0

Is it normal for a physical VPN service to generate/compile the exe for the VPN client? I don't know that much about VPNs, so this might be normal - but a client uses Sophos VPN, and they're saying they want to email me an exe to install for the VPN client. I've asked if I can download the client directly from Sophos's website (as I have sensitive client information on my machine - and don't want to install random exe's people have emailed to me). They're saying that the VPN server on-premise generates the VPN client executable, and mentioned something about a profile. This seems really odd to me - surely people should be discouraged from installing exes from non-official websites?

3 Answers 3

2

The VPN client likely has settings and certificates specific to this connection and server. Such that, you cannot use it for any other connection.

Compiling these things into the binary means that it is much more difficult for someone to steal or reverse engineer the settings and gain unauthorised access to their VPN. I've seen this before.

So, in short, perfectly normal.

4
  • 1
    As for running a client's executable, I would simply run a VM on your machine just for working with them. This creates a natural segmentation of the things relevant to them and the rest of the things on your computer.
    – schroeder
    Mar 25 at 13:41
  • Thanks. I've done the VM thing for another client. But it's a bit of a pain just for this one thing I need to do for this particular client - I very rarely need to access their network. But, it is what it is. Thanks again :)
    – Dan
    Mar 25 at 13:52
  • "Compiling these things into the binary means that it is much more difficult for someone to steal or reverse engineer the settings and gain unauthorised access to their VPN. I've seen this before." I hope this is not the reason why they do that because it won't work …
    – ysdx
    Mar 25 at 14:38
  • @ysdx no, as I said, they do it to embed the settings.
    – schroeder
    Mar 25 at 16:22
1

I've seen an instance of another VPN solution which does something similar. You can download an installer which includes the VPN configuration (VPN server, server certificate, etc.). The settings are included in an XML file which is easily extracted (using strings) from the installer. In this case, you could definitely extract the settings without running the binary and use them from the official client found on the official website.

In summary, this appears to package the installer with the provisioning configuration for convenience.

1

As other answers stated, this is quite normal. There are several reasons to do this:

  • As already mentioned, it allows the server administrator to include the VPN configuration data as part of the installer, thus giving a one-click experience to less technically savvy users and reducing the burden on IT support.
  • It ensures that the server and client are running mutually compatible software versions, again reducing the burden on IT support.

For some VPN solutions, you cannot even get the client any other way. You can only get it from the VPN server. This includes some of the big brands such as Cisco or Palo Alto Networks.

It is generally not a good idea to allow devices which are not under your control access to your network, especially since the whole point of a VPN is to gain access to networks that you would normally not have access to. Therefore, lots of VPN clients now include full endpoint security solutions that allow the VPN administrator wide range access to your device in order to ensure that it is compliant with their security requirements.

That is yet another reason for the VPN administrator to ensure that you only use the exact client with the exact configuration they gave you.

as I have sensitive client information on my machine - and don't want to install random exe's people have emailed to me

There is an unfortunate stalemate here: you want your computer to be protected from them, so you don't want to give them any access to it, but they want their network to be protected from your computer, so they need access to it.

There is no easy solution to this. My employer does it by only allowing access to the VPN from company laptops. In order to access customer's VPNs, we have a pool of VMs in our vSphere cluster that sit inside a DMZ. These VMs have only the VPN client for the customer installed plus any tools to perform our maintenance tasks. They do not have access to the company network nor to each other, thus making it safe to give up control to the VPN administrator.

Some customers send us laptops with the VPN client pre-installed that we have use to connect to their network. Some customers don't use those strict endpoint security settings on the VPN client machine, instead they allow only access to one single port of one single IP which is a "jumphost" VM we can remote into which then has all the security settings applied.

But the fundamental problem of you wanting to use your own machine and not give up control and the VPN admin wanting to have control on the machine to ensure the security of the network is unsolvable. Someone has to give up something: either the VPN admin needs to give up control or you need to give up control or you need to give up on using your own machine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.