Should a VPN user be allowed to bypass a SSH jump host?

Question

I am setting up a computer network for software engineers. I currently have all SSH connections run through a jump / bastion host, with access to production servers requiring SSH agent forwarding.

For the purpose of accessing internally-facing, potentially-unsecured HTTP services (such as an admin dashboard or IPython notebook), the user must port forward the production server's port to localhost.

I am interested in provisioning an OpenVPN server for the users, allowing them to access internal services without port forwarding. However, access to these services (like an IPython notebook) is equivalent to SSH / shell access.

If I implement OpenVPN alongside my existing OpenSSH setup, end users would have two methods to gain remote shell access--the SSH key and the OpenVPN TLS key. I am afraid this complicates authentication for my users, increases the attack surface of the network, and increases the difficulty of access auditing and intrusion detection.

Based on this, is it a good idea to deploy OpenVPN at all? If so, what are some ways that I can simplify key management for my users? (Can my users use the same RSA key for OpenVPN TLS and SSH?) How can I collate logging on the server to provide an identical auditing experience for VPN and SSH access?

Answer 1

It will not make a single complication! Use the next things in your server:

• OpenLDAP - it will hold the user info
• goSA - a fine web interface to utilize all the operations you need administering users and groups in LDAP
• pam-ldap - a very handy authenticator for PAM standard/interface/library

So! for your OpenSSH use PAM auth method and use pam-ldap to authenticate using LDAP. For your OpenVPN use similar setup, some out-of-the-box solutions do exist too, like this one

And no confusion should ever exist in such a setup: everything is quite clear and well-organized in single point of storage/auth in LDAP. If you will need to use a ppptp access like mpd - no problem, it integrates well in this setup too(I did it myself): just use a freeradius as a backend form mpd and point the freeradius to LDAP too.

Answer 2

If I implement OpenVPN alongside my existing OpenSSH setup, end users would have two methods to gain remote shell access--the SSH key and the OpenVPN TLS key. I am afraid this complicates authentication for my users, increases the attack surface of the network, and increases the difficulty of access auditing and intrusion detection.

The answer to all of this is yes. Obviously opening up another method of access to a network is going to increase the attack surface. The real question is if the benefits are enough to justify the added risk. You ask if the VPN server is really a good idea, but alternatively, if you have a VPN server, do you really need to keep the SSH server available? As mentioned in one of the comments, the VPN is a more robust and secure method to provide access to the network-but requires more setup and maintenance. Keeping things simple, or familiar, for your users is always a nicety to consider, but security should generally overrule convenience.

It sounds like you are dealing with developers who should be competent enough to understand there is generally some give and take between security and convenience, so you need to figure out where that balance lies for your client's specific needs. The questions about reusing keys and collating audits all depend on the needs of the client, the security policy in place, the level of protection desired for the information, current network architecture and implementation, etc... Re-using a key between two disparate systems is not going to provide the highest level of security, and it comes with more risk. But depending on the level of protection you need, it might provide ENOUGH security for your implementation, without the more complex and costly setup of a true Single Sign-On system.