4 ms·
I have considerably less faith in OpenVPN than you do. The "bastion host" concept is fine, but you can do this with SSH, near-transparently even (using ProxyCom
by JoachimSchipper 13y ago
I have considerably less faith in OpenVPN than you do. The "bastion host" concept is fine, but you can do this with SSH, near-transparently even (using ProxyCommand).
- pbsdp 13y agoCan you expand on why? OpenVPN has long been an example of solid development (and crypto) practices. As far as the bastion host, you need an actual VPN to do more than forward SSH connections. For instance, connectivity to your LDAP server, internal web services, etc. Port forwarding gets you part of the way there, but it's inconvenient to use with SSL, requires using weird local port numbers when connecting to services, etc. SSH does have VPN support via tun/tap, but it's not nearly as functionally complete as OpenVPN, and you still have the entire SSH authentication path exposed to the world.
- JoachimSchipper 13y agoOpenSSH has long been an example of solid development (and crypto) practices too, and has had a few less issues. Search for "Use constant time memcmp when comparing HMACs in openvpn_decrypt." (the fix is my colleague's, but the bug was mine.) That said, both are very good, and if you do want a full VPN there's a lot to recommend OpenVPN.