An employee has left the company, so we need to revoke his OpenVPN access. Unfortunately, we don't have a good record of which certs were created or being used. He probably has multiple certificates (one for each of his systems).
How do I:
Check the logs.
Reconcile the logs with the known IPs of the user?
Ya got me there. It's been so long since I've used OpenVPN I can't remember if you can disable/remove individual certificates.
(P. S. Thank you yet-another-mark-up-language for renumbering my 1-2-3 into 1-1-1.)
Here's what I did:
Note: OpenVPN appears to use a cert revocation list. That's too bad. It would be preferable (from a security point of view) to have it use an access list, where certs are denied by default. That way, if there were unknown certs out there (ex: if this ex-employee made his own before he was terminated) then we wouldn't run the risk of having a backdoor into the system.
Do you know what IPs the former employee was using? If not, I think you're going to have a tough time reconciling the logs, and you'd be better off starting to reissue certs to people who are using them, and revoking all the other ones.
And this time, you can keep a log. :-)
This might be a good time for an audit. Might as well solve the underlying problem before it turns into a disaster.
Depending on your circumstances you might:
Ask your users to connect to the VPN by a certain deadline so you can capture their certificate information and disable any who haven't connected, or
If nothing mission-critical is at stake, disable all certificates and ask your users to contact you to re-enable their access.
Either way, you'll end up knowing exactly where each active certificate is.
Whatever you decide to do, you should make sure it's not something you are going to have to do again the next time someone leaves.
It will probably also involve disturbing the other users because nobody thought about this up front.
The simplest might be to create a second layer of security, perhaps a password protected program that everyone has to run within a minute of logging in. If they don't run it, the system will kick them and tag their cert as questionable for you to review. If they do run it, it tags their cert as authorized and they shouldn't have to do it ever again.
Certificate Revokation appears to be the major method OpenVPN supports. In order to do this securely, you must be certain that you know about every signed certificate ever created. Perhaps some environments can rely on this, but we can't.
Therefor, the only sure way to allow only certain people onto the network is to reenerate the certificates (both server and client), reissue them, and then reconfigure all the clients. That's definitely an ugly process.
I think the best bet is to enable an alternative authentication method, use that to allow/restrict access, and not worry so much about revoking certificates.
Check the section of the OpenVPN docs that covers the ccd-exclusive option: create a "Client Configuration Directory" on the server and place a file in this directory for each valid user. Any user without a corresponding file will be denied access.