I am setting up a computer network for software engineers. I currently have all SSH connections run through a jump / bastion host, with access to production servers requiring SSH agent forwarding.
For the purpose of accessing internally-facing, potentially-unsecured HTTP services (such as an admin dashboard or IPython notebook), the user must port forward the production server's port to localhost.
I am interested in provisioning an OpenVPN server for the users, allowing them to access internal services without port forwarding. However, access to these services (like an IPython notebook) is equivalent to SSH / shell access.
If I implement OpenVPN alongside my existing OpenSSH setup, end users would have two methods to gain remote shell access--the SSH key and the OpenVPN TLS key. I am afraid this complicates authentication for my users, increases the attack surface of the network, and increases the difficulty of access auditing and intrusion detection.
Based on this, is it a good idea to deploy OpenVPN at all? If so, what are some ways that I can simplify key management for my users? (Can my users use the same RSA key for OpenVPN TLS and SSH?) How can I collate logging on the server to provide an identical auditing experience for VPN and SSH access?