4

We are using a PPTP VPN, on Windows RAS/Server 2003.

We have users verify anti-virus patching, and then after verification grant access to the VPN. We don't use a CMAK applet, we just provide users with instructions on configuring their home device to connect to the VPN.

My question is how can we ensure that they do not save the VPN password when they save the connection? Is there any method to audit it? We can remind users, but if they've already set up VPN it's not too likely that they'll actually follow through and change the settings.

A method that works for XP is most important, but also support OS X and Windows 7/Vista would be nice. I would be willing to switch our VPN to a new solution and distribute a connectoid if that's the only real way to do it.

Edit: I should point out two things: we can't really afford to use 2-factor authentication. Also, I understand that there's probably not a perfect way to ensure it. Our users aren't malicious, but they are lazy. If I can identify even 90% of users that are saving the password and then deny them access until they fix it, that's enough for me.

Quinten
  • 1,076
  • 1
  • 11
  • 25
  • 5
    My gut says, if you don't own the box they are using to connect, you cannot guarantee that. If you own the PC, you can set and control security policy. If you are that concerned, use two-factor authentication. – uSlackr Apr 25 '12 at 19:12
  • I have to agree with uSlackr - it's not your box, so you don't control anything on it. You have to accept that and either work around it using one of the ways that have been identified or accept that its going to happen. Sorry. – Rob Moir Apr 25 '12 at 20:14
  • 1
    It might be worth mentioning your budget. You're ruling out 2-factor auth because of the assumed cost, but there are definitely low-cost solutions available without any subscription or recurring costs, for example the YubiKey. – Martijn Heemels Apr 25 '12 at 20:42
  • PhoneFactor mutli-factor authentication is free for up to 25 users. http://www.phonefactor.com/solutions/ssl-vpn-authentication – joeqwerty Apr 25 '12 at 21:17
  • Pain is a good motivator. ;D – Justin Pearce Apr 25 '12 at 22:42

3 Answers3

1

I also run a VPN with Windows Server and RRAS. My recommendation is to use CMAK (Connection Manager Administration Kit) to create VPN client installers. It's not a lot of work and it does what you want - lets you customize the VPN screen options and, among other things, allows you to remove the ability to save/remember the user's password. I do this myself.

CMAK covers XP, Vista, and Windows 7 (though they are separate installers based on both architecture (32/64-bit) and OS version and must be created from the appropriate server version corresponding to each client. (For XP, Server 2003, Vista would be Server 2008, Windows 7 would be Server 2008 R2). It's somewhat of a pain, but once they're created they don't generally change often.

As for existing users, tell them to maintain the ability to VPN from their home PCs, you have a new VPN client that they need to start using.

It's not bulletproof (a user could still manually create a PPTP connection in Windows), but it's still an improvement over each user having the save password checkbox directly in front of them. It should also save you the manual work of having to walk users through configuration of a new vpn connection each time in the future. They just need the right installer, type their username and password, and connect.

This doesn't solve the OS X case, and is not a true guarantee, but it does at least improve the situation. I would consider using CMAK if you stick with Windows RRAS. If you decide to switch to another technology, please leave a comment on it - I'd be curious.

uSlackr's comment holds true - if you don't control the hardware, there is no guarantee.

Joshua McKinnon
  • 1,421
  • 1
  • 13
  • 26
  • This will work for the casual users. I've had more technical users set up their own VPN software such as Shrewsoft because they were experiencing problems with our Cisco IPSec VPN client. Using another client will circumvent your settings. – Martijn Heemels Apr 25 '12 at 20:48
  • This seems like the best answer, although implementation may be a little work to begin with. I'm not worried that someone will be able to get around it--they surely will for anything but the 2-factor. I'd just like to catch the bumbling users who got VPN to work and then didn't pay attention to the instructions about not saving a password and who will ignore an email message warning them about it. – Quinten Apr 26 '12 at 12:44
1

Similar to Bryan's answer the YubiKey has a low cost per device($25 for one, less in bulk) and the YubiRadius software is free (they only charge for support). Just set up the radius server and have your VPN use that to authenticate the users.

This will work in the same way the RSA Secure ID token works so that they have a physical device that generates a one time password and if they do not have the device with them they can not log in.

Community
  • 1
Scott Chamberlain
  • 1,445
  • 2
  • 21
  • 37
  • 1
    Beat me to it. :-) I was just going to suggest using the YubiKey. It's a cheap, simple device that's easy to roll out. The YubiRadius software is free and does all the poster needs. This would definitely fix Quinten's concern, is very low-cost, and has no recurring costs. – Martijn Heemels Apr 25 '12 at 20:33
0

Strictly speaking this doesn't answer your question, however I believe this alternative approach should be a suitable solution for you.

Implment a system that requires two factor authentication for your VPN connections, using a device such as an RSA secureID.

The user might still leave their SecureID at next to their home PC, but these devices usually require a PIN to be entered (that the user memorises and can't be cached), plus the digits displayed on the device.

There is a youtube video that demonstrates this.

Bryan
  • 7,538
  • 15
  • 68
  • 92
  • That is definitely an interesting solution, but I think it's outside of our budget. – Quinten Apr 25 '12 at 19:59
  • 1
    @Quinten What is your budget as that can affect recommendations. – Scott Chamberlain Apr 25 '12 at 20:01
  • @ScottChamberlain free would be best, even if time-consuming to implement, as our current solution works without requiring additional licenses. The value of buying a new product to fix the problem will be hard to show. – Quinten Apr 25 '12 at 20:04