Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to know if there's a way to check the OS of the client connecting to a client to site VPN tunnel ending in an OpenVPN Linux server. I don't want Windows clients to connect to it due to security concerns.

I'd like to be able to do this with an open source solution.


share|improve this question

I question the logic of this question, as even if you are only allowing Linux boxes to connect, there is nothing to stop those Linux boxes natting Windows boxes etc. I believe that doing this for security reasons must be misguided, particularly as OpenVPN is opensource, and can thus be hacked to appear to be something its not.

You haven't specified the parameters for the OpenVPN clients, so the question is open to interpretation. You could, for instance, allow the client to connect but then force a connection (via SSH or somesuch) back to the machine which connected and run some tests to ensure it is a Linux machine.

Alternatively, depending on how robust a solution you need, you could also do a "Fingerprint Scan" scan for OS using, for example, NMAP OS Detection.

Another option, depending on your usage case would be to use parameters which are only implemented under Linux. You might be able to set up P2P tunnel with on the one end and upwards on the other end - I suspect Windows will not handle this correctly while Linux will.

share|improve this answer
Hi David, thanks for the response. Yes, I know a VM could be natted inside Linux, but I'm not trying to prevent such determination. Do you know how I can add a script that runs NMAP & pareses the output to ID the OS? I know how to create the script, the thing is how I can make the OpenVPN server run it & wait for a response. Thanks. – Just Starriol Oct 7 '13 at 13:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .