5 ms·

These days for VPNs it's hard to beat OpenVPN with TLS auth enabled and using keys, not passwords/passphrases.

• brunoqc 11y ago
  Why not passwords with LDAP and a psk?
  • feld 11y ago
    Password protected keys (edit:certificates), yes, but not regular user/password no matter if it's LDAP backed or anything else... (but I think you can do password and key, but I need to check docs) I'm in a meeting and drawing a blank on what the primary reason was for avoiding password-only... I'll update if I can remember the reason besides "passwords are easier to crack"
    • brunoqc 11y ago
      LDAP is nice to grant and revoke access and have passwords in sync with the computers at work. Maybe the certificates could be stored in LDAP.
      • snuxoll 11y ago
        Almost any decent enterprise identity management solution (read: Active Directory, FreeIPA) includes user certificate management in some fashion; or if you want a separate CA for VPN access it's not hard to write a couple scripts to generate user certificates and revoke them as needed.