Originally Posted by sundialsvcs

OpenVPN provides a server setting which prevents more than one simultaneous session from using the same credentials. (Everything in OpenVPN boils down to "the user's key." It knows nothing of system usernames, much less passwords.) The keys contain within their encrypted content a unique serial number, and the same number cannot be used twice at the same time.

Of course it goes without saying that you should never use PSKs = simple passwords." Every user or computer should be issued its own unique key, which you can if necessary selectively revoke.

Anyone who shares VPN key information should be subject to immediate employment termination. And they should be sternly warned of this on day one.

Also note that most software does not enable a "non-administrator user" to access the key information anyway: they are entitled to use the key, but they have no reason to know it. (Any more than they "need to know" what is actually encoded on the unique badge they use to get beyond the lobby of the building.)

If you further "password-protect" a key, you are actually encrypting it. So it must be successfully decrypted before it can then be used. But the security of the key rests only with "itself," encrypted or not. (And with the fact that it has not yet been revoked.) The key is "one of a kind," and the user cannot manufacture one for himself.

Give each user a unique key and a copy of the tls-auth certificate (which is common). The latter enables you to even try(!) to connect – completely shutting-down "unauthorized access attempts."

Originally Posted by Jason.nix

Are you saying that by default two people cannot use the same key at the same time?

Originally Posted by rkelsen

Unless you change the default settings, the server will reject multiple concurrent connections with the same certificate.

Originally Posted by rkelsen

The server will reject attempts by a second user to use the same keys as someone else.

Originally Posted by Jason.nix

So, the best way to prevent two people from logging in at the same time is to use username and password authentication.

Originally Posted by rkelsen

Yes, that is how it works.

See also post #10: and post #7:

No.

Originally Posted by Jason.nix

One of the reasons I hadn't noticed this was that when one user connects to the OpenVPN server and then the next user connects to the server with the same key, the OpenVPN Connect app stays connected.

Originally Posted by Jason.nix

I have two questions:
1- I used the following two commands to generate keys for clients:

Originally Posted by Jason.nix

Now, two clients should be able to connect simultaneously. Am I right?

Originally Posted by Jason.nix

2- Are ca.key and ta.key the same for all clients?

Originally Posted by rkelsen

If this happens, then there is something wrong.

You should only use nopass for the server's keys. Definitely not on client keys, unless you're setting up a permanent VPN between sites and the remote client is a headless server.

Using different keys, yes.

No.

ca.key is the private key. This should NEVER be shared with anyone. It should only exist on the CA machine.

It probably wouldn't hurt to read the documentation to learn more about this. The questions you have seem to be quite fundamental and are all covered: https://community.openvpn.net/openvpn/wiki/HOWTO

Originally Posted by Jason.nix

1- Should an option be included in the server or client configuration files?

Originally Posted by Jason.nix

2- I guess nopass is just to increase security, if the key falls into someone's hands, then he\she need to know the username and password to use it.

Originally Posted by Jason.nix

3- If you want to create a file with the extension .ovpn for the client that will connect to your server, then you need to put the keys Ca.crt, Client.crt, Client.key and Ta.key in the client file. Am I wrong?

Originally Posted by rkelsen

By default, the server will disallow two connections using the same Common Name. If you want to enable multiple connections with the same Common Name (which is not a good idea), then you have to use the "duplicate-cn" directive in your configuration file.

Just the opposite. nopass leaves the key unencrypted, which means anyone can use it.

No, you're not wrong. Your understanding is correct. The "client.crt" and "client.key" parts are different for each user, and should have different names.

Originally Posted by rkelsen

By default, OpenVPN uses UDP. This allows it to operate without a connection.

When you "connect" to it, what you're actually doing is registering your IP address with the server. It then knows to accept packets from your IP address which are encrypted with the key you're using. If a user on a different IP address then "connects," with the same key it will deny access to packets from the original IP address. The original client device won't even know.

This is an over-simplification, and I'm more than happy to be corrected by someone who knows better.

You can check the logs in /etc/openvpn or /var/log/messages or /var/log/syslog for more details about the connections and what is going on.

Originally Posted by Jason.nix

Hello,
Thank you so much for your reply.
But in my opinion, it is better that the creators of OpenVPN designed it in such a way that the previous connection is interrupted so that the user realizes that someone is connected to the server with his\her keys.

Originally Posted by pan64

no
the working session will work, another one cannot be opened with the same key. User will be informed using email/sms/whatever, but not by disconnecting.