Openconnect VPN Nikos Mavrogiannopoulos Security Technologies Red - - PowerPoint PPT Presentation

▶
openconnect vpn
SMART_READER_LITE
LIVE PREVIEW

Openconnect VPN Nikos Mavrogiannopoulos Security Technologies Red - - PowerPoint PPT Presentation

Feb 08, 2023 328 likes •739 views

Openconnect VPN Nikos Mavrogiannopoulos Security Technologies Red Hat February, 2016 VPN story The server Future plans VPN story 3/17/13 3 Red Hat VPN story T ask Setup a VPN service to inter-connect router devices

slide-1
SLIDE 1

Openconnect VPN

Nikos Mavrogiannopoulos Security Technologies Red Hat February, 2016

slide-2
SLIDE 2
  • VPN story
  • The server
  • Future plans
slide-3
SLIDE 3

3/17/13 3 Red Hat

VPN story

slide-4
SLIDE 4

3/17/13 4 Red Hat

VPN story

  • T

ask

–

Setup a VPN service to inter-connect router devices

slide-5
SLIDE 5

3/17/13 5 Red Hat

VPN story

slide-6
SLIDE 6

3/17/13 6 Red Hat

VPN story

slide-7
SLIDE 7

3/17/13 7 Red Hat

VPN story

slide-8
SLIDE 8

3/17/13 8 Red Hat

VPN story

  • Requirements:

–

Simple setup for users

slide-9
SLIDE 9

3/17/13 9 Red Hat

VPN story

  • Requirements:

–

Standards based solution

slide-10
SLIDE 10

3/17/13 10 Red Hat

VPN story

  • Requirements:

–

The administrator should be able to view who is connected on every moment

slide-11
SLIDE 11

3/17/13 11 Red Hat

VPN story

  • Requirements:

–

The administrator should be able to disconnect and block access to users

slide-12
SLIDE 12

3/17/13 12 Red Hat

VPN story

  • Solution:

–

Based on OpenVPN and lots of custom scripts

slide-13
SLIDE 13

3/17/13 13 Red Hat

VPN story

  • Solution:

–

Based on OpenVPN and lots of custom scripts

slide-14
SLIDE 14

3/17/13 14 Red Hat

VPN story

  • Requirements:

–

Simple setup for users

–

Standards based solution

–

The administrator should be able to view who is connected on every moment

–

The administrator should be able to disconnect and block access to users

Involved configuration files for client setup, TCP/UDP had to be selected by user

slide-15
SLIDE 15

3/17/13 15 Red Hat

VPN story

  • Requirements:

–

Simple setup for users

–

Standards based solution

–

The administrator should be able to view who is connected on every moment

–

The administrator should be able to disconnect and block access to users

Was using TLS for key exchange; everything else was custom

slide-16
SLIDE 16

3/17/13 16 Red Hat

VPN story

  • Requirements:

–

Simple setup for users

–

Standards based solution

–

The administrator should be able to view who is connected on every moment

–

The administrator should be able to disconnect and block access to users

No support; lots

  • f custom scripts
slide-17
SLIDE 17

3/17/13 17 Red Hat

VPN story

  • Requirements:

–

Simple setup for users

–

Standards based solution

–

The administrator should be able to view who is connected on every moment

–

The administrator should be able to disconnect and block access to users

No support

slide-18
SLIDE 18

3/17/13 18 Red Hat

VPN story

  • AnyConnect VPN
slide-19
SLIDE 19

3/17/13 20 Red Hat

VPN story

  • CISCO AnyConnect VPN

–

A proprietary VPN implementation based on standard protocols

–

A VPN channel established over an HTTPS session (TLS 1.x)

–

Supports dual TCP/UDP; UDP via a pre-draft DTLS version

–

Open-source compatible client → openconnect

  • Implements a compatible protocol we call “Openconnect protocol”
slide-20
SLIDE 20

3/17/13 21 Red Hat

VPN story

  • CISCO AnyConnect VPN

–

A proprietary VPN implementation based on standard protocols

–

A VPN channel established over an HTTPS session (TLS 1.x)

–

Supports dual TCP/UDP; UDP via a pre-draft DTLS version

–

Open-source compatible client → openconnect

  • Implements a compatible protocol we call “Openconnect protocol”

