michael.schefczyk Dear All, My experience with OpenVPN is extremely positive in general. I use it with pfSense firewalls for site-to-site VPN as well as for remote access. I am also glad to see that 2.4 brings new ciphers and other features. Thanks to the developers for that! What horrifies me is that the new Windows OpenVPN GUI does contain a "Save password" checkbox. We are using client certificates which are password protected. It is nice to use "auth-nocache" in the configuration but this is no longer useful if less security minded users can just check to save their password. Then anyone with physical access to the machine can start the VPN connection. Is there a way to disable "Save password"? Regards, Michael
michael.schefczyk Dear TinCanTech, Thank you very much for pointing this out to me! I would add a comment if I knew how to deal with responding to a mailing list message which I did not receive for not being part of the list. In general, I find it not sufficiently careful to depend on user cooperation in a security sensitive software. For that reason, I do never work with network-manager-openvpn-gnome on debian desktops because that does always keep the private key password. On debian, I rather use sripts. The only safe workaround which comes to my mind right now is to setup one time passwords in addition. Probably, that is a good idea anyway. I just hope that users will not be too insulted by the complexity. Regards, Michael
