News for hackers. Stuff that matters.

A comment on IPsec Vulnerabilities and Software Security Prediction. Parent comment

Re:IPsec Vulnerabilities and Software Security Prediction by feld on Tuesday May 19, 2015 @10:21AM (#9570218)
These days for VPNs it's hard to beat OpenVPN with TLS auth enabled and using keys, not passwords/passphrases.
[ Parent | on HN ]
Re:IPsec Vulnerabilities and Software Security Prediction by brunoqc on Tuesday May 19, 2015 @10:31AM (#9570286)
Why not passwords with LDAP and a psk?
[ Parent | on HN ]
Re:IPsec Vulnerabilities and Software Security Prediction by feld on Tuesday May 19, 2015 @11:00AM (#9570526)
Password protected keys (edit:certificates), yes, but not regular user/password no matter if it's LDAP backed or anything else... (but I think you can do password and key, but I need to check docs)

I'm in a meeting and drawing a blank on what the primary reason was for avoiding password-only... I'll update if I can remember the reason besides "passwords are easier to crack"

[ Parent | on HN ]
Re:IPsec Vulnerabilities and Software Security Prediction by brunoqc on Tuesday May 19, 2015 @11:13AM (#9570685)
LDAP is nice to grant and revoke access and have passwords in sync with the computers at work.

Maybe the certificates could be stored in LDAP.

[ Parent | on HN ]
Re:IPsec Vulnerabilities and Software Security Prediction by snuxoll on Tuesday May 19, 2015 @11:55AM (#9571035)
Almost any decent enterprise identity management solution (read: Active Directory, FreeIPA) includes user certificate management in some fashion; or if you want a separate CA for VPN access it's not hard to write a couple scripts to generate user certificates and revoke them as needed.
[ Parent | on HN ]