We have an AWS network which can only be accessed once connected to a VPN. .opvn.

Currently, in order to connect to the VPN, our IP needs to be whitelisted from within aws which can only be done by a small group of people. This can be bothersome for remote workers who then cannot access the VPN should this group of people be offline.

I proposed we add username/password / 2-factor authentication to the VPN configuration and do away with IP whitelist approach, however, there is some pushback around security concerns.

My question is are these concerns valid? Would password-based authentication be enough seeing as it's enough to access the console which controls the whitelist?

  • VPN is already handshake using the PKI mechanism, i.e. VPN client can not establish the connection to the server without the server issued public key. IP whitelist is not required unless you are worry about DDoS attack. 2FA/TFA is not much of security concern. Because if the user system is totally compromised, IP whitelist will not help either. – mootmoot Apr 27 '18 at 12:38
  • 1
    How do you handle it when your remote workers don't have a static IP address? Sounds like a potential security hole to whitelist IP's that can be under the control of unknown individuals as an ISP changes who is assigned to that IP. – Joe W Jun 26 '18 at 17:01
  • This was a point that I raised. Currently it would require a team member to reach out to a security member who can then whitelist them. – jackdh Jun 27 '18 at 13:32
  • And how the security member authenticates the team member? Just call and ask for permission? – ThoriumBR Nov 23 '18 at 18:39
  • Yeah pretty much – jackdh Nov 23 '18 at 22:02

Using an IP as an authentication method is not a great practice. It can be slightly useful as second factor, but it is much better to rely on real authentication methods. IP can be spoofed in many ways, or the attacker may be able to bounce the data from your network, if he compromises a device in it.

I would suggest you use the PKI authentication paired with TOTP. TOTP should be more secure than using a password, as an attacker that can steal the private key will often be able to install a key-logger as well, but that will not help with TOTP. You can add password as a third factor if you want, just to make sure. While the password should be unnecessary assuming employees follow basic security precautions, such as having the phone with TOTP app locked, you should never trust users to do things right.

PS: If you really want to invest into security, you can also use physical tokens. But it should be completely unnecessary in most cases.

|improve this answer|||||

To make the most educated determination of what is best for your organization, you need to look at what your current security solution provides and what would happen if you changed those security measures.

What is the purpose of of having an IP whitelist. It means that only specific (WAN) IP addresses are allowed to connect, to your VPN tunnel. If you removed this limitation you are allowing individuals to login from anywhere. So ask yourself this:
1. Do your users frequently access the VPN connection abroad?
2. Does having the IP whitelist hinder operations enough to dictate removing it?
3. Are users at risk of having thier credentials compromised? (i.e. are they using insecure workstations)
4. Are you protecting high value information?
5. Can you modify the whitelist to increase availability while also keeping certain degree of the security it provides (I.e. Set the whitelist to allow I.P. addresses from within the United States protecting from people attempting to connect from other countries.)

These are just a few of the questions I could think of and i'm sure there is plenty more but it should get you in the right mindset.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.