I'm trying to start a client on Linux (NixOS) using systemd: [code]systemctl start openvpn-myclient.service[/code] My private key has a passphrase, but I'm not being prompted for it. Running systemctl status shows systemd-ask-password waiting for input: [code] systemctl status openvpn-myclient.service ● openvpn-myclient.service - OpenVPN instance ‘myclient’ ... CGroup: /system.slice/openvpn-myclient.service ├─11060 openvpn --suppress-timestamps --config /nix/store/...-openvpn-config-myclient └─11061 /nix/store/...-systemd-238/bin/systemd-ask-password --icon network-vpn Enter Private Key Password: [/code] If I run openvpn directly on the command line, I am prompted for a password and all works as expected. [code]sudo openvpn --config /nix/store/...-openvpn-config-myclient[/code] I tried adding askpass to my client config, but that didn't make a difference. So far the only way I've found to successfully start the client using systemctl is by adding askpass /path/to/myprivate.key to the client config, but this means keeping the pass phrase in a plaintext file. I found an old bug-ticket reporting the same issue, but it's been marked resolved and it sounds like this was fixed in version 2.3.4 (I'm running 2.4.6). https://community.openvpn.net/openvpn/ticket/437 Though it sounds like the fix requires that openvpