1

I know to run the Openvpn service you have to be logged in as root to start it but what about the creation of keys? So far it seems you can do it without root privileges but I'm wondering if this will come to haunt me somewhere further down the setup line.

2 Answers 2

5

No you are not. Regular user can create the keys, but you have to be root to alter the configuration to use OpenVPN with the specified keys, and to control the service itself.

3

Once the server is set up to accept any key signed by a particular CA (certificate authority), it will do exactly that, regardless of where the keys are generated or who by.

You don't even have to have the CA on the same computer as the openvpn installation. The only thing that is really important is to restrict access to the CA's files; if someone can get the private key then they too can generate keys that will let them in.

You should also look at revocation: it is done at the CA, but the openvpn server needs to be updated with a copy of the file whenever a certificate is revoked.

If you ever believe the CA is compromised, to guarantee security you have to stop using that CA and reissue all keys with a new CA private key.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .