the client certificate). Can I do this by using <ssh-keygen -p -N new_passphrase ...> on the server's certificate?

janjust

the server certificate password can be rotated using

openssl rsa -in server.key -aes256 -out newserver.key

this will create a new version of the server key ; don't specify the same filename twice (e.g. 'out server.key') as there is a good chance that you will destroy the original first.

cjs226

Thanks for responding but it appears there were some misunderstandings regarding how our server was built. I was told it used a master password of sort and it needed to be rotated. However, it appears the password that was prompted for was simply the password used when user's certs were created.

Is it possible to configure OpenVPN to use certs as well as a site-wide password that can easily be rotated? We like having users submit their own CSR which is then signed by the CA on the server. However, we also want to rotate a password in case a cert is "obtained" by a black hat...but would rather not have an account/password for each and every user.

janjust

the site-wide password would need to be configured on each client - if you rotate the password you would have to update all clients.
you might be better off protecting the client-side keys with a passphrase, or, if you're really paranoid, opt for a 2 factor solution (e.g. hardware tokens).

cjs226

janjust wrotethe site-wide password would need to be configured on each client - if you rotate the password you would have to update all clients.

This is what we're wanting - one password that can be rotated on the server forcing all users to update the password in their client. Is this possible?

janjust

sure - username+password authentication in openvpn is quite flexible: on the client side the option

auth-user-pass

can be used to force the client to enter a username and password. Depending on the GUI used the user will have to enter both username and password every time. Some GUIs allow you to save the username+password in a file, but this is not considered secure.

On the server side you'd use a script ('auth-user-pass-verify') or a plugin (e.g. the PAM auth plugin) to validate the username and password entered; simply change the password on the server side and all clients will have to use the new password.

cjs226

Thanks for your help. As is normal for me, I was over thinking it.

I made/enabled the openvpn-auth-pam.so plugin and a lone user on the server. Users enabled auth-user-pass within their client and enter the user/pass when initiating a connection. I'll rotate the password once a quarter and the pointy hair types will go back to their spreadsheets.