:::success
# Implement OpenVPN and provide authentication with Directory services

### by Daniil Sinelnik and Bogdan Lyubchenko
:::

## Introduction
:::info
Done by Bogdan Lyubchenko and Daniil Sinelnik
:::
In today's digital age, network security is paramount, especially when accessing sensitive information remotely. Virtual Private Networks (VPNs) have become an essential tool for establishing secure connections over the internet. OpenVPN is a widely used open-source VPN solution known for its flexibility and robust security features. However, authenticating remote users securely and efficiently is crucial for the overall integrity of the VPN infrastructure. To address this, implementing OpenVPN with Directory Services for authentication provides a powerful solution.

This project aims to integrate OpenVPN, a versatile and widely adopted VPN solution, with Directory Services, such as LDAP (Lightweight Directory Access Protocol) or Microsoft Active Directory. By leveraging Directory Services, user authentication can be centralized, simplifying the management and control of user access and enhancing overall network security.

Directory Services act as a central repository for user information and credentials, making it easier to authenticate users as they connect to the VPN. LDAP, a lightweight protocol commonly used for this purpose, provides a reliable and scalable solution for storing and retrieving user information. In contrast, Microsoft Active Directory offers a comprehensive platform that supports a wider range of enterprise-level features and functionalities.

Implementing OpenVPN with Directory Services for authentication involves configuring the LDAP server and integrating it with the OpenVPN server. This integration ensures that user credentials are validated during the VPN login process, enhancing security by only allowing authorized individuals to access the network. By centrally managing user accounts and authentication information, organizations can streamline user access and ensure consistent security practices across the VPN infrastructure.

## Methodology
:::info
Done by Bogdan Lyubchenko and Daniil Sinelnik
:::
The OpenVPN protocol and LDAP are chosen for this project due to their numerous advantages. OpenVPN is a widely used open-source VPN solution known for its robust security features, flexibility, and cross-platform compatibility. It provides a secure and encrypted connection for remote access to network resources.

LDAP, on the other hand, is a lightweight protocol used for accessing and managing directory information. It is commonly used for centralized user management and authentication in enterprise environments. LDAP directories, such as Microsoft Active Directory or standalone LDAP servers, allow for storing and managing user accounts and their attributes securely.

By integrating OpenVPN with LDAP, we can leverage the authentication capabilities of the directory service for VPN access. LDAP allows for efficient and centralized user management, making it easier to add, remove, or modify user accounts. OpenVPN can then utilize LDAP to verify user credentials and control access to VPN resources based on the user's group memberships or other attributes stored in the directory service.

This combination of OpenVPN and LDAP provides a reliable and scalable solution for managing VPN access. OpenVPN's strong encryption and authentication mechanisms ensure the security and privacy of VPN connections.

**Service and Server side**
As soon as we have to use OpenVPN, the only thing we have to decide is runtime environment and framework that we will use to implement our simple service. To learn something new Node.js and Nest.js were picked to due to high easy setup(At least it was mentioned in the documentation).

Node.js as the Runtime Environment:

* **Efficiency**: Node.js is known for its event-driven, non-blocking I/O model. This allows it to handle a large number of concurrent connections efficiently. For simple services, this can lead to better performance and responsiveness.
* **JavaScript/TypeScript**: Node.js allows you to use JavaScript or TypeScript, which is a familiar language for many developers. This can lead to faster development and easier maintenance.
Nest.js as the Framework:

* **Modularity and Scalability**: Nest.js is built with a focus on modularity and scalability. It encourages the use of well-organized, reusable code through modules, services, and controllers. This can be especially useful as your simple service grows or if you plan to expand it in the future.
* **Dependency Injection**: Nest.js utilizes a dependency injection system, which makes it easier to manage and test components of your application. This can lead to cleaner, more maintainable code.

* **Support for RESTful and GraphQL APIs**: Nest.js provides built-in support for both RESTful APIs and GraphQL. This allows you to choose the API style that best fits your needs for the simple service.

* **Middleware Support**: Node.js and Nest.js have a rich ecosystem of middleware and packages available. This means you can easily add functionality like authentication, logging, error handling, etc., without having to reinvent the wheel.

* **Community and Ecosystem**: Node.js has a massive and active community, which means you'll find a wealth of resources, libraries, and tools available to help you build and maintain your service. Nest.js, while newer than Node.js, has been gaining popularity and has a growing community.
* **Simplicity and Speed of Development**: For a simple service, you want a framework and runtime that allow you to develop quickly and efficiently. Node.js, combined with Nest.js, provides a powerful combination for rapid development, thanks to its simplicity and the ability to leverage existing packages and modules.
* **Flexibility for Future Expansion**: Even though this is a simple service, you may have plans to expand it or add more features in the future. Node.js and Nest.js provide a solid foundation for growth, allowing you to easily extend and enhance your service as needed.
* **Performance and Scalability**: While a simple service might not require extreme performance, Node.js' non-blocking I/O and event-driven architecture can provide good performance even with a high number of concurrent connections. This can be beneficial if you expect your service to scale.

