@jimp:
No, that would be very insecure.
You'd want a page, on your firewall no less, open to the internet protected by only a username and password, that would let someone get a VPN client and full access to your network, using that very same username and password?
You, as the admin, download their clients for them, and distribute them to users via network/usb/cd/etc. Because you are dealing with certificates and sensitive data, a physical means of transfer is preferred. I would not recommend e-mailing them.
But then again I tend to be paranoid when it comes to those things.
Yes that's exactly what I'm looking for. That's how the OpenVPN AS appliance works. That's how the Juniper Network Connect full tunnel vpn solution works. That's how Fortinet SSL VPN connect works, etc. etc.
This is standard practice. In a corporate implementation, authentication is going to be two factor, ala domain credentials + rsa (which itself will use a static N-digit PIN + random token number).
Regarding the security, I completely understand your position. But I respectfully request that you do not hold back function because you're concerned about the security of my implementation. When done right, more convenience does not always necessitate less security. I can do it right, I don't need a big brother holding my hand.
