Crypto-systems and keys
Nice article here about safer key usage:
https://blog.g3rt.nl/upgrade-your-ssh-keys.html
Generate your new sexy Ed25519 key (EdDSA using Twisted Edward curves) and a robust RSA key (Rivest–Shamir–Adleman).
ssh-keygen -o -a 100 -t ed25519 ssh-keygen -t rsa -b 4096 -o -a 100
Add these to the SSH agent via ssh-add:
ssh-add
OpenVPN
Important reading:
https://blog.g3rt.nl/openvpn-security-tips.html
https://community.openvpn.net/openvpn/wiki/Concepts-Authentication
There is a good tool that helps you create your key pairs and certificates for OpenVPN with Client Certificates called easy-rsa. But it does rely on the fact that you are your own Certificate Authority.
We want to use CA-Cert to sign our certificates, so we must make a Certificate Signing Request
Note that OpenSSL and OpenSSH use different formats for there keys. OpenSSH uses a propriety format PKCS#1 PEM-encoded for its private key, OpenSSL uses a standard format IIUC.
For OpenVPN (SSL) we use the OpenSSL toolset to generate the certificates.
I could not find how to convert the private OpenSSH key to a OpenSSL format. So we will regenerate the keys with OpenSSL. (PEM format)
OpenSSL command line cannot create Ed25519 keys (not yet, anyway).
openssl genpkey -algorithm RSA \ -pkeyopt rsa_keygen_bits:4096\ -pkeyopt rsa_keygen_pubexp:65537 | \ openssl pkcs8 -topk8 -nocrypt -outform pem > rsa-4096-private-key.pem openssl pkey -pubout -inform pem -outform pem \ -in rsa-4096-private-key.pem \ -out rsa-4096-private-key.spki
Some interesting readings on OpenSSL:
https://www.sslshopper.com/article-most-common-openssl-commands.html
Generate the CSR, fill in the details as required. You could leave everything empty if the certificate will only be used by OpenVPN. As your email address is not in the certificate, the certificate cannot be used to track you.
openssl req -new -sha256 -key rsa-4096-private-key.pem -out rsa-4096-private-key.csr
Send this to CA-Cert, and receive a signed certificate from them by email.
Information from certificates and CSRs can be obtained with this:
openssl x509 -noout -subject -in <certificate>.crt openssl req -in <request>.csr -noout -text
The big question that now pops-up is if we trust CA-Cert enough to let them sign the certificates. If we would be our own Certificate Authority, we would know exactly which certificates we have signed.
If you are using OpenVPN for your organisation it is probably better not to use any public certificates for OpenVPN but create your own CA and only accept certificates issued by this CA. This is actually the way proposed in the OpenVPN Howto. This way you are in full control of the certificates and even if some of the public CA’s gets compromised and issues certificates in your name then none of your OpenVPN endpoints will accept these, because only certificates issued by your own CA gets accepted.
Apart from that: Using a self-signed certificate does not impose a risk by itself, not for VPN and not for HTTPS. The risk is only if the certificate is not fully validated. A self-signed certificate can not be validated without additional information. So if a client connects to a server, the connection is encrypted, but the server is not verified.
If the server is not verified a man in the middle attack is possible. This not only includes stealing the VPN credentials but intercepting the traffic or modifying the traffic. Since VPN connections are often considered as safe as internal connections inside the company the attacker can thus get access to interesting data or mount attacks against internal clients.
Knowing this, we will need to add some extra security measures.
- Besides certificates, also make use of a Username/Password combination for the clients.
- Get a server certificate for a full domain name. This would make it more difficult for a MitM attach, where you would need to spoof the VPN server.
- Let the server verify if the common name used in the client certificate matches the username, and disconnect if not.
https://github.com/OpenVPN/openvpn/blob/master/sample/sample-scripts/ucn.pl
Unfortunatly, CaCert does not put the CN in their certificates if you are not a “Trusted User (WoT)”.
Generate a private key for the VPN server, and a Certificate Signing request. No need for a public key.
openssl genpkey -algorithm RSA \ -pkeyopt rsa_keygen_bits:4096\ -pkeyopt rsa_keygen_pubexp:65537 | \ openssl pkcs8 -topk8 -nocrypt -outform pem > rsa-4096-server-key.pem openssl req -new -sha256 -key rsa-4096-server-key.pem -extensions server -out rsa-4096-server-key.csr
If you get the error:
openssl req -new -sha256 -key rsa-4096-server-key.pem -extensions server -out rsa-4096-server-key.csr Error Loading extension section server
It means the openssl configuration file ( normally at /etc/ssl/openssl.cnf) is missing this extension. So add it:
[ server ] # comment that this section was added manually by myself nsCertType = server
Generate the DH parameters
openssl dhparam 2048 > dh2048.pem
If you want to harden the security, you could have a look at the openVPN server options:
username-as-common-name client-config-dir <dir>
openssl x509 -noout -subject -in
Convert one to another with:
openssl pkcs8 -topk8 -in <server.key> -out server-pkcs8.key –nocrypt
ssh-keygen -o -a 100 -t ed25519 -f <username>.key
openssl req -key <username>.key -new -out <username>.csr
sssh-keygen -f <input>.key -e -m pem
But these are SSH k
openssl genrsa -des3 -out private.pem 4096
openssl genpkey -algorithm Ed25519 -out ed25519key.pem
openssl req -new -sha256 -key za -out za.csr
/usr/syno/etc/packages/VPNCenter/openvpn
/opt/share/easy-rsa#
/var/packages/VPNCenter/target/scripts/openvpn.sh {start|stop|restart}
Now, we need to build a router key/certificate pair:
./build-key-server server1
Generate a private key for the VPN server, and a Certificate Signing request. No need for a public key.
openssl genpkey -algorithm RSA \ -pkeyopt rsa_keygen_bits:4096\ -pkeyopt rsa_keygen_pubexp:65537 | \ openssl pkcs8 -topk8 -nocrypt -outform pem > rsa-4096-server-key.pem openssl pkey -pubout -inform pem -outform pem \ -in rsa-4096-server-key.pem \ -out rsa-4096-server-key.spki openssl req -new -sha256 -key rsa-4096-server-key.pem -extensions server -out rsa-4096-server-key.csr