Re: [Full-disclosure] SSL VPNs and security
- From: Tim <tim-security@xxxxxxxxxxxxxxxxxxx>
- Date: Fri, 9 Jun 2006 14:55:53 -0400
Sure, it's trivial to create self-signed certs (or run a CA), but
distributing your cert (or the CA cert) to all but a handful of clients
is a logistical nightmare.
For company managed laptops, it is trivial to distribute via normal
software distribution processes. For non-managed systems (which you
shouldn't allow into your network via a VPN anyway), installing a CA
cert is as simple as clicking on a link ONCE, and installing the cert.
This cert can be distributed over a VeriSign secured SSL connection.
Then when the website presents a page, it can dynamically sign certs for
each domain. This stuff isn't really that hard. The tools that the
industry has provided users just suck, that's all.
If you're going to be installing stuff, might as well make that a
IKE/IPSEC client and do it the right way to begin with.
Well, I don't disagree with this one, but so many people who complain
about certificate distribution have not thought through the ways it can
happen. Even with a real VPN, you really should be using client certs
anyway, which present the same distribution problems. These problems
aren't made any easier by using a "trustyworthy" CA which charges you.
The software you use is the biggest contributor to management headaches.
tim
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
- Follow-Ups:
- Re: [Full-disclosure] SSL VPNs and security
- From: Brian Eaton
- Re: [Full-disclosure] SSL VPNs and security
- References:
- [Full-disclosure] SSL VPNs and security
- From: Michal Zalewski
- Re: [Full-disclosure] SSL VPNs and security
- From: Tim
- Re: [Full-disclosure] SSL VPNs and security
- From: Michael Holstein
- Re: [Full-disclosure] SSL VPNs and security
- From: Tim
- Re: [Full-disclosure] SSL VPNs and security
- From: Michael Holstein
- [Full-disclosure] SSL VPNs and security
- Prev by Date: Re: [Full-disclosure] Re: blocking tor is not the right way forward. It may just be the right way backward.
- Next by Date: Re: [Full-disclosure] Re: blocking tor is not the right way forward. It may just be the right way backward.
- Previous by thread: Re: [Full-disclosure] SSL VPNs and security
- Next by thread: Re: [Full-disclosure] SSL VPNs and security
- Index(es):
Relevant Pages
|
