#  OpenVPN Notes - Server Terminated on May 23, 2022. 

## NOTE: OpenVPN decommissioned on March 25, 2022; replaced with AWS VPN

See [AWS VPN Notes](AWS%20VPN%20NOTES.md)


<!-- ```
To admin OpenVPN, SSH into the OpenVPN server and use the admin user that is located in Vault. 

The admin username is `openvpn`

`systemctl restart openvpnas`

Helpful... [OpenVPN - Managing settings for the web services from the command line](https://openvpn.net/vpn-server-resources/managing-settings-for-the-web-services-from-the-command-line/)

There is a strict dependency that OpenVPN be started after `firewalld`.


## How to Reset ldap.read 

`ldap.read@defpoint.com` is the Okta user that OpenVPN uses to auth to Okta. The `ldap.read` account's password expires after 60 days. To see when the password will expire, go to [Reports -> Okta Password Health](https://mdr-multipass-admin.okta.com/reports). Don't open with EXCEL! Add 60 days to the date in the last column.  

- Be on prod VPN.
- Log into OKTA in an Incognito window using the `ldap.read` username and the current password from Vault (`engineering/root`). Three failed logins will lock the user. Brad's phone is currently setup with the Push notification for the account. The MFA is required for the account. To change the password without Brad, remove MFA with your account in OKTA and set it up on your own phone. 
- Once the password has been updated, update Vault in this location, `engineering/root` with a key of `ldap.read@defpoint.com`. You will have to create a new version of engineering/root to save the password. 
- Store the new password and the creds for openvpn and drop off the VPN. Log into the [OpenVPN web GUI](https://openvpn.xdr.accenturefederalcyber.com/admin/) as the openvpn user (password in Vault) and update the credentials for `ldap.read`. Authentication -> ldap -> update password -> Save Settings. Then update running server. Repeat this for the [Dev Environment](https://openvpn.xdrtest.accenturefederalcyber.com/admin/) 
- Verify that you are able to login to the VPN. 
- Set reminder in your calendar to reset the password in less than 60 days. 


------------
when okta push is slow, get the 6 digits from your okta app
and put into Viscosity your password as  `password,123456`
clearly your password should have no commas in it


### LDAP config

Primary server: [MDR Multipass Okta](https://mdr-multipass.ldap.okta.com)      
Bind Anon? NO       
Use creds? YES      


BIND DN:                    
`uid=ldap.read@defpoint.com, dc=mdr-multipass, dc=okta, dc=com`       

BASE DN for Users       
`ou=users, dc=mdr-multipass, dc=okta, dc=com`    

Username Attribute      
`uid`    


## OpenVPN License

PROD -> See Salt state.     
TEST -> YOLO via web interface. This means I did not take the time to reconfigure the Salt states to handle a prod and test license. 


## CLI

OpenVPN can also be configured via CLI. 

The `confdba` tool is used to view the configurations DB.

```
#Show all configurations
/usr/local/openvpn_as/scripts/confdba -s

#Show all configurations in the User database
/usr/local/openvpn_as/scripts/confdba -us
```

The `sacli` tool is used to interact with the OpenVPN API.

`/usr/local/openvpn_as/scripts/sacli Version`

View Configurations
If configuration doesn't show up it is set to the default.
```
/usr/local/openvpn_as/scripts/sacli ConfigQuery
/usr/local/openvpn_as/scripts/sacli UserPropGet

/usr/local/openvpn_as/scripts/sacli ConfigQuery --pfilt=vpn.server.tls_version_min
```
## Timeouts

[OpenVPN Tunnel Session Management Options](https://openvpn.net/vpn-server-resources/openvpn-tunnel-session-management-options/)

Fedramp SC-10 [FedRAMP Security Controls Baseline](https://www.fedramp.gov/documents-templates/)

#RIGHT:             
The Access Server can push the OpenVPN "inactive" directive to clients. The inactive directive can be used to compel clients to disconnect if their bandwidth usage is below a given threshold for a given length of time.

Control with the following user/group properties:
```
prop_isec:	(int, number of seconds over which to sample bytes in/out)
prop_ibytes:	(int, minimum number of in/out bytes over prop_isec seconds to allow connection to continue)
For example, to disconnect a user who fails to transmit/receive at least 75,000 bytes during a 30 minute period:

#default user applies to all users.
# 30 minutes
/usr/local/openvpn_as/scripts/sacli --user __DEFAULT__ --key prop_isec --value 1800 UserPropPut
/usr/local/openvpn_as/scripts/sacli --user __DEFAULT__ --key prop_ibytes --value 75000 UserPropPut

# 15 minutes
/usr/local/openvpn_as/scripts/sacli --user __DEFAULT__ --key prop_isec --value 900 UserPropPut
/usr/local/openvpn_as/scripts/sacli --user __DEFAULT__ --key prop_ibytes --value 5000 UserPropPut

#verify the setting is in place
/usr/local/openvpn_as/scripts/confdba -us -p __DEFAULT__
```

## Configure TLS on OpenVPN

Make a certificate like you would any other, using openssl commands and our CA.  Then to install:

```
../scripts/sacli --key "cs.openssl_ciphersuites" --value 'TLSv1.2+FIPS:kRSA+FIPS:!eNULL:!aNULL:!3DES:!SHA' ConfigPut
../scripts/sacli --key "cs.ca_bundle" --value_file=bundle.pem ConfigPut
../scripts/sacli --key "cs.cert" --value_file=openvpn.pem ConfigPut
../scripts/sacli --key "cs.priv_key" --value_file=openvpn.key ConfigPut
```

See [OpenVPN Docs](https://openvpn.net/vpn-server-resources/managing-settings-for-the-web-services-from-the-command-line/#selecting-ssl-and-tls-levels-on-the-web-server)

``` -->