4

I'm looking for best-practices or suggestions to secure inter-server communications between VPSs.

  • Should I just run all traffic through SSH?
  • What about HTTP Traffic via something like mongo? Reverse proxy it on the same machine to https with nginx?
  • What about setting up a VPN? My concern here is both 100% reliability and overhead. If this is a way to go, OpenVPN?

Thanks for any insight :)

3

It depends on the traffic. If it's commands and file transfer, then SSH is sufficient (since you'd be using SSH anyway). You'll be relying on strict host key checking, so make sure you don't suppress that.

Otherwise, VPN it. OpenVPN is simple enough. Requires some setup, but not tons.

IPSec was actually designed specifically for this purpose. It's a disaster of Design-By-Committee bloat to the extent that it's, unfortunately, almost completely unusable. A bit of a shame, because it's otherwise a simple solution to a very common problem. But if you can get IPSec to work, the overhead is theoretically negligible.

  • I use OpenVPN a fair bit; use certificate based authentication, and make sure to upgrade from the default cipher suite and hash (cipher, auth, and tls-cipher options). Use the tls-auth option (ta.key) control channel encryption, as well. See TLS v1.0 best cipher for OpenVPN setup – Anti-weakpasswords Feb 17 '14 at 5:51
2

From a security point of view, all the options you mention are adequate, provided they are configured securely. Secure configuration is mostly about key management; the model I'd suggest is that every server has its own private key, and also the public keys of all the servers it needs to talk to.

You need to consider whether you want servers to talk directly to each other, or you want a central hub. SSH and SSL fit the peer-to-peer model naturally. VPNs would generally favour the hub model, but it is possible to have a peer-to-peer VPN, e.g. Freelan.

If you need to secure a variety of protocols then a VPN may be the best option as you can configure the security once, and all the protocols benefit from the VPN security. If it's only one protocol, then I'd favour SSH for administration and file transfers, and SSL for everything else.

  • Thanks for the feedback. Freelan looks like a very interesting option, and possibly also solves my problem that I potentially want multiple connected VPNs from different data centers. The only thing I'm worried about with a VPN is what happens if the connection drops? My own VPN takes up to 30 seconds to reconnect. Granted, this probably wouldn't be the case with servers that have <1ms pings to one-another, but if the connection to my DB drops and it takes 5 seconds to reconnect, that's very very bad. HTTPS wouldn't have that problem, but I have to worry more about other communication – zyklus Feb 17 '14 at 7:41
  • @zyklus Freelan may be able to route around a failed link. I don't know that for certain, but it seems an obvious feature for a peer-to-peer VPN. – paj28 Feb 17 '14 at 7:53
0

SSH seems the most easiest choice, yet strongly secure. You would use unnecessary resources and invest more time in implementing and maintaining anything else. SSH is straight forward.

Check A Simple Way to Send Multiple Line Commands Over SSH and How To Set Up SSH Keys

0

In my experience, OpenVPN is far more reliable than SSH. And it's not that much harder to set up. The OpenVPN HOWTO covers PKI creation, and includes extensively annotated sample configuration files for server and client.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.