Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an OpenVPN server which authenticates to an Active Directory and asks therefore each user for a username and passphrase.

On top of that it also requires each user to have a client certificate and client key (+ server ca.crt).

Question

I would like that each user must login with their AD username and passphrase and that all clients shares the same client certificate and client key.

The reason I want a shared client certificate and key is for ease of management and it protects the network from someone brute forcing a password.

One way would be to just create one client like so

cd /etc/openvpn/easy-rsa/2.0/
. /etc/openvpn/easy-rsa/2.0/build-key client1

and give this to each user.

Is that the correct way under these conditions? Or should the client certificate and key be created in a special way?

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

You shouldn't do that, because once your single key is compromised for any reason (stolen laptop, trojan, employee leaving the company, etc.), you will need to give each user a new one, most likely resulting in more time spent than you saved initially by creating only one.

If you want to avoid the complexities of creating a CA and signing (and revoking) client certificates (although with the easy-rsa script it really isn't that hard), OpenVPN also supports static keys (generated with openvpn --genkey) that are very straightforward to handle (although they will also be used for encryption, instead of TLS).

share|improve this answer
1  
+1 for this. Note also that the client key is an important part of the security of the link. I suspect that if all clients have the same private key, then given the complete ciphertext of one client's session, any other client can decrypt it. –  MadHatter Sep 8 '11 at 14:05
    
@MadHatter : Only is symmetric key are used I assume? –  Sandra Sep 8 '11 at 16:57
1  
Sorry, what? The private key and certificate form an asymmetric keypair, the latter being signed by some other entity (hence, certificate). Usually, these are used to negotiate a "nonce" session key, which is a symmetric key, yes. Is that what you meant? –  MadHatter Sep 8 '11 at 17:02
    
@MadHatter : Sorry about the nonsense I wrote =) But yes, that was what I meant to say =) –  Sandra Sep 8 '11 at 18:12
add comment

First off, I agree with Ingmar Hupp, you don't want to be passing around one single key for a bunch of users. It's really not part of a good security strategy. Additionally, as he mentions, setting up a CA and signing/revoking keys using easy-rsa is quite easy, and IMO worth the additional "manpower" (if you will) to setup / maintain keys properly, instead of passing a single one around.

But anyway, the "technical" answer is to add

duplicate-cn

to your server.conf file.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.