Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm working on a software appliance based on linux platform. I want to have a secured way of reaching every installed appliance over the Internet for remote debugging and support. In order to traverse NAT and to be able to simply connect to the appliance I was thinking about OpenVPN as a solution. Problem is that I can't ship a single certificate with the appliance image and have all everyone connected with it since openvpn will not allow more than one session per certificate.

Another issue is isolation between the VPN clients so that one client won't be able to connect to the other. how can that be achieved. Thanks

share|improve this question

3 Answers 3

up vote 0 down vote accepted

You can generate the OpenVPN client certs on building the image if the server is configured with --duplicate-cn. Then you have networking to the appliances and can get a new certificate signed with a real ca or whatever you want to do... it's probably not a great idea to keep running with a defaulted certificate on every appliance.

The Miredo idea is orthogonal... that may very likely help you get connected in the first place, since Miredo can get through many NATs that OpenVPN can't.

share|improve this answer

try Miredo to give every appliance a globaly routable IPv6 number. Add a dynamic DNS, or your own registration database, and you're good to go.

but on second thought, it might be easier to just generate the client certificates for OpenVPN on first run.

share|improve this answer
    
And then what? that certificate has to get to the openvpn server automatically. how ? –  ApriOri Dec 30 '09 at 17:39

Are you certain you really want the appliance to open up for you unconditionally? Shouldn't that be some easily accessible function during first boot? When the user/customer wants to have the support channel, the certificate could be emailed, encrypted with your public key (so only your secret key can decrypt and save it to the vpn server).

At your end it should be easy to match these emails and process them automatically.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.