Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have to set up a VPN (various clients connecting to a web service on a server, which is also the VPN server) and I want to make sure that no user will share his/her credentials with third parties.

I know that this problem is not solvable completely, but I'd want to set up some additional security checks... Some idea I have:

1) An additional check on MAC address, but... are MAC addresses preserved thru VPN? 2) Some kind of extra identification of the client (User Agent, open ports, I want to make sure that is the very same client I authorized). 3) I would like to avoid commercial solutions like a security token... I realize it would be the perfect solution, but it will be to expensive, I suppose...

Do you feel that these options are viable? Do you have any other ideas? Thanks in advance for your replies!

share|improve this question

1 Answer 1

1) An additional check on MAC address, but... are MAC addresses preserved thru VPN?

MAC addresses can be changed. Even if you write a custom program that pokes the hardware directly, one can run it inside a virtual machine, and route VPN traffic through it.

Besides, the VPN connection usually gets its own virtual network interface, with its own hardware address.

2) Some kind of extra identification of the client (User Agent, open ports, I want to make sure that is the very same client I authorized).

All those things are manipulated easily.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.