请问HN：各位代理机构/托管服务提供商，你们是如何管理多个客户的VPN访问的？
嗨，HN，
我们是一家软件开发公司，客户遍布欧洲。由于我们产品的性质，许多客户需要连接到他们的VPN，以提供支持和进行维护。大多数情况下，我们无法安装自己的VPN。
这导致我们的一些开发人员需要管理超过20个不同的VPN，所有这些VPN都是与不同客户相关的（有时版本不兼容，Fortinet你在看着我），并且有不同的凭证、过期时间、令牌等。有些VPN几个月都没有使用，结果在最需要它们修复生产环境故障时才发现它们已经损坏。对我们来说，这已经变得一团糟。
所以我想问的第一个问题是：这是一个比较常见的问题，还是只有我们遇到这个问题？如果是的话，你们是如何解决的？我一直在寻找工具来简化这个过程，但还没有找到合适的。
话虽如此，我们已经探索了一个想法一段时间：基本上是在现有VPN之上建立一个控制层。一个虚拟化框架，让VPN客户端在由控制平面管理的容器中运行。用户只需安装一个客户端连接到我们的VPN层，然后选择要连接的端点。这也会开启其他可能性，比如全面的连接审计、快速的离职处理、更好的一次性密码管理、过期通知等。当然，我们会设计成零知识，以避免安全问题。
目前仍处于早期阶段，老实说，我们不确定这是否真的是一个普遍存在的问题，还是仅限于我们所见的几个环境。
欢迎告诉我这个想法愚蠢（但我希望知道原因），或者讨论我们尚未考虑的潜在问题。
查看原文
Hi HN,<p>we're a software development agency with several clients scattered across Europe. Due to the nature of our products many require to connect to the client's VPN to offer assistance and perform maintenance. Most times we can't install our own VPN.<p>This has led to some of our devs needing to manage more than 20 different VPNs, all with different clients (sometimes with incompatible versions, looking at you Fortinet), credentials, expirations, tokens and such.
Some of those get unused for months, only to discover they're broken when you most need them to fix an outage in production. For us, it has become a mess.<p>So the first question for you: Is this a fairly common problem or is this just us? If it is, did you solve it in any way?
I've been looking for tools to streamline this but haven't found anything.<p>That said, we’ve been exploring an idea for a while: basically a control layer on top of existing VPNs. A sort of virtualization framework where vpn clients run on containers managed by the control plane.
Users would only then have one client to our VPN layer installed and just decide which endpoint to connect to.
This would also open up other possibilities like full connection audits, quick offboarding, better OTP management, expiration notifications.
Of course we would design it to be zero knowledge to avoid security issues.<p>Still very early and we’re honestly not sure if this is actually a widespread pain or just limited to the few environments we’ve seen.<p>Happy to be told this is dumb (but I'd like to know why) or to discuss potential problems we haven't considered yet.