I have configured a working openvpn server (ubuntu 10.04) and client, no problems.
I generated certificates and key files and such like for a client machine.
We deploy a number of these generic client machines for data capture, anywhere between 10 and 20 a month. The reason for the VPN is to allow us to remote login for occasional support and monitoring. They send their data home via other means (not the VPN)
I am considering making the client config files generic and using them on all deployed machines (the "duplicate-cn" option on the server side).
My reasoning is this:
- The vpn server explicitly disallows ssh login from anywhere except our office, so a connected client cannot ssh into the server
- In addition, login to the openvpn server requires the X509 .pem keyfile (it's an Amazon EC2 instance)
- The server does not allow clients to see each other ("client-to-client" is commented out), and there is no access to any other networks, it's purely so we can ssh in to the client.
- We are lazy, and don't want to admin generating the certs, applying them to the machine (hence no longer generic and no longer hot swappable etc) and people will get confused and get this wrong.
The main drawback seems to be:
- It's difficult to tell which machine is which where there are many connections (I haven't found a solution for this yet)
The client machines are installed on "untrusted" sites, that is, I cannot guarantee their phyiscal security.
So my question is... what is the worst that could happen in this scenario? If a machine got compromised directly, the worst it could do is open a VPN tunnel (which it does automatically anyway!) but then could not really get anywhere beyond that. We could just block that IP at the firewall level once detected.
Is my thought process correct here or have I missed anything?
I maybe should have said that the client machines are headless (no video/keyboard) and not accessed directly by the client sites (although you cannot outright guarantee that!). This is a machine-2-machine (M2M) environment. These are not (eg) laptops carried by sales folks.