News for hackers. Stuff that matters.
Re:Chrome Enterprise by twotwotwo on Tuesday August 22, 2017 @03:00PM (#15075389)
One of my annoyances on consumer Chrome OS is that the built-in VPN support is tricky. There's a JSON format, ONC (https://chromium.googlesource.com/chromium/src/+/master/comp...), that maps to OpenVPN options. When I last used it the documentation was a bit tricky though it may have improved, I couldn't find ONC equivalents for some of my .ovpn options, and, most frustratingly, there was very little specific feedback if you try to import a configuration that isn't right. Because of all that I wonder if it was developed so Google could support specific large customers' VPNs (think school districts or companies) and its public availability was mostly an afterthought.

If you leave the GUI, you can also run openvpn yourself on a good old .ovpn file, but you lose some of the nice security properties you get with the default Chrome OS setup, you have to do cros-specific hacks to make it work (https://github.com/dnschneid/crouton/issues/2215#issuecommen... plus switching back and forth between VPN and non-VPN DNS by hand), and last I checked it made ARC (Play Store) apps' networking stop working.

I would consider paying a premium just to get my Chromebook connecting to work's VPN smoothly, though of course I'd love it if improved VPN functionality were available to everyone by default.

At some point I'm probably also going to take a second look at the latest ONC docs. It looks like they've improved since I first looked at VPN setup a while back.

Re:Chrome Enterprise by massar on Tuesday August 22, 2017 @03:40PM (#15075694)
Please do check: https://unfix.org/projects/chromeos-openvpn-onc/

which is a WebUI thingy I wrote to solve exactly that problem.

[disclaimer: "advertising" tool I wrote]

Re:Chrome Enterprise by twotwotwo on Tuesday August 22, 2017 @04:03PM (#15075893)
Neat tool, and glad it's here for others to see. It doesn't look like it matches the specific kind of ovpn setup I'm using (for example, I don't have a client key/cert).

When I last looked at the situation, I couldn't find an ONC equivalent for some of the options in the .ovpn file. It might be the docs or even functionality have gotten better. (I remember looking at some PDF, for example, and now there's https://chromium.googlesource.com/chromium/src/+/master/comp...) It's also possible I just missed something last time. Either way I should take another look.

Re:Chrome Enterprise by corybrown on Tuesday August 22, 2017 @03:34PM (#15075653)
What about non-OpenVPN? Any good option that works well with Chromebook?
Re:Chrome Enterprise by tssva on Tuesday August 22, 2017 @04:11PM (#15075960)
Pulse Secure, Cisco, F5, Palo Alto and SonicWALL provide VPN clients for Chrome OS. The Cisco AnyConnect client will also work with the open source openconnect vpn server although doing so is a violation of the client's license. L2TP/IPsec VPNs are supported out of the box.
Re:Chrome Enterprise by massar on Tuesday August 22, 2017 @03:43PM (#15075712)
As there is a Linux kernel underneath, basically anything could in theory work; but non-standard options require 'developer mode' operation which kinda destroys the security model of ChromeOS.

Android apps (on some models of the laptops) might work though.

Having support for Wireguard would be pretty neat, but afaik not possible yet.

OpenVPN works quite fine for my use cases up to now.

Re:Chrome Enterprise by twotwotwo on Tuesday August 22, 2017 @03:52PM (#15075785)
I need to connect to my work's OpenVPN network, so I can't really use other options and don't know much about them.