Security Concerns

[khris2fer74]

Hello, I've come across a couple of security concerns with the Softether VPN Server
1. Old TLS versions by default TLS 1.0 and TLS 1.1 are enabled by default but there is a step that can be taken to disable the old protocols and leave 1.2 and 1.3 enabled.

2. Also by default if you go to https://yourpublicipaddress:5555 or whatever port your sever is on in a browser it displays this in a webpage

SoftEther VPN Server / Bridge
For VPN users:

Connect to this VPN Server
by Official SoftEther VPN Client (download)
by L2TP/IPsec, OpenVPN or SSTP traditional clients
For VPN administrators:

Manage this VPN Server or VPN Bridge
by SoftEther VPN Server Manager GUI for Windows / macOS (download) (Recommended)
by SoftEther VPN Command Line Management Utility (vpncmd) for CUI
by JSON-RPC API from your favorite programming language (JavaScript, TypeScript, Java, Python, Ruby, C#, ... etc.)
(ID: 'administrator', Password: same to the VPN Server's password. Default: empty)
by Built-in HTML5 Web Administration Console (New, under construction)
(ID: 'administrator', Password: same to the VPN Server's password. Default: empty)

If you want to disable this embedded web server and JSON-RPC server:
Stop the daemon.
Modify the value of "bool DisableJsonRpcWebApi" from "false" to "true" on the vpn_server.config or vpn_bridge.config.
Restart the daemon.

Which I don't like cause it advertises what VPN software you're using. All they need now is to get the client and start trying to login at the bottom of the page it tells how to disable this.

So those are 2 security issues I see. Does anyone know of anything else that should be disabled to harden the security a bit more or turn off anything that's vunerable?

[solo]

Enable anti-MitM.
https://www.softether.org/4-docs/1-manu ... rification
https://www.softether.org/4-docs/1-manu ... entication

Enable TunnelCrack protection.
https://www.softether.org/9-about/News/905-TunnelCrack

Pick chained ciphers.
viewtopic.php?t=68790

Adapt VPN Gate packet filtering rules.
viewtopic.php?f=7&t=68039#p97841

Apply IP Access Control List.
https://www.softether.org/4-docs/1-manu ... ntrol_List

Consider VPN Gate's "Deny Bridge Operation policy" option.
https://www.softether.org/4-docs/1-manu ... licy_Items
(this would make some users cry, LOL viewtopic.php?t=70058 and viewtopic.php?t=70105 )

While at it, for other reasons disable DDnsClient and NatTraversal if you don't need them.
viewtopic.php?f=7&t=67838#p97405

[Aleksas123]

Would it also make sense to restrict management access to trusted IPs at the firewall level, especially if the server is directly exposed to the internet?

[solo]

For sure if it's on non-443 port.
viewtopic.php?p=104455

[khris2fer74]

I hear what you're saying about not being on port 443 and it being "not encrypted" however when I run a packet sniffer running on port 5329 connecting directly to the server with the Server Manager I'm getting that the traffic is TLSv1.3 why would that be if it isn't encrypted. I also reached out to one of the contributors of the software from Japan asking this very question and this is what they came back with... my question and the reply

Hello, I have already reached out to the forums and I'm not sure if I got a clear answer so I thought I"d reach out to ask 1 quick question. Does the VPN Server Manager encrypt communication between that and the server over a network by default even if it's not using port 443? Just looking for an answer as if this is a security issue managing our customers servers I didn't want to manage them this way. It's just really convenient to be able to do it this way. Thank You

Hi,



The answer is yes — and no.



Communication between VPN Server Manager and the VPN Server is encrypted

with SSL by default, regardless of the port number used (it does not

have to be 443).



However, VPN Server Manager does not perform server certificate

verification. As a result, while the traffic is encrypted, it is not

protected against man-in-the-middle (MITM) attacks.



So from a strict security standpoint, this method is convenient but

should not be considered fully secure on untrusted networks.



Regards,

--

************, operations section of SoftEther Corporation.

So it looks to be encrypted evidence of the results of the packet sniffer and confirmed by one of the contributors of the software.
I understand you're very knowledgeable about the software & you have helped me greatly. From what I posted is it not evident that the connection is encrypted? Or am I missing something? I'm pretty open minded and I'll listen if you have any way to show otherwise. Thank You.

[solo]

You are missing SE version numbers.

In my example viewtopic.php?p=104455#p104454 it is evident beyond any dispute that Server Manager of PacketiX.NET on port 443 is encrypted but on port 992 is not. Note the following...

.

server info.png

.

So, my Server Manager v4.44 connecting to JP PacketiX.NET SE server v4.41 (compiled in 2022) is just like that. Your context is different because SE software changes over time.

Now, here is the simplest, most secure and confusion-free solution. Implement all of the above security-hardening options, especially the anti-MitM, chained ciphers, IP Access Control List, etc., start your VPN and connect Server Manager on LAN address. Ain't it perfect? :-)

[khris2fer74]

OK then, that was never mentioned. I know you know your stuff so I was wanting to make sure that our traffic was encrypted. So for conformation you're saying that any port with Softether Server manager especially the newest versioin 4.44 should be encrypted regardless of the port number? I knew I wasn't crazy the tests were showing otherwise. Have you not tested this with 4.44? I just assumed you would be on the newest version being that it's been out for more than a year. Anyway I appreciate your contribution to the software you've helped me through several issues. I'm going to go through the list and keep hardening the security.

If I could request anything it would be to be able to mix and match the security options like combining a certificate authenication with a password, and natively be able to disallow password saves when using Domain authenication, otherwise it's great software to be free. As always thanks for your time and input.