6

I'd like to commit my OpenVPN client config to version control, in a repo that's remotely hosted and publicly accessible.

This would reveal the server's hostname and port, as well as the filepaths to .crt and .key files.

Should I be worried about revealing the server's hostname/port, or would that be considered security through obscurity?

More generally, how safe/unsafe would this be?

An obfuscated example config would look like:

client
dev tun
proto udp4

remote my.example.net 1194
remote-cert-tls server
tls-auth /home/ivan/path/to/ta.key 1
cipher AES-256-CBC

ca /home/ivan/path/to/ca.crt
cert /home/ivan/path/to/myuser.crt
key /home/ivan/path/to/myuser.key

nobind
user nobody
group nogroup
persist-key
persist-tun
comp-lzo yes
auth-nocache

Update: Thanks for the feedback. The points about contrasting "security through obscurity" with choosing not to expose more than necessary about your secure system were well made.

I realized that the context in which I'm doing this offers an easy way to exclude some of the config from version control while committing the rest. The Git repo is for my NixOS system configuration, so I can put the sensitive parts of my vpn config in a separate file, which I'll gitignore, and interpolate its contents into the final config file that nix composes.

So my configuration.nix will have something like:

services.openvpn = {
  servers.fooServer = {
    config = ''
      # The insensitive stuff inline, committed to Git
      client
      dev tun
      # etc...

      # The sensitive stuff slurped from a gitignore'd file
      ${builtins.readFile ./foo-server.private.conf}
    ''
  }
}
1

I'm afraid we cannot conclude how safe/unsafe it is as we do not know which other security controls you have put in place. Generally speaking, security through obscurity as the only defense mechanism is bad practise and should be avoided at all times, however in addition to other fundamental security controls, it might actually be wise to not unnecessarily publish information.

Assuming that you have applied the basic security practices (i.e. no default passwords, no unused open services, up-to-date middleware etc.) I'd say it is safe to publish your config as nothing in there is actually weakening your security level. Be aware that making this config public may lead users with malicious intents to your server more easily so the risk incurred by publishing your config depends on how your securely your server is currently configured and maintained. It's up to you whether or not to accept that risk...

4

Avoiding "security through obscurity" doesn't mean giving away information about your system just because it's something a determined person can find out anyway.

Also, I assume you mean version control hosted remotely, not just version control on your development machine?

If the remote version control server is publicly accessible or accessible to more than those who need to know this information, putting the file in version control doesn't make it anymore secure, so I guess if you think it does, that's falling victim to "security through obscurity".

  • That's right, I was referring to a remotely hosted, publicly accessible git server. I should have mentioned that -- I'll update the question. – ivan May 16 '18 at 1:51
1

If the snippet above is all that is published (i.e any key files are not included), then the only information you are protecting is the location of the OpenVPN service and how to connect to it, information that could likely be derived by an attacker through scanning and observation. This information alone does not grant an attacker any access (unless something is horribly misconfigured or vulnerable).

That said, it does reveal some information about your environment, which, depending on your specific threat model, may be undesirable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.