VPN for security

Question

I have a server which will hold some sensitive data. At the moment, access to the server is restricted via SSH and only to a single person. The server is however on the same network that many other computers are and has an IP from the same range (albeit protected by a firewall).

I have read that an added measure of security would be to connect to the server via a encrypted VPN and thus not have the server on the same network as other computers. Should we in the future want to expand the security, we could add token authentications.

Could anybody please tell me if the above is feasible and if it makes sense to set up? I cannot put my head around how the VPN would work short of getting an VPN router and connect via that.

Any feedback and pointers would be helpful.

Answer 1

I agree with the first answer (if I could comment, I would, but I can't, so I'm posting an answer). A VPN is most likely not the most appropriate technology for your situation. Only allowing SSH from a set of known hosts is a better bet. To go one step beyond that, I'd configure the SSH server to disallow password auth, and force the use of ssh keys. This adds one more thing to the list of stuff a potential attacker needs.

Just using SSH and firewall rules an attacker would need:

1. A host with an allowed IP
2. A valid password

If you tell the SSH server to only allow key based logins, an attacker would need:

1. A host with an allowed IP
2. Your ssh key
3. The password to the ssh key

It just adds another hurdle to jump to break into your box. Plus, it completely eliminates the standard dictionary attacks against an ssh port. Without a good key, no amount of password guessing will work.

Answer 2

Although VPNs are great you'll still have to have an IP address on the same network it's already on, it would just be restricted to handling the VPN connection traffic.

If you switch off all other sharing and ports other than SSH then it'll be about as secure as you can reasonably get without a lot more effort.

Answer 3

Working through some similar issues I'd like to give my input.

Depending on the reasons for your security concerns you may one day be looking for a level of security based on a standard such at the Payment Card Industry (PCI). To meet these requirements and provide the most secure means of access and restriction I would recommend the following:

Move the secure machine to a separate sub-net separated with a proper router capable of access control lists (ACLs). Use ACLs to lock down the IP addresses and ports you wish to have access to the machine in addition to a stateful inspection firewall (IPTables is more than capable). Ensure there is no direct path to the secure network from untrusted networks (i.e. the internet).

For an extra level, you certainly can permit connections to the machine on a VPN connection port only(such us UDP 1194 for OpenVPN), though if your connectivity to the machine is only via SSH, an additional SSH VPN Tunnel may be considered redundant.