OpenVPN-AS Log Reports Username: local_root ?

boktai1000

Hello all,

On a regular basis I like to review our OpenVPN Access log/Log reports - I have seen occasionally weird logins and our configuration is public facing so it's to be expected.

One thing that I cam across recently, is a user named "local_root" attempted to interface with the OpenVPN-AS via the XML_API, and there's not a whole lot of information to go off of like no error, IP address, etc. I'm assuming this is system related, but I just wanted to double check and maybe understand a bit more with what exactly this means, or if it is possible that it was an external attack on our server.

Let me know if you need any more information, our setup is very traditional/generic as far as Linux OpenVPN-AS setups go.

ops@claresco.com

Hi,
We are seeing the same thing. Does anyone out there have any information?

ops@claresco.com

https://openvpn.net/index.php/access-server/docs/admin-guides-sp-859543150/howto-commands/377-log-database.html

It does appear harmless in our case, some kind of licence and vpn stat collection? But, it would still be nice to know for certain.

$ cd <path-to-openvpn_as>/scripts
$ sudo ./logdba --csv --service_filt=XML_API --columns="+api_method"
<hostname>,local_root,2016.10.26 22:07:25 PDT,,XML_API,LicenseUsage,,1,,,,,,
<hostname>,local_root,2016.10.26 22:08:49 PDT,,XML_API,GetVPNSummary,,1,,,,,,
... 8270+ records snipped ...
<hostname>,local_root,2016.11.10 06:47:38 PST,,XML_API,GetVPNSummary,,1,,,,,,
<hostname>,local_root,2016.11.10 06:48:31 PST,,XML_API,LicenseUsage,,1,,,,,,

The Johan

Most of the scripts in the scripts folder use XML-RPC calls locally to the Access Server daemon to do their work, so it's likely that. Some people run for example scripts to monitor VPNSummary or VPNStatus from sacli on a regular basis.