Standards compliant VPN

slide-21
SLIDE 21

3/17/13 22 Red Hat

History

  • OpenConnect doesn't need any user confjguration

# openconnect server.example.com:443

POST https://server.example.com/ Attempting to connect to server 127.0.0.1:443 SSL negotiation with server.example.com Connected to HTTPS on server.example.com XML POST enabled Please enter your username Username:test POST https://server.example.com/auth Please enter your password. Password: POST https://server.example.com/auth Got CONNECT response: HTTP/1.1 200 CONNECTED CSTP connected. DPD 90, Keepalive 32400 Connected tun0 as 192.168.1.191, using SSL Established DTLS connection (using GnuTLS). Ciphersuite (DTLS1.2)-(RSA)-(AES-128-GCM).

slide-22
SLIDE 22

3/17/13 23 Red Hat

History

  • OpenConnect doesn't need any user confjguration

# openconnect server.example.com:443

POST https://server.example.com/ Attempting to connect to server 127.0.0.1:443 SSL negotiation with server.example.com Connected to HTTPS on server.example.com XML POST enabled Please enter your username Username:test POST https://server.example.com/auth Please enter your password. Password: POST https://server.example.com/auth Got CONNECT response: HTTP/1.1 200 CONNECTED CSTP connected. DPD 90, Keepalive 32400 Connected tun0 as 192.168.1.191, using SSL Established DTLS connection (using GnuTLS). Ciphersuite (DTLS1.2)-(RSA)-(AES-128-GCM).

Simple user setup

slide-23
SLIDE 23

3/17/13 24 Red Hat

VPN story

  • Requirements:

–

Simple setup for users

–

Standards based solution

–

The administrator should be able to view who is connected on every moment

–

The administrator should be able to disconnect and block access to users

slide-24
SLIDE 24

3/17/13 25 Red Hat

VPN story

  • Requirements:

–

Simple setup for users

–

Standards based solution

–

The administrator should be able to view who is connected on every moment

–

The administrator should be able to disconnect and block access to users

–

The server should isolate users between them

–

The server should operate under the least possible privilege

slide-25
SLIDE 25

3/17/13 26 Red Hat

The server

slide-26
SLIDE 26

3/17/13 27 Red Hat

The server

  • Openconnect server: started in 2013
  • T
  • day the server interoperates with both openconnect and Anyconnect clients

–

Is available for Linux and *BSD systems

slide-27
SLIDE 27

3/17/13 28 Red Hat

The server

  • Features:

–

Supports for password (fjle, PAM, radius), certifjcate or Kerberos authentication

–

Supports setting resource limits per client or groups of clients (e.g., cgroups, bandwidth)

–

Processing scales with the number of CPUs

–

Supports LZS, LZ4 compression

–

Supports TLS 1.2, DTLS 1.2 and AES-GCM

–

Supports online user management

slide-28
SLIDE 28

3/17/13 29 Red Hat

The server

  • Features:

–

Privilege separation between main server and worker processes

  • Isolation of worker processes (using seccomp)

–

Isolated software security module handles PAM/radius and keys

slide-29
SLIDE 29

3/17/13 30 Red Hat

The server

  • Features:

–

Privilege separation between main server and worker processes

  • Isolation of worker processes (using seccomp)

–

Isolated software security module handles PAM/radius and keys

User isolation + Least privilege

slide-30
SLIDE 30

3/17/13 31 Red Hat

The server

  • occtl: Control tool to administer the server and view clients
slide-31
SLIDE 31

3/17/13 32 Red Hat

The server

slide-32
SLIDE 32

3/17/13 33 Red Hat

The server

slide-33
SLIDE 33

3/17/13 34 Red Hat

The server

User overview

slide-34
SLIDE 34

3/17/13 35 Red Hat

The server

slide-35
SLIDE 35

3/17/13 36 Red Hat

The server

slide-36
SLIDE 36

3/17/13 37 Red Hat

The server

User disconnect/block

slide-37
SLIDE 37

3/17/13 38 Red Hat

VPN story

  • Requirements:

–

Simple setup for users

–

Standards based solution

–

The administrator should be able to view who is connected on every moment

–

The administrator should be able to disconnect and block access to users

–

The server should isolate users between them

–

The server should operate under the least possible privilege

slide-38
SLIDE 38

3/17/13 39 Red Hat

Future plans

slide-39
SLIDE 39

3/17/13 40 Red Hat

Future plans

  • Extend and simplify the openconnect protocol

–

e.g., drop legacy pre-DTLS 1.0 support

–

Publish and standardize on an SSL/VPN protocol

  • Improve performance by utilizing an in-kernel TLS/DTLS stack
slide-40
SLIDE 40

3/17/13 41 Red Hat

Questions

  • www.infradead.org/openconnect
  • www.infradead.org/ocserv