I'm in charge of setting up a "walled network" set of servers for a group of employees, but I have no clue where to start. Posted below are the initial requirements, my line of thoughts, and my questions.
1. Any software needs to be Open Source.
2. The users aren't tech savvy and they will be connecting via their own computers we can assume they have admin access to those computers so they can install/run software if needed.
3. They can connect to this walled network from anywhere on the net.
4. we wont be providing a tunnel that handles everything just traffic to/from the servers.
5. This connection should be secure. (SSH maybe? Just an Idea)
6. The employees use Windows, Linux, and MacOSX.
7. Each user needs a UserName/Password
8. A log of the time each user spent logged in needs to be somewhere.
My line of Thought:
I initially wanted to use openVPN but as far as I understand it pipes EVERYTHING through the VPN network and has problems connecting to all 3 PC platforms, which wont work per the requirement posted above.
1. Is my understanding of vpn specifically openVPN correct?
2. Are there any web based solutions so the employees don't have to install a vpn client on their computers. Maybe I could have a web login that adds the users IP to a firewall white list and then remove it after some time of inactivity (Just an Idea)?
3. Am I completely missing something or a way this can be done better?
4. Any ideas, thoughts, resources, websites links, etc would be helpful.
TL;DR I need a way to authenticate users for an arbitrary set of servers on different PC platforms.
Thank you for your time.
Edit: Thanks for the help everyone, but I think I just need to take the leap, try to set up a debian box with the necessary software and then ask questions regarding problems when I run into them. I'm over thinking everything and thats taking up a large amount of time. so my plan of action is as follows
- Setup a Debian server.
- Install the required server software the company needs.
- Install openVPN
I'm still confused with setting up the usernames/password accounts and logging time and users, but I'll solve that problem when I get to it.
Do you notice any problems or pitfalls with my current plan of action?