Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

We have number of CentOS/RHEL5 servers in datacenter, which are secured with border firewall (basically, only http/https and ssh are allowed). Sometimes me (as systems administrator) & selected developers are required to connect to some local services.

Currently we are doing this by ssh proxying or by mapping some external ip:ports to internal one (to protocols which are supports encryption). But it's not always convenient to use ssh and I'd like to remove all custom firewall rules (for security reasons). So I need to use some vpn solution. OpenVPN seems to be fine and I think I'll stick with it. But I'm wondering if there are some (may be better?) alternatives. Requirements are:

  • Allow simulations connections for 2-5 users.
  • Users should have separate accounts (username/password and/or cert)
  • Total number of users: I believe not more than 10
  • It should work perfectly under Windows XP/Vista/7 and any Linux
  • Server should work perfectly on one of our CentOS servers
  • I need to have ability to remove user account/invalidate cert
  • It should be opensource or at least free
  • (optional) user should have ability to re-issue cert and/or change password without my attention.
share|improve this question

4 Answers

up vote 1 down vote accepted

best way for your is solution with radius server with some web-interface for cert generation, password recovery, password change, add/delete users. and OvenVPN server can use external radius server verification.

share|improve this answer
Sounds very good, it seems is's also possible with LDAP, and I'm more familar with ldap. If there any strong reasons to use radius, but not ldap? (Probably, I'll also use it for some other services authentication). – rvs Apr 5 '11 at 10:36
@rvs we vere making security solution with RSA server that was based on Radius server. And OpenVPN can act with LDAP code.google.com/p/openvpn-auth-ldap or you can search other lib. but its possible – MealstroM Apr 5 '11 at 10:56
up vote 2 down vote

OpenVPN is a very flexible VPN solution that has sufficed our needs very well. I'd say go with it.

share|improve this answer
up vote 2 down vote

openvpn works great for this situation. You just generate a cert for each user (with the provided shell scripts). You can either do pem certs that don't need a passwd to connect, or require a passwd).

if it is just 10 people, then a radius server is way overblown.

Any modern machine would suffice.

EDIT: not 100% sure how they could change their passwd on their own.

share|improve this answer
...or both a domain password and a cert, if needed. – Sirex Apr 5 '11 at 11:14
up vote 0 down vote

mapping some external ip:ports to internal one

This is not a good idea - you shouldn't be making ad-hoc changes to your firewall - it's too easy to make a mistake.

But it's not always convenient to use ssh

Why not?

Certainly a certificate based solution is (IMHO) a lot easier to imlpement a distributed management framework than ssh (there is a patch to use ssl certs with openssh).

It should work perfectly under Windows XP/Vista/7

That makes it a lot more difficult.

Just how many services are we talking about here? If it were me I'd probably just go for stunnel wrapping on the services you want to make available with your own CA and client certificate verification.

share|improve this answer
Why not ssh? Because not all developers know it, because it's too many toonels when I need to connect to number of different hosts/ports. – rvs Apr 5 '11 at 10:26
It's 5 servers currently with quite high number of different services running on them. – rvs Apr 5 '11 at 10:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.