Should users have access to the IPsec pre-shared key?

Question

We are in the process of switching from Hamachi to Meraki VPN by Cisco. Hamachi was managed internally, but this new VPN solution is managed by an external party and they have set it up as L2TP/IPsec with a pre-shared key and authentication. They insist on keeping the pre-shared key private, which means they have to set up the VPN for everyone in the company via TeamViewer.

This means I cannot easily set up VPN on my Linux dual boot or my phone whenever I want. Is it standard practice to keep the pre-shared key super secret or should users have access to the pre-shared key?

Answer 1

This is really too broad to have a single answer. If you trust your users enough to give them root/admin access, then they can get the PSK anyhow; nothing to be done about it. At some companies it's standard practice to give everybody root access if they want it; at others it's standard practice to never give it out at all except to the actual sysadmins. Neither of these are an industry-wide practice.

The same is true of hiding the PSK or not. If they don't trust (in the sense of "confident won't do something wrong, knowingly or by accident) employees enough to give root/admin, then it wouldn't surprise me if they don't trust employees to see the PSK. If they do trust employees to follow the principle of least privilege and only use elevated access when necessary, they might still keep the PSK secret because most people have no need to know (and they might not have considered your valid reasons to need it... or they might not think your reasons are valid).