Other users on my PC have access to GUI and can use VPN

anthgav

If I install the client GUI, the certificates in program files, then potentially another user on my PC can open the GUI and connect to the VPN as the program folder with the client config and certificates are available to all users on the PC. What is the best way to prevent other users on the PC from using the VPN?

george

From the client side:

You can delete the OpenVPN client folder from the startup menu, stop the OpenVPN-gui from starting with Windows so the program must be started from the install location.

From the server side:

Require a username/password for connections.

anthgav

Hi thanks for the reply, does the user/password have to be set when creating the certificates or can the server config file be configured for authetication?

george

I personally use /etc/passwd entries to authenticate VPN users. This causes the client to be prompted for a username/password before the server will accept the connection.

Here's the howto:
http://openvpn.net/index.php/open-source/documentation/howto.html#auth

anthgav

I looked at the "how to" and downloaded the source code and read the "read me" in the "auth-pam" folder, am I right in thinking this can only be used in linux?

My vpn server is on a Windows XP machine, if it is only for linux what are my options for Windows?

gridrun

How about setting proper NTFS permissions on the files and folders :?:

Basically, it's the private key file(s) you need to protect. Only the openVPN service process (if running as a service, usually Local System) or the "owning" user (the one who's supposed to run the GUI) and possibly the admin should have read access to those.

Obviously, the config shouldn't be writable for anyone but the admin or the "owner".