Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I know to run the Openvpn service you have to be logged in as root to start it but what about the creation of keys? So far it seems you can do it without root privileges but I'm wondering if this will come to haunt me somewhere further down the setup line.

share|improve this question
add comment

2 Answers

up vote 5 down vote accepted

No you are not. Regular user can create the keys, but you have to be root to alter the configuration to use OpenVPN with the specified keys, and to control the service itself.

share|improve this answer
add comment

Once the server is set up to accept any key signed by a particular CA (certificate authority), it will do exactly that, regardless of where the keys are generated or who by.

You don't even have to have the CA on the same computer as the openvpn installation. The only thing that is really important is to restrict access to the CA's files; if someone can get the private key then they too can generate keys that will let them in.

You should also look at revocation: it is done at the CA, but the openvpn server needs to be updated with a copy of the file whenever a certificate is revoked.

If you ever believe the CA is compromised, to guarantee security you have to stop using that CA and reissue all keys with a new CA private key.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.