Differences

This shows you the differences between two versions of the page.

--- vpnaccess [2018/06/29 15:59] – djgalloway
+++ vpnaccess [2026/09/16 18:42] (current) – djgalloway
@@ Line 1: / Line 1: @@
 ====== VPN Access ======
-===== Requesting Access =====
+===== Requesting New Access =====
-To request access to the Sepia lab,
-  - Generate login credentials by following directions under **VPN Client Access** below.
-  - [[http://tracker.ceph.com/projects/lab/issues/new?issue[tracker_id]=3|File a ticket]].  Select **Sepia Lab Access Request** for the Issue Template.
-For details on our particular OpenVPN server setup, see [[services:openvpn|OpenVPN]].
+Visit https://onboarding.sepia.ceph.com/
-===== VPN Client Access =====
+===== Existing User Additional Credential =====
-Follow the instructions corresponding to your workstation's operating system below.
-**NOTE:** You will need VPN credentials for each machine/workstation you intend to connect to the Sepia VPN.  **Client credentials can not be used on more than one machine at a time!**
+Use this form if you are registering an additional machine and need another Wireguard or SSH key.
-==== Linux ====
+See https://onboarding.sepia.ceph.com/wireguard/request
-<code>
-sudo [apt-get|yum] install openvpn
-cd /etc/openvpn
-wget http://ceph.com/sage/sepia-vpn-client.tar.gz
-sudo tar zxvf sepia-vpn-client.tar.gz
-# Generate client credentials
+===== Existing User Replace Credential =====
-# USER should be your desired username and HOST should describe your workstation
-# e.g., dgalloway@thinkpad
-sudo ./sepia/new-client USER@HOST
+Use this form if you are //replacing// a machine and no longer need your previous Wireguard key/SSH key.
-# Submit the command output in your ticket
+https://onboarding.sepia.ceph.com/wireguard/replace
-# After you've been notified in your ticket that access has been granted,
-sudo service openvpn restart
+===== Existing User Remove SSH Key =====
-OR
-sudo systemctl restart openvpn@sepia
-# If you have a /etc/openvpn/client/ directory, you may need to:
+https://onboarding.sepia.ceph.com/keys/request
-sudo mv /etc/openvpn/sepia* /etc/openvpn/client/
+===== Approvals =====
-# before you can run openvpn-client@sepia.service.
+User access requests from @ibm.com and @redhat.com e-mail addresses are automatically approved once they confirm their e-mail via a magic link.  (Other domains can be added.  For now, IBM and Red Hat seemed safest.)
-# This is because the OpenVPN systemd unit file looks in /etc/openvpn/client/ for configuration files by default.
-</code>
-=== Linux Gotchas ===
+Non-whitelisted domains require an existing lab user to "vouch" for them by clicking a magic link in their e-mail.  Then a Lab Admin still has to approve.
-You may need to modify ''user'' and ''group'' in ''/etc/openvpn/sepia/client.conf'' depending on what user the service runs as.  This could be ''nobody'', ''nogroup'', or ''openvpn''.
-<code>
+Once an account is approved, automation runs to add the user's public key to https://github.com/ceph/keys and their user entry to https://github.com/ceph/ceph-sepia-secrets.
-- user nobody
-- group nogroup
-+ user openvpn
-+ group openvpn
-</code>
-If you're using OpenVPN for any other VPN connection (e.g., Red Hat's), you may need to change the ''dev'' name in ''/etc/openvpn/sepia/client.conf''.  See below.
+The user will then be e-mailed their Wireguard IP and can log in.
-<code>
+Admins can approve/deny/clean up at https://onboarding-admin.front.sepia.ceph.com/admin.
-- dev tun
-+ dev sepia0
-+ dev-type tun
-</code>
-=== Troubleshooting ===
-To troubleshoot your VPN connection, try running the following command to determine where the connection is failing:
-<code>
-openvpn --config /etc/openvpn/sepia.conf --cd /etc/openvpn --verb 5
-</code>
-==== Fedora NetworkManager GUI ====
-  - Make sure you've followed all the prerequisite steps [[vpnaccess#linux|here]]
-  - Right click the NetworkManager icon
-  - **Edit Connections**
-  - Click the + symbol
-  - Select **Import a saved VPN configuration** from the bottom
-  - Click **Create**
-  - Browse to ''/etc/openvpn/sepia/client.conf''
-  - Enter your the first line in ''/etc/openvpn/sepia/secret'' (e.g., ''USER@HOST'') under **User name**
-  - Enter the second line in your ''/etc/openvpn/sepia/secret'' file for **Password**
-==== Mac/OS X ====
-Tunnelblick and Viscosity are two clients known to work with the Sepia VPN.
-=== Tunnelblick **UNTESTED** ===
-  - Download and untar the Sepia VPN client [[http://ceph.com/sage/sepia-vpn-client.tar.gz|tarball]] <code>
-mkdir /etc/openvpn
-cd /etc/openvpn
-wget http://ceph.com/sage/sepia-vpn-client.tar.gz
-sudo tar zxvf sepia-vpn.client.tar.gz
-# Generate client credentials
-# USER should be your desired username and HOST should describe your workstation
-# e.g., dgalloway@thinkpad
-sudo ./sepia/new-client USER@HOST
-# Submit the output of this command in your ticket</code>
-  - Replace the line ''auth-user-pass sepia/secret'' with just ''auth-user-pass'' in client.conf
-  - Follow [[https://tunnelblick.net/cConfigT.html|Tunnelblick's instructions]] for adding the config
-  - When prompted for user/pass, enter username USER@HOST as above, and for password use the secret contents of the file ''/etc/openvpn/sepia/secret''.
-  - Save to your keychain if you wish
-=== Viscosity ===
-  - Download http://ceph.com/sage/Sepia.visz
-  - Download http://ceph.com/sage/sepia-vpn-client.tar.gz
-  - Import the Sepia.visz config into Viscosity
-  - Extract sepia-vpn-client.tar.gz
-  - Save ''sepia/ca.crt'' somewhere
-  - Run ''sudo ./sepia/new-client USER@HOST''
-    - Replace ''USER@HOST'' with your desired username and machine description.  (e.g., dgalloway@laptop)
-  - In Viscosity, under the Authentication tab, set:
-    - **Authentication:** SSL/TLS Client
-    - Check **Use Username/Password authentication**
-    - **CA:** to the ca.crt file you saved earlier
-    - **Tls-Auth:** ta.key
-  - When connecting to the VPN for the first time,
-    - Enter your ''USER@HOST'' combination as the username
-    - Enter the second line of ''sepia/secret'' as the password
-  - Save the credentials to your keychain
-  - You can now delete any downloaded and created files (except ca.crt)
-===== A Note About DNS =====
-Due to complexities around adding nameservers to various Linux distro VPN clients, our OpenVPN server does not use the [[https://openvpn.net/index.php/open-source/documentation/howto.html#dhcp|dhcp-option DNS]] option.
-Instead, we serve our private DNS records publicly.  Your machine should be able to resolve hostnames under the ''sepia.ceph.com'' subdomain automatically.
-If you're using dnsmasq, you can add ''server=/sepia.ceph.com/172.21.0.1'' to ''/etc/dnsmasq.conf''.