Hacker News new | ask | show | jobs
by peterwwillis 3256 days ago
They are not identical in attack vectors, and OpenVPN has many more capabilities to resist MITM and other attacks, and it resists network failure much more.

OpenSSH uses the SSH protocol and username/password and public keys for auth.

OpenVPN auth uses TLS key exchange, pre-shared keys, and username/password, and uses IPSec's ESP protocol for transport, with custom work to handle multiplexing connections. It can verify HMAC on all packets. It tunnels layer 2 or 3. It won't swap sensitive memory and can utilize SELinux. Since OpenVPN can use static keys and a UDP transport, it can resist network partition much better than OpenSSH.

Of course IPSec is much better than either of them. If you have to do all your tunneling in userland, OpenVPN is a more secure method, but if you don't have tun/tap device access, OpenSSH will get you by with port forwarding (which is what its SOCKS tunnel is, if you don't use its tun/tap device or pppd).