Hello, -I'm using the windows version of OpenVPN, most up to date (2.2.2) -I'm using auth-user-pass to remove the need for me to type in a username/password -I store my password in plaintext. You may think this is bad, but I've been doing it for over a year with NO PROBLEMS. If someone were to get my password, I'd just change it - so please don't lecture me on it. I've been using OpenVPN for quite some time now. I've ALWAYS installed OpenVPN with the default install I've recently just switched VPN service providers. For the last two providers I used (all the way up to 2.2.2) and I'm noticing a problem. Not sure if its due to using different certificate files and encryption but: My problem: -Even with auth-user-pass and having this within in plaintext: username password -I still get prompted for a password EVEN BEFORE my OpenVPN GUI attempts to connect to the server. Therefore the issue must be clientside. Why am I having this problem? One of my configs: client dev tun proto tcp-client remote port dh ca cert key cipher DES-CBC ns-cert-type server resolv-retry infinite nobind persist-key persist-tun reneg-sec 0 win-sys 'env' route-method exe route-delay 2 redirect-gateway def1 comp-lzo verb 1 mute 20 keepalive 20 120 auth-user-pass I must repeat: THE ONLY PROBLEM I'M HAVING is that my openvpn GUI PROMPTS ME for a password, even though it is in the file appropriately. I can connect to the server just fine, I'm annoyed by having to type in my password.

it complains about the fact that your PEM file does not seem to be a valid private key; open the file using a text editor and look for blocks similar to [code]-----BEGIN RSA PRIVATE KEY----- MIICXQIBAAKBRtC+Tk4cW2Au4RDSr/SJ0agbgtcNzRNbi/BCcktyK1Qa2qoBK1/B ..... -----END RSA PRIVATE KEY----- [/code] PS Do [b]NOT[/b] post your private key here !

[SOLVED] Using auth-user-pass prompt for password

Veego

Hello,

-I'm using the windows version of OpenVPN, most up to date (2.2.2)
-I'm using auth-user-pass to remove the need for me to type in a username/password
-I store my password in plaintext. You may think this is bad, but I've been doing it for over a year with NO PROBLEMS. If someone were to get my password, I'd just change it - so please don't lecture me on it.

I've been using OpenVPN for quite some time now. I've ALWAYS installed OpenVPN with the default install

I've recently just switched VPN service providers. For the last two providers I used (all the way up to 2.2.2) and I'm noticing a problem.
Not sure if its due to using different certificate files and encryption but:

My problem:
-Even with auth-user-pass <filename> and having this within <filename> in plaintext:
username
password

-I still get prompted for a password EVEN BEFORE my OpenVPN GUI attempts to connect to the server. Therefore the issue must be clientside.

Why am I having this problem?

One of my configs:
client
dev tun
proto tcp-client
remote <server address>
port <the port I use>
dh <a filename>
ca <a filename>
cert <a filename>
key <a filename>
cipher DES-CBC
ns-cert-type server
resolv-retry infinite
nobind
persist-key
persist-tun
reneg-sec 0
win-sys 'env'
route-method exe
route-delay 2
redirect-gateway def1
comp-lzo
verb 1
mute 20
keepalive 20 120
auth-user-pass <filename with extension>

I must repeat: THE ONLY PROBLEM I'M HAVING is that my openvpn GUI PROMPTS ME for a password, even though it is in the file appropriately.
I can connect to the server just fine, I'm annoyed by having to type in my password.

janjust

most likely the private key is protected using a passphrase, which would cause the openvpn GUI to ask for a password. you can remove such a passphrase using openssl (which is installed together with OpenVPN):

openssl rsa -in privkey.pem -out newprivkey.pem

Veego

I tried to modify the pem file with:

openssl.exe rsa -in <directory>\<filename>.pem -out <directory>\<different filename>.pem

I received the following error:
WARNING: can't open config file: c:/openssl/ssl/openssl.cnf
unable to load Private Key
2044:error:0906D06C:PEM routines:PEM_read_bio:no start line:.\crypto\pem\pem_lib.c:696:Expecting: ANY PRIVATE KEY

janjust

it complains about the fact that your PEM file does not seem to be a valid private key; open the file using a text editor and look for blocks similar to

-----BEGIN RSA PRIVATE KEY-----
MIICXQIBAAKBRtC+Tk4cW2Au4RDSr/SJ0agbgtcNzRNbi/BCcktyK1Qa2qoBK1/B
.....
-----END RSA PRIVATE KEY-----

PS Do NOT post your private key here !

Veego

Okay I've located it. Now what do I do?
It looks similar

janjust

now run the openssl command on it.

Veego

Okay I'm guessing you want me to do this:

<directory>\openssl.exe rsa -in <my entire private key in the .pem file> -out <directory>/<new .pem file>

I received the following error: (by the way, I don't understand why it automatically decides to refer to "c:/openssl/ssl/openssl.cnf" - that directory doesn't even exist)
WARNING: can't open config file: c:/openssl/ssl/openssl.cnf
Error opening Private Key <my private key>','rb')
1208:error:20074002:BIO routines:FILE_CTRL:system lib:.\crypto\bio\bss_file.c:400:
unable to load Private Key

Also, please remember that I also did attempt to -in <the pem file itself>

Any ideas?

P.S. the < and > aren't things I actually included, just so make this readable for you.

janjust

you can ignore the openssl.cnf warning; the fact that it cannot load the private key is more worrisome...

the private key file should contain ONLY the BEGIN RSA / END RSA blob.

Veego

Hey Janjust, I realized I was making a mistake earlier in using the wrong file. The VPN I'm using gave me a few different files and when I glanced at the .pem file I didn't realize it said "-----BEGIN DH PARAMETERS-----" and "-----END DH PARAMETERS-----"

I tried another file, this type with a .key extension and this file actually had the "-----BEGIN RSA PRIVATE KEY-----" and "-----END RSA PRIVATE KEY-----" - openssl.exe was able to recognize it.

Thanks for all the help 🙂
My apologies for the mix-up.

P.S. I noticed when it said "Enter pass phrase for <directory>\<filename>.key:" that it wouldn't actually show the text I was typing in. Made me mess up a few times, didn't think it was working - but I typed it in right the 3rd time and it successfully wrote the modified file.

janjust

Good to hear that - closing topic