3 ms·
Not necessarily. What about exploiting VPN clients? http://www.zerodayinitiative.com/advisories/ZDI-09-024/ http://www.zerodayinitiative.com/advisories/ZDI-09-0
by iuguy 17y ago
Not necessarily. What about exploiting VPN clients? http://www.zerodayinitiative.com/advisories/ZDI-09-024/ http://www.zerodayinitiative.com/advisories/ZDI-09-024/
There's also the configuration to consider. Using PSK or aggressive mode for VPNs can be considered bad but are you really going to deploy a full RADIUS solution just to access a web server?
Compare this to using public key based auth on SSH, I know which one I'd rather have for a web server.
- ankp 17y agoNot necessarily. What about exploiting VPN clients? IPSec is a disaster, one aspect of which is having a client daemon listening on an open port for isakmp/ike key exchange. There's also the configuration to consider. Using PSK or aggressive mode for VPNs can be considered bad but are you really going to deploy a full RADIUS solution just to access a web server? Provisionally "yes", but I'd actually use OpenVPN, wired into our existing directory infrastructure. Compare this to using public key based auth on SSH, I know which one I'd rather have for a web server. Why do you consider it a net win to reduce the entry barrier to only one exploit, one bad user password, or one misconfigured host?