Nikos Mavrogiannopoulos

Openconnect is a relatively new VPN solution. It started as a client for CISCO's anyconnect VPN server, but it has now surpassed that role and provides a reliable VPN solution with a very conservative security architecture for the server. This talk will go through the story behind the development of the OpenConnect VPN server, address the question on the need for a new VPN solution and feature the distinctive security features and capabilities of openconnect. Finally we will provide an insight on the current development plans.

Openconnect is a relatively new VPN solution. It started as a client for CISCO's anyconnect VPN server, but it has now surpassed that role and provides a reliable VPN solution with a very conservative security architecture for the server. This talk will go through the story behind the development of the OpenConnect VPN server, address the question on the need for a new VPN solution and feature the distinctive security features and capabilities of openconnect. Finally we will provide an insight on the current development plans.

For the development of openconnect VPN server a decision to compartmentalize the server was taken, in order to protect any sensitive values exchanged, ranging from the user transferred data, to the data used during the authentication process. This talk will summarize the issues faced during that development that relate to software isolation. That would cover issues with protecting the server's keys via TLS, the client-side authentication of TLS, and PAM authentication, and how they were solved.

For the development of openconnect VPN server a decision to compartmentalize the server was taken, in order to protect any sensitive values exchanged, ranging from the user transferred data, to the data used during the authentication process. This talk will summarize the issues faced during that development that relate to software isolation. That would cover issues with protecting the server's keys via TLS, the client-side authentication of TLS, and PAM authentication, and how they were solved.