Prevent access to personal devices
-
Hi.
I want to secure connections to openVPN by being able to control which devices can connect, preventing devices from outside the company from accessing (or at least being able to launch a script or write the hostname and MAC in a log to alert).
There are all kinds of clients: Ubuntu, CentOS, Windows 10 and server, OSX, Android, IOS.
Any ideas how to do this?
-
Device names, MAC's etc can be changed easily.
Users that can/should access your VPN have credentials like password, certificates. These can be copied.
It all boils to tu usual issue : don't hand out these credentials in case of doubt.
And limit on a per user basis what a user can access.Why should you care if the user uses OSx, or an iOS or Windows XP ?
-
Also, you'll never see a MAC address from a remote device. They never leave the local network.
-
@Gertjan said in Prevent access to personal devices:
And limit on a per user basis what a user can access.
That does not solve the problem, since what we want to avoid is that users use a different laptop than the company to connect to the openVPN
"Also, you'll never see a MAC address from a remote device. They never leave the local network." -> But you can launch a script when connecting on the client side, but it can be skipped very easily since it is plain text in the configuration file.
Thaks
-
@josea-guardia said in Prevent access to personal devices:
we want to avoid is that users use a different laptop than the company to connect to the openVPN
Like to meet these 'we'.
Users (with an average number of neurons) can and will use login credentials on devices when they think they have to do use.
You should consider taking the source of VPN, recompile it with some extra code so that executing only works on a well defined device. Like pay-ware software does, using the TPM chip, BIOS ID, hardware references etc.
The OPENVPN is "open source", and you are asking for a version that executes on one device only, using, for example, a hard coded certificate and user credentials based on this cert.
It can be done.Way easier is : have these users sign a contract that extends their work contract. That should bring you somewhat into the right direction.
-
Something to read:
https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg16128.html
