-2

I need to ask a question.

  1. there are multiple users of server, all connecting via vpn.
  2. each using openvpn-cert based connection (linux)

I'd like to find a way to limit vpn connection to "trusted" devices only, added to the server and prevent to log in from the other devices. The point is to have a better control of logging.

Improve this question

1 Answer 1

Reset to default
2

f you are using OpenVPN I think you can use the ccd-exclusive directive

--ccd-exclusive Require, as a condition of authentication, that a connecting client has a --client-config-dir file.

You will need to configure the client-config-dir directive and then create a file in that directory named after the client's X509 common name

For example if you have a client with an X509 common name of my_client and you configure

ccd-exclusive
client-config-dir /etc/openvpn.ccd

Then the file /etc/openvpn/ccd/my_client has to exist (it can be blank) for the client to be allowed to connect.

Improve this answer
2
  • How about an access to the remote resources (eg. vcenter)?
    – sebthesaviour
    Oct 6, 2017 at 9:39
  • There's no problem to restrict remote share. I want to prevent in case of any installation of vpn on the other than "company" device. If someone will use any other than authorized device - the connection will not happen - that's the case :) I suppose that will need an external service like eg. Barracuda, Fortigate etc.
    – sebthesaviour
    Oct 10, 2017 at 13:06

Not the answer you're looking for? Browse other questions tagged .