1

What security implications should I know about/look for when running OpenVPN on the same server as my network cloud controller and apt-cache-ng?

I plan on using the same server to run apt-cacher-ng to cache updates for other Linux servers on the network. It will also run my cloud network controller (manages my switches, WAPs, etc).

Since OpenVPN requires opening up a port-forward on the router to the server, does this pose a bigger threat or am I over-thinking things?

I do not want to put apt-cacher on another system. The other possibility is virtualization but I'm not familiar with KVM or other Linux virtualization software. I don't run MS, so Hyper-V is out. And ESXi 6/6U1 gives me disk errors on Debian 8 due to the newer kernel not supporting WRITE SAME.

Improve this question

2 Answers 2

Reset to default
1

One issue is that if there are any services which are only accessible from the server's IP, including services accessible from the LAN (like your router's admin page) or even other services running locally on the server which are only accessible to localhost, then a user successfully logged into the VPN may be able to access them.

If you have any services like this (like your router's admin page) that you don't want VPN users to be able to access, then make sure they're securely protected by passwords and don't just rely on the inability of outsiders to connect to them.

Improve this answer
0

So we assume you only forward exactly one port to the server. We assume you router-firewall is reliable, and it will not be able to attack the server or your network from the router. Then IMHO the only risk is that someone could somehow break your VPN auth or use an OpenVPN exploit and enter as a valid user into your network. But from this moment on the issue is not limited to the VPN server only but to all components of the network that can be reached from the VPN server as well.

In my network admin times I installed many "old" Windows-VPNs with PPTP daemons etc (it was state of the art until some time ago, sinc eit was very easy to setup). With low security come more danger, but I would consider OpenVPN being quite hard to break when set up correctly. If you use certificate-based auth its more a matter on how to revoke a certificate quikcly if it got compromised (laptop lost etc). Too bad I dont know if a 2-factor-auth is possible with it.

BR Florian

Improve this answer
1
  • Yes, the only port(s) forwarded are for OpenVPN (both UDP/TCP). I run what I would call an entry-level enterprise grade router at home as well. All my linux server systems have solid firewall rules applied as well. As for certificates, I would be the only one having access to it and would have no way of revoking it if my device was stolen while I was away. I guess I can setup a script where if I send an email with some secret 'delete certificate' in the subject line it would delete the certificate.
    – user2077362
    Commented Nov 19, 2015 at 16:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .