Re: [gentoo-user] Re: replacement for ftp?

[R0b0t1]

On Sun, May 14, 2017 at 3:52 AM, Mick <michaelkintzios@×××××.com> wrote:
>> I had some problems setting up OpenVPN that were solved by using
>> per-client public keys. That seems to be the best supported
>> configuration (as well as the most secure). Windows-side using
>> OpenVPN-GUI is very easy.
>>
>> OpenVPN tends to have poor bandwidth due to overhead, but that may be
>> in large part due to my connection.
>
> OpenVPN is not the most efficient VPN implementation for connections to a
> server because it is not multithreaded and also because unlike IKE/IPSec it
> operates in userspace, not in kernelspace.  If you have more than one client
> connecting to the server at the same time you will need to set up multiple
> instances with different ports or different protocols.  With IKE/IPSec you
> don't.  MSWindows PCs come with IKEv2 natively so they can be configured to
> use it without installing additional client applications.
>
> A VPN connection will expose each endpoint's LAN to the other and therefore
> additional firewall configurations could be required.
>

That is only in one setup. It is possible to assign an IP address to
OpenVPN such that you will need any traffic to cross onto your LAN.

>> >> OpenVPN also offers transparent compression which can be a big
>> >> plus for your scenario.
>> >
>> > Not really, a lot of data is images, usually JPEG, some ZIP files, some
>> > PDF.  All that doesn't compress too well.
>> >
>> >> OpenVPN is not too difficult to setup, and the client is available for
>> >> all major OSes. And it's not too complicated to use: Open VPN
>> >> connection, then use your file transfer client as you're used to. Just
>> >> one simple extra step.
>> >
>> > I'm finding it a horrible nightmare, see above.  It is the most
>> > difficult thing you could come up with.  I haven't found any good
>> > documentation that explains it, the different types of it, how it works,
>> > what to use (apparently there are many different ways or something, some
>> > of which require a static IP on both ends, and they even give you
>> > different disadvantages in performance ...), how to protect the
>> > participants and all the complicated stuff involved.  So far, I've
>> > managed to stay away from it, and I wouldn't know where to start.  Of
>> > course, there is some documentation, but it is all confusing and no
>> > good.
>>
>> Feel free to start a thread on it. As above, I recommend
>> one-key-per-client and running your own CA.
>
> For secure connections you will have to set up CA and TLS keys with any
> option.  Even ftps - unless the ftp server is already configured with its TLS
> certificates.
>

No, certain OpenVPN modes allow encryption without a CA, but they are
limited (e.g. single user, single password, etc).