1

I'm a newbie in OpenVPN and the related questions, I'm googling for several days without positive answer.

I have several linux-based devices located in my town that collects data and sends it for me. I also need to be able to execute some commands on them. I've decided to connect all of them into one virtual private network over the Internet. I've chosen to use OpenVPN to do it. I have no problems with building OpenVPN.

After some work, I've successfully connected all devices into network. All devices use PKI to validate/authenticate themselves. The problem: Devices doesn't have real-time clock, so after turning off the power, we have incorrect time on device and they can't connect to my VPN server.

I found that time synchronization is required for PKI authentication.

In this mailing list users suggest to use static keys. Ok, I found an article on how to make this, but as I see there is one disadvantage: Limited scalability -- one client, one server. As I understand I can't use one vpn server for multiple devices.

Can anyone tell me how to solve the problem? Maybe there is some other authentication solution for OpenVPN which is independent from time synchronization?

P.S. I can't change time setting on that devices.

P.P.S. Thanks in advance and sorry for my terrible English.

1

Use ntpdate to synchronize time and then start OpenVPN.

Alternative:

Try using tinc: https://www.tinc-vpn.org/

  • It gives solution but in form of a question. Use ntpdate then start OpenVPN – Dariusz Bączkowski May 8 '16 at 2:05
  • Thanks for an answer, but as I told at the end of the question, I can't change time settings on the device. Maybe there is another solutions? I found something that named PAM. I don't understand what is this, but looks like, this thing gives another way to make authentication. – ArhiChief May 9 '16 at 18:52
  • They do not have any time or they lose time on reset only and you can set it manually after boot? If you can set it ntpdate should too. – Dariusz Bączkowski May 9 '16 at 18:58
  • Yes, the lose time on reset. And I can't use any software that will correct time settings on device. I need solution what will be independent from time checks. – ArhiChief May 9 '16 at 20:19
  • 1
    Thank! This is what I was looking for. Lightweight and easy to configure. – ArhiChief May 16 '16 at 13:44
0

There's a solution:

(...), it basically removes an important security feature.

In this case, I would probably rather recommend to issue a CA
and/or server certificate with "Valid From" with a date which is the
initial boot time of the embedded device. This should solve this issue, 
and contain the issue within your environment.

https://community.openvpn.net/openvpn/ticket/199

  • Hmm... Interesting suggestion. I'll try to implement it on my systems. – ArhiChief May 10 '16 at 7:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.