Crypto-systems and keys

Nice article here about safer key usage:
https://blog.g3rt.nl/upgrade-your-ssh-keys.html

Generate your new sexy Ed25519 key (EdDSA using Twisted Edward curves) and a robust RSA key (Rivest–Shamir–Adleman).

ssh-keygen -o -a 100 -t ed25519
ssh-keygen -t rsa -b 4096 -o -a 100

Add these to the SSH agent via ssh-add:

 ssh-add

OpenVPN

Important reading:
https://blog.g3rt.nl/openvpn-security-tips.html

https://community.openvpn.net/openvpn/wiki/Concepts-Authentication

There is a good tool that helps you create your key pairs and certificates for OpenVPN with Client Certificates called easy-rsa. But it does rely on the fact that you are your own Certificate Authority.

We want to use CA-Cert to sign our certificates, so we must make a Certificate Signing Request

Note that OpenSSL and OpenSSH use different formats for there keys. OpenSSH uses a propriety format PKCS#1 PEM-encoded for its private key, OpenSSL uses a standard format IIUC.

For OpenVPN (SSL) we use the OpenSSL toolset to generate the certificates.
I could not find how to convert the private OpenSSH key to a OpenSSL format. So we will regenerate the keys with OpenSSL. (PEM format)

OpenSSL command line cannot create Ed25519 keys (not yet, anyway).

openssl genpkey -algorithm RSA \
   -pkeyopt rsa_keygen_bits:4096\
   -pkeyopt rsa_keygen_pubexp:65537 | \
   openssl pkcs8 -topk8 -nocrypt -outform pem > rsa-4096-private-key.pem

openssl pkey -pubout -inform pem -outform pem \
 -in rsa-4096-private-key.pem \
 -out rsa-4096-private-key.spki

Some interesting readings on OpenSSL:
https://www.sslshopper.com/article-most-common-openssl-commands.html

Generate the CSR, fill in the details as required. You could leave everything empty if the certificate will only be used by OpenVPN. As your email address is not in the certificate, the certificate cannot be used to track you.

openssl req -new -sha256 -key rsa-4096-private-key.pem -out rsa-4096-private-key.csr

Send this to CA-Cert, and receive a signed certificate from them by email.

Information from certificates and CSRs can be obtained with this:

openssl x509 -noout -subject -in <certificate>.crt
openssl req -in <request>.csr -noout -text

The big question that now pops-up is if we trust CA-Cert enough to let them sign the certificates. If we would be our own Certificate Authority, we would know exactly which certificates we have signed.

If you are using OpenVPN for your organisation it is probably better not to use any public certificates for OpenVPN but create your own CA and only accept certificates issued by this CA. This is actually the way proposed in the OpenVPN Howto. This way you are in full control of the certificates and even if some of the public CA’s gets compromised and issues certificates in your name then none of your OpenVPN endpoints will accept these, because only certificates issued by your own CA gets accepted.

Apart from that: Using a self-signed certificate does not impose a risk by itself, not for VPN and not for HTTPS. The risk is only if the certificate is not fully validated. A self-signed certificate can not be validated without additional information. So if a client connects to a server, the connection is  encrypted, but the server is not verified.

If the server is not verified a man in the middle attack is possible. This not only includes stealing the VPN credentials but intercepting the traffic or modifying the traffic. Since VPN connections are often considered as safe as internal connections inside the company the attacker can thus get access to interesting data or mount attacks against internal clients.

Knowing this, we will need to add some extra security measures.

• Besides certificates, also make use of a Username/Password combination for the clients.
• Get a server certificate for a full domain name. This would make it more difficult for a MitM attach, where you would need to spoof the VPN server.
• Let the server verify if the common name used in the client certificate matches the username, and disconnect if not.
  https://github.com/OpenVPN/openvpn/blob/master/sample/sample-scripts/ucn.pl
  Unfortunatly, CaCert does not put the CN in their certificates if you are not a “Trusted User (WoT)”.

Generate a private key for the VPN server, and a Certificate Signing request. No need for a public key.

openssl genpkey -algorithm RSA \
 -pkeyopt rsa_keygen_bits:4096\
 -pkeyopt rsa_keygen_pubexp:65537 | \
 openssl pkcs8 -topk8 -nocrypt -outform pem > rsa-4096-server-key.pem

openssl req -new -sha256 -key rsa-4096-server-key.pem -extensions server -out rsa-4096-server-key.csr

If you get the error:

openssl req -new -sha256 -key rsa-4096-server-key.pem -extensions server -out rsa-4096-server-key.csr 
Error Loading extension section server

It means the openssl configuration file ( normally at ​/etc/ssl/openssl.cnf) is missing this extension. So add it:

[ server ]
# comment that this section was added manually by myself 
nsCertType = server

Generate the DH parameters

openssl dhparam 2048 > dh2048.pem

If you want to harden the security, you could have a look at the openVPN server options:

username-as-common-name
client-config-dir <dir>

 

openssl x509 -noout -subject -in

Convert one to another with:

openssl pkcs8 -topk8 -in <server.key> -out server-pkcs8.key –nocrypt

 

ssh-keygen -o -a 100 -t ed25519 -f <username>.key

openssl req -key <username>.key -new -out <username>.csr

 

sssh-keygen -f <input>.key -e -m pem

But these are SSH k

 

openssl genrsa -des3 -out private.pem 4096

openssl genpkey -algorithm Ed25519 -out ed25519key.pem

openssl req -new -sha256 -key za -out za.csr

/usr/syno/etc/packages/VPNCenter/openvpn

 

/opt/share/easy-rsa#

/var/packages/VPNCenter/target/scripts/openvpn.sh {start|stop|restart}

Now, we need to build a router key/certificate pair:

./build-key-server server1

 

Generate a private key for the VPN server, and a Certificate Signing request. No need for a public key.

openssl genpkey -algorithm RSA \
   -pkeyopt rsa_keygen_bits:4096\
   -pkeyopt rsa_keygen_pubexp:65537 | \
   openssl pkcs8 -topk8 -nocrypt -outform pem > rsa-4096-server-key.pem

openssl pkey -pubout -inform pem -outform pem \
 -in rsa-4096-server-key.pem \
 -out rsa-4096-server-key.spki

openssl req -new -sha256 -key rsa-4096-server-key.pem -extensions server -out rsa-4096-server-key.csr