up vote 1 down vote favorite
share [g+] share [fb]

I've set up a VPS that handles mail, files, jabber, etc. All these services are available only to the local network that OpenVPN creates. For example all of the services will only listen on the 10.55.66.xx subnet and ignore connections from public IPs.

If the communication between my clients and the server is already encrypted, does it make sense to add another layer on top of that? For example forcing http to https, requiring SSL for jabber, POP3/IMAP, etc.? It seems redundant to me, but I'd like to know if there are any considerations that I'm not aware of.

link|improve this question
feedback

2 Answers

up vote 1 down vote

Securing the services even when they can be accessed only locally can be a good idea especially if don't/can't trust all your internal users. Of course, this depends on your network size, whether your users are all trusted, the sensitivity of your exchanged data, etc...

link|improve this answer
not sure I understand this, can you please elaborate? from what I understand, the point of using e.g. https is so no one in the middle can intercept any meaningful traffic. since the communication is already encrypted, what does adding another encryption layer add to security? as to potential malicious users, if I disable client-to-client in openvpn, they can't see each other, right? – sostacked Jan 22 at 21:16
The point I am talking about is the ability of each user to see the traffic of other users. If it does not matter or impossible, you should be OK without adding more security of SSL. – Khaled Jan 23 at 8:12
feedback
up vote 1 down vote

If you've set up OpenVPN so that the clients can't see each other (i.e., you haven't turned on "client-to-client"), it's probably redundant. Even if you've turned it on, it's likely redundant anyway, as I don't think they can sniff each other's traffic.

On the other hand, I think it's just good practice to turn on SSL for the other services, since it's not that onerous to do. If, sometime in the future, you need to open up access to non-VPN clients, you won't have scramble to figure out how to do it, and you've hopefully found any pitfalls for your SSL setup between now and that hypothetical future.

link|improve this answer
thanks for the answer. can you estimate if there would be a transfer speed penalty for that? ping over VPN is about 300 ms avg as is, would adding another layer increase that significantly? – sostacked Jan 22 at 21:20
Hmm, the latency is pretty high already. Adding SSL to those services probably doesn't significantly change that. In terms of throughput, I think you'll be adding another 15% penalty on top of the 15-25% (or so) penalty from OpenVPN. It'll probably depend on your users performance expectations. Your setup probably has some performance issues already compared to a LAN, so additional penalties from the SSL layer may not be noticed. You'll need to test this to see how it works for you. – cjc Jan 22 at 21:25
Thinking about the types of traffic you've mentioned: xmpp won't matter too much in terms of performance overhead from SSL. Probably the same for email. Users aren't going to notice an extra 50ms in connection time, and throughput isn't going to be an issue unless you're sending large attachments. HTTPS, maybe, depends on what you're serving, etc. – cjc Jan 22 at 21:39
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.