## Results
:::info
Done by Bogdan Lyubchenko and Daniil Sinelnik
:::
First of all I created the virtual machine and configured ssh for convenience. Also I configured firewall and check IP of this virtual machine (figure 1-2). Uncommented line in `/etc/sysctl.conf` to allow packet forwarding for IPv4 (figure 3).
<center>

Figure 1: IP of virtual machine
Figure 2: firewall status
Figure 3: allow forwarding
</center>

Then I installed OpenVPN on this virtual machine and configured it.
Using this comman `wget https://git.io/vpn -O openvpn-install.sh && bash openvpn-install.sh` I got installation file and run it.
The installation process is automated, so you need to answer the following questions: IP and port on which the OpenVPN service will be installed, protocol (tcp or udp), also creating a user. After this, keys are generated for the server and client. Server keys and configuration are stored in the `/etc/openvpn/server/` directory, and client keys in the `.ovpn` file (images).
<center>

Figure 3: server configuration file
Figure 4: server directory
</center>

:::spoiler posible issue
When I looked at the logs, I saw that there were errors about missing key files. To fix this error I edited the file `/lib/systemd/system/openvpn.service`, changing the path to the keys from `/etc/openvpn` to `/etc/openvpn/server`.
:::
Next, I installed and configured LDAP for VPN. (ldap conf and commands)
`apt install openvpn-auth-ldap`. LDAP configuration file I stored in the `/etc/openvpn/auth` directory.
<center>

Figure 5: LDAP configuration file
</center>

After all the settings, I copied the OpenVPN file to the client machine using WinSCP (from my laptop) and checked if the connection worked (figure 6-7).
<center>

Figure 6: client .ovpn file
Figure 7: connecting to VPN
</center>

:::spoiler IP before and after connection to OpenVPN
<center>

IP before connection
IP after connection
</center>
:::

**Server side**
First of all we configured the github repository and the runtime environment called `Node.js` with `Nest.js` using `WebStorm` IDE.

<center>

Figure 8. Controller that handles the requests.
</center>

<center>

Figure 9. Service that returns simple data.
</center>

In fact we have 2 routes.
1. `{serverHost}/` returns the string `Hello World!`
2. `{serverHost}/ssn/group` returns the Names and Surnames of our SNE Master programm group.

Architecture of the `Nest.js` application structured as follows.

<center>

Figure 10. Architecture Pattern.
</center>

## Discussion
:::info
Done by Bogdan Lyubchenko and Daniil Sinelnik
:::

Explanation of Results:
The implementation of OpenVPN with LDAP for authentication has proven to be successful in achieving the intended objectives of providing secure remote access to network resources. The integration of OpenVPN with an LDAP directory service has allowed for centralized user management and authentication, enhancing the overall security and efficiency of the VPN solution.

By leveraging LDAP for user authentication, the project has achieved a streamlined process for managing user accounts. The LDAP directory service stores user credentials and attributes, allowing for easy addition, modification, or removal of user accounts. This simplifies the user management process and eliminates the need for separate account management systems.

Moreover, OpenVPN's robust security features, including encryption and authentication mechanisms, ensure the confidentiality and integrity of VPN connections. This protects sensitive data transmitted over the VPN and prevents unauthorized access to network resources. The successful implementation of OpenVPN with LDAP has resulted in a secure and reliable remote access solution.

Objectives Achieved:
The project has successfully achieved its objectives of implementing OpenVPN with LDAP for authentication. The integration of OpenVPN and LDAP has provided a secure and efficient remote access solution for accessing network resources. The objectives of centralized user management, streamlined account management process, and enhanced security have been met through this implementation.

The use of LDAP for user authentication has allowed for centralized user management, simplifying the process of adding, modifying, or removing user accounts. The integration with OpenVPN has ensured secure and encrypted VPN connections, protecting sensitive data and preventing unauthorized access.

Limitations:
While the implementation of OpenVPN with LDAP has been successful, it is essential to acknowledge the limitations of this approach. One limitation is the reliance on the availability and stability of the LDAP directory service. If the LDAP server experiences downtime or connectivity issues, it may impact the authentication process and hinder VPN access.

Additionally, the scalability of the solution should be considered. As the number of VPN users grows, the LDAP directory may face performance challenges, potentially impacting authentication speed and overall user experience. Proper monitoring and optimization of the LDAP server are crucial to maintaining a scalable solution.

Implications for Future Research and Application:
The successful implementation of OpenVPN with LDAP for authentication opens up avenues for future research and application. Here are a few implications to consider:

1. Integration with other directory services: While LDAP is a popular choice for directory services, there are other options available. Future research can explore integrating OpenVPN with alternative directory services, such as Microsoft Active Directory or Azure Active Directory, to provide more flexibility for organizations.

2. Advanced security features: OpenVPN already offers robust security features, but further research can focus on enhancing security measures, such as implementing multi-factor authentication (MFA) or integrating with other authentication protocols like SAML or OAuth.

3. Scalability and performance optimization: As the number of VPN users increases, scalability and performance optimization become critical. Future research can focus on optimizing LDAP servers, implementing caching mechanisms, or exploring alternative authentication architectures to ensure a smooth user experience.

4. User experience enhancements: The project has focused primarily on the backend implementation of OpenVPN with LDAP. Future research can explore improving the user interface and user experience of the VPN client to ensure ease of use and accessibility for end-users.

## Conclusion
In conclusion, the successful implementation of OpenVPN with LDAP for authentication has provided a secure and efficient remote access solution. While acknowledging the limitations, the project has achieved its objectives of centralized user management, streamlined account management, and enhanced security. The implications for future research and application in terms of integration with different directory services, advanced security features, scalability, and user experience enhancements open up exciting possibilities for further exploration and improvement of the solution.

## References
:::info
Done by Bogdan Lyubchenko and Daniil Sinelnik
:::
1. https://openvpn.net/
2. https://www.dmosk.ru/instruktions.php?object=kak-nastroit-openvpn-server-i-vklyuchit-autentifikatsiyu-cherez-ldap-active-directory#ldap
3. https://wiki.merionet.ru/articles/chto-takoe-active-directory-i-ldap
4. https://ruweb.net/articles/kak-podnyat-svoj-vpn-na-servere
5. https://nodejs.org/en/docs
6. https://docs.nestjs.com/
7. https://docs.npmjs.com/