> > > > I'm hoping to use the vpn in three few ways: > > > > > > > > 1. imap and smtp between my laptop and the mail server > > > > 2. ssh from my laptop to the remote server > > > > 3. cups printing from the remote server to the print server > > > > > > I don't think you need a VPN to SSH from your laptop to the remote > > > server -- SSH is already encrypted. > > > > For sure, but it seems like running SSH inside a VPN is better for > > security than running SSH on a non-standard port or even port > > knocking. If I need to set up a VPN for printing, shouldn't I use it > > for other stuff too? Maybe not, I have yet to actually use a VPN so > > please correct me if I'm wrong. > > There are other ways to make SSH more "secure". For example, you could
But what's wrong with this one? :) Honestly though, why would any of those methods be preferred to openvpn? > only enable PubkeyAuthentication while disabling all other methods of > Authentication, then use a large (4096-bit?) key pair with a strong > passphrase[1] and use keychain[2] so you don't have to type in the > passphrase all the time. OK, I'm exaggerating a bit with those > passwords from GRC, but you get the idea. > > [1] https://www.grc.com/passwords.htm > [2] http://www.gentoo.org/proj/en/keychain/ > > Also keep in mind the added overhead with OpenVPN -- your encrypted > SSH traffic is again encrypted by the VPN. Is this significant? Would my SSH latency be increased, the system slowed down, or both? > > > If your laptop is always behind your local firewall, then it should be > > > sufficient to have an OpenVPN tunnel established between your local > > > firewall/print server and your remote server. This should allow you to > > > print. > > > > > > Configuring the routes on your laptop to go through your local > > > firewall and VPN to the remote server should allow you to grab your > > > mail. > > > > > > If you move around with your laptop then you'll need to establish the > > > VPN tunnel to your remote server anytime you need to grab your mail > > > from anywhere else but home (behind your local firewall). > > > > Ah, tunnels, OK. I need to think in terms of tunnels. I'll > > definitely be moving around and won't be behind my local firewall too > > much of the time. Can I set up the openvpn server on my remote system > > and keep a tunnel open between it and the firewall/print server for > > printing, and also initiate a tunnel between the laptop and the remote > > system whenever I need to mail or SSH? Does that sound like a good > > plan? > > Yep, that should work. With a 'permanent' tunnel established between > your remote server and your local firewall/print server, you'll always > have access to those too simply by connecting via VPN to your remote > server. You can print from your laptop to your printer at home while > overseas, for example. Nice, thanks Mike. - Grant -- gentoo-user@lists.gentoo.org mailing list
