My openvpn clients connects to server with .ovpn+ca.crt files only
Matthew Martinez 
I ask you if my clients connect to openvpn server through two files only: client.ovpn and ca.crt, Is this connection secure? Any security problems in this mechanism there? Is the connection encrypted?
Knowing that:
- Clients can connect without any problems or warnings,
- Openvpn client should connect to server though these four files: client.crt client.key ca.crt client.ovpn ,
- client.ovpn as shown:
client dev tun0 proto tcp remote IP PORT resolv-retry infinite nobind persist-key persist-tun ca ca.crt # cert client.crt # key client.key remote-cert-tls server ;tls-auth ta.key 1 cipher AES-128-CBC comp-lzo verb 3 auth-user-pass pass
Server configuration:
port port
proto tcp
dev tun0
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server P.P.P.P 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 8.8.4.4" push "dhcp-option DNS 8.8.8.8"
cipher AES-128-CBC
comp-lzo
persist-key persist-tun
status openvpn-status.log verb 3
client-cert-not-required
plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so login 1 Answer
In the server configuration you have the following lines:
client-cert-not-required
plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so login client-cert-not-required has the following description from man openvpn:
Don't require client certificate, client will authenticate usingu sername/password only. Be aware that using this directive is less secure than requiring certificates from all clients.
The plugin requires authentication against PAM.
The data is encrypted when it transits the VPN. This is shown by the line cipher AES-128-CBC, which specifies which encryption to use. AES is generally regarded as secure.
If you consider this secure enough depends on what you are attempting to protect, and the quality of the passwords. There's no one-stop answer to this; you have to define the threats you find applicable, and what security is acceptable.
Maintaining a CA and distributing certificates may be more work than distributing passwords. This depends on your setup. It also makes it more difficult to setup VPN on a new computer, as you securely have to bring the relatively long key to that computer. The decreased security of password authentication may be a worthwhile trade off in this aspect.
TL;DR: It depends.
4
