Howto

In my previous article, I laid out a framework for building a modern, hardened OpenVPN server/client configuration. At the end, I noted there were some additional hardening steps that would be nice to take for extra security. In particular: Using an additional static TLS key in the initial TLS handshake to prevent denial-of-service attacks. Storing keys in hardware cryptographic devices to prevent exfiltration. Using multi-factor authentication with time-based one time passwords (TOTP, AKA Google Authenticator) Closing the small security hole created because OpenVPN doesn’t by default check that client certificates match client usernames. Instructing OpenVPN to apply additional exploit mitigation measures to itself after initialization. Like the previous article, this will be slightly complicated by the fact that many installations of OpenVPN don’t use the community edition server directly, but wrap it in some other interface or appliance. It will likely be impossible to apply the latter two hardening steps in that case, and may also be impossible to perform the first or third depending on what options are exposed. If you use a wrapper or appliance and the security benefits of these additional configuration steps seem like something you want and the appliance doesn’t offer the options to do so, check with the support team for the product and see if they’re applying them already or if they can expose the relevant options in their interface. ...

This post originally appeared on the ISE Blog. Since everyone is working from home for the foreseeable future, corporate IT departments are scrambling to bolster existing VPN solutions or deploy new ones as fast as possible. One of the most popular VPN solutions is OpenVPN, either used directly, or through appliances like the commercial OpenVPN Access Server or third-party VPN gateway products. Some third-party products are not quite upfront about being OpenVPN wrappers, so if you use an SSL VPN Gateway appliance, make sure to double-check the documentation to see if this guide applies to you. ...

I use a MacBook Pro for work, and naturally my job involves a good amount of VM usage. VMWare Fusion is supposed to have good integration with ESXi, allowing you to connect to servers, manage VMs remotely, and transfer them to/from them. I find that the remote management works pretty well, and downloading VMs works most of the time, but I couldn’t get uploading them to our ESXi 6.5 host to work; I would always get cryptic errors like Invalid configuration for device '0'. Even exporting the VM to an OVA file and importing it on the web interface wouldn’t work. One ticket with VMWare Support later and I finally have the correct import procedure: ...

Windows 10 ships with two awesome features for users and developers who still work in Linux land. The first is the Windows Subsystem for Linux, which implements a subset of the Linux Kernel’s system calls to allow you to run native Linux userland utilities such as bash and friends, and ssh. Windows 10 also includes a native build of OpenSSH, which means you don’t even need to use WSL to SSH into your other machines! Unfortunately, neither option has any ssh-agent running by default, so if you have passphrase protected keys (which you should!), then you’ll need to enter the passphrase every time you want to use them. Let’s fix that! ...

I’ve started experimenting with exposing some of my home lab services to the world without needing a VPN. Instead, I use Caddy (which is an excellent web server, and much easier to work with than Nginx) as a reverse proxy with TLS client certificates for authentication. Caddy’s built-in Let’s Encrypt functionality provides the server certificate, and my internal PKI provides the client certificates. I still want to have 2-factor authentication, though — a certificate is merely “something you have”, and I want to require “something you know,” too. Since all my PCs are recent enough to feature a TPM, I decided to store the keys on said TPM and configure it to require a password before allowing any authentication to take place. I was inspired by Microsoft Hello for Business — which is really cool and I can’t wait to work with it some day — but using the TPM directly is much lighter weight as no domain controller or Windows AD Domain is needed. The previous iteration of Microsoft’s “Passwordless Future,” TPM-backed virtual smart cards would be exactly what I want, except the docs come with a big ol’ deprecation warning. Instead, I found how to interact with the base TPM crypto provider to generate certificates. ...