Slashdot Mirror
Dutch Government Officially Trusts OpenVPN-NL
First time accepted submitter joost.bijl writes "Yesterday the Dutch government took a step to further improve the adoption of Open Source in its ranks. It has officialy approved a modified version of the open source VPN software OpenVPN for use on the governmental level 'Departementaal Vertrouwelijk' (Restricted). The release is called OpenVPN-NL and is fully open-source and available for use. The software has undergone a security evaluation by the Dutch government's national communications security agency (NLNCSA). The major change is the removal of OpenSSL as the cryptographic core of OpenVPN-NL. Instead, the Dutch government opted to include the smaller, better readable and documented open source library PolarSSL to provide the cryptographic and SSL/TLS functionality. The Dutch IT Security company Fox-IT worked together with both OpenVPN and PolarSSL communities and modified the stock software to support the government evaluation process. In total 8000 lines of code and 4000 lines of documentation were checked in to the OpenVPN trunk."
This is very good news. OpenVPN is probably the easiest secure VPN software I've ever worked with. I've been running it as the link for our multi-site network for over two years now, and it's also the VPN software our road warriors are using. Simple to configure, and damnit but it just works. After years of trying to get all these weird implementations of IPSec to co-operate with each other, OpenVPN is just a marvel, fast and lightweight.
The world's burning. Moped Jesus spotted on I50. Details at 11.
Dutch government does not trust openssl?!
Why should we trust it?
When VPN routers were hard to find I set up several OpenVPN links. Over the years most of those networks migrated to other VPN solutions but this one never changed and it always worked. Meanwhile I had to dick with the other solutions all the damn time. When the client with that old OpenVPN link wanted another link I took a good hard look at it. I never had to reconfigure it. I never had to reboot it. It was installed on two HP desktop mini-towers that the client gave to me. And I realized just how good that product was. So I used OpenVPN for the two new links, too. But I upgraded to version 2 and used Centos. That one has been up for two months and everyone is pleased as punch. I'm about to take the old one out of service and install a newer machine running version 2. I'm sure they'll last another ten years.
Holland has made a wise decision to support OpenVPN!
No one ever had to evacuate a city because the solar panels broke!
In usa they're still beating up harddrives likes neanderthals.
I guess you are American?
Comparing to other VPNs... PPTP - insecure by design... L2TP - insecure without IPSec... IPSec - troublesome in IPv4, cause of many of incompatible designs. I do remember one install... cca 8y ago... temporal bridging corporate LAN between two locations for period company moving from one office to another... I've started with IPSec on Linux and after day of not very satisfying results... finished with very stable, lightweight and performant solution OpenVPN on OpenBSD. Computers/servers then worked on both offices without any change in network settings so company was able to manage migration itself. Thanks to OpenVPN adaptive compression slowdown was not so disturbing.
If only apple would support it in their iOS devices. They have a NDA api for cisco and juniper, but no way for openssl to make it in...
I have been trying to use SSH and OpenVPN to help a friend play games through a university network, but my experience with VPNs is limited to Hamachi. It seems extremely easy to setup a client, but setting up a server over Windows 7 seems slightly trickier. Anyone know a good up-to-date guide for a complete noob like myself?
Wasn't some recent version of OpenSSL actually FIPS approved?
Don't get me wrong, I don't see anything bad in allowing the user choose which crypto library to use.
Differences in code between OpenVPN and OpenVPN-NL. (credits: Palatinux) openvpn_nl-v2.1.4-diffpatch.txt
About why the chose to use PolarSSL:
Among the notable differences between OpenVPN and OpenVPN-NL is the cryptographic library. Correct SSL functionality is essential for the protection that OpenVPN offers. OpenSSL is a large and complex library. PolarSSL is a compact and modular library, which is small enough for a fairly in-depth evaluation. Therefore, in the OpenVPN-NL package, it has been chosen to exchange PolarSSL for OpenSSL. This change does not change functionality; the two libraries (OpenSSL and PolarSSL) are mutually compatible.
source: background OpenVPN
But as being said in another comment, someone now working for Fox-IT was involved in PolarSSL. Extra functionality and documentation was added to PolarSSL by Fox-IT according to a comment on a tech-site (tweakers.net) by someone who claims to be the maintainer of PolarSSL.
While OpenVPN is great and I use it myself all these time, I'm stomped nobody's mentioned of IPsec. There's racoon that I've used and it works great too. Client software? Check out http://shrew.net
This seems like a sensible move. It also seems like a major endorsement for OpenVPN. I've always had better experience with OpenVPN than with other VPN solutions, but I have the feeling it hasn't gained much traction. This may be a step in the right direction.
Also, I hadn't heard of PolarSSL, but it sounds worth checking out. OpenSSL has always worked for me, but it is true that the interfaces and documentation aren't the best I've ever seen.
Please correct me if I got my facts wrong.
Not rebooting your 10 year old link, means you haven't done software updates (esp. kernels, which requires reboots), which means you got a setup which is much more insecure than what you would like. After updating glibc, it's also recommended to do a reboot as well - so that all programs use the last glibc. If not doing that, you will have some programs running on the old (removed) glibc - as the kernel keeps the data available for programs which uses libs. All programs started after the glibc update completed will use the new glibc. (This also covers for all kinds of libraries, but glibc is one of the more crucial ones)
Taking your link down for a couple of minutes once every month or every other to update kernels and system libraries, isn't a bad habit. And it'll make you sleep better too. File systems gets their regular checks, so you won't need to spend days saving an outdated file system if your old box suddenly died.
Just my 2cents.
I'm Dutch and I feel ashamed!
Apparently to them, less is more. Less code means verifiability?? I thought it was just a matter of checking how well a certain standard was implemented. And if only 1 standard is implemented, well, less code to check?
They could have just taken GnuTLS and removed everything they didn't need. And even that would be plain stupid, as it would simply mean you're disabling a feature (instead of just choosing not to use said feature).
$(echo cm0gLXJmIC8= | base64 --decode)
I use it for all our RoadWarrior VPN connections...I have yet to have a problem using it on any network we've tried it on. For everything I can't use it for (site-to-site tunnels between PIX/ASA firewalls), I resort to IPSEC (which, is a pain in the ass to deal with compared to OpenVPN).
TLS 1.1 may be excellent, but Google recently added support for perfect forward secrecy to OpenSSL, which would seem like a nice feature to have for governments. If they're sending secrets over OpenVPN with standard TLS, those secrets will only be secrets until computers are powerful enough to factor the primes used to negotiate the session. That might only be a decade - hard to say.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
One of the other interesting things about using OpenVPN is that it doesn't have to be on the edge of your network. Both OpenVPN boxes are inside the firewall and WAN router... both have only one physical interface and both have internal IP addresses. So all the boxes do is OpenVPN and only that port is open to the Internet and *that* one is filtered by the firewall so that only the other box gets to pass. The firewall also blocks the OpenVPN boxes from sending packets to any IP address other than the firewall at the other end. So they may technically be vulnerable but it's way down on the list because even if they're cracked they can't be used for anything and don't have anything on them of interest.
As an aside, I have had numerous instances of an update breaking something important. There are times when it's just not worth the risk.
In addition, no one was interested in paying for updates. It just worked. Not the only Linux installation I've put in that I never got called back on, by the way. One client didn't call me for 5 years after I put in a Linux box that worked as a file/print server. When he called me (because he had to move to MSSQL runtime and was forced to move to MS Server as a result) I told him that I thought he had found someone else to take care of things. He seemed surprised. He never called me because nothing broke. Everything just worked.
No one ever had to evacuate a city because the solar panels broke!