Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

Say I have an internal server that I am using for source control. If I only access that server through a VPN connection, do I still need to have SSL setup on the source control server to ensure that no one can eavesdrop on my communication with it?

share|improve this question

marked as duplicate by Celeritas, Deer Hunter, Xander, Ohnana, Bob Brown Feb 8 at 0:10

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

I think you mean HTTPS? There are VPN technologies using SSL. – Terry Chia Mar 21 '13 at 17:04
You are correct. Sorry, I don't know a lot about this subject. – Abe Miessler Mar 21 '13 at 17:17
up vote 7 down vote accepted

VPN is a Virtual Private Network: it isolates a group of machines from the rest of the world, so that these machines can talk to each other undisturbed by outsiders. If the isolation is reasonably thorough (it uses encryption, and it uses it properly), then communications between any two machines in the VPN will be protected from eavesdropping and alteration from machines which are not in the VPN.

But the VPN will not do anything against attackers who are already inside the VPN. Your desktop system is in the VPN; so is the server you are talking to. But there may be other machines as well. In fact, it is typical, in enterprise contexts, that all remote employees join the VPN, which will therefore contain many people as well as a bunch of corporate servers, and other systems of questionable security (e.g. printers).

Another point is that the VPN is between machines. In the "mainframe model", a given machine may run process from distinct users, with distinct rights. With SSL, the security is from one specific process on the client machine, to one specific process on the server. Even if the VPN uses authentication, it would be inconvenient for the client to get some accurate information on the identity of the server, and vice versa, because the VPN authentication is not made available to the individual process on the involved machines.

Therefore, in the presence of a VPN, SSL is redundant only if all the following characteristics are met:

  • the VPN provides confidentiality and integrity as well as SSL would (i.e. with correctly used cryptography);
  • all machines which may connect to the VPN are trusted;
  • authentication can be delegated to the VPN layer.

If unsure, use SSL and consider the network as hostile. This is the safe way.

share|improve this answer

This depends on a) if the VPN in use provides encryption and b) if the VPN end point is the server. If you are VPNing to an office network for example, then your traffic would still be unencrypted from the VPN exit node (provided that the VPN provides encryption) until it gets to the server. Using SSL will ensure that your traffic is encrypted all the way to the server (unless you are using SSL to a firewall).

share|improve this answer

VPN doesn't necessarily imply that the traffic going across the tunnel is encrypted so first I would ask what type of VPN you are using to ensure it is encrypted.

Assuming you are using a VPN that is encrypting the traffic, the communication would still be moving in clear text between the host where the VPN terminates and the source control server I tend toward a "assume your internal network is compromised" stance and thus would suggest using SSL even on a "private" or "internal" network.

share|improve this answer
Hrrm, I'm not really sure how to check the type of VPN I am using. I am connecting from an OS X machine if that makes any difference. – Abe Miessler Mar 21 '13 at 16:45
do you know what you are connecting to on the other end? – PacketWrangler Mar 21 '13 at 18:44
It's a windows server. – Abe Miessler Mar 21 '13 at 18:46
If it was configured correctly, then it most likely is encrypting traffic between your machine and the VPN endpoint. Though as I said, it is probably still a good idea to use HTTPS to access your source control server. – PacketWrangler Mar 21 '13 at 19:37

If the VPN server is the same machine as the source control server, and you are using a decent VPN technology such as IPSec, then no, there is no benefit in adding SSL in terms of people eavesdropping - you already have end to end encryption with message authentication. The only worry here is anyone else on the VPN can view and edit the traffic in plaintext.

If however, the VPN and end-point are not the same machine, then yes, you need to add SSL. This is because any VPN encryption terminates at the VPN server, and the VPN server then acts as a dynamic NAT gateway, essentially dialing out to the endpoint server on your behalf. From then on, the connection is in plaintext unless some other encryption layer is present, such as SSL.

Essentially, always add SSL, even when you don't think you need it. It might upset your firewall operators though...they like to be able to inspect traffic.

share|improve this answer

Yes, you need to use SSL to encrypt sensitive information. VPN establishes you encrypted tunnel between your end point on internet and end point of VPN server of that organisation. However, once you have joined VPN any non-https links you browse are transmitting clear-text data. This is vulnerable to internal attackers, and moreover, anyone in the position where he/she can intercept traffic (sitting in same network segment or man-in-the-middle scenario) can easily retrieve data by capturing network traffic between the client (your system) and the server. However, probability is less but yes possible from an internal attacker's perspective.

Excuse my english but I hope you got my point which is there is a difference between using VPN (encrypted traffic between your ISP and your organisation) and SSL (encrypted traffic between the client and the web server).

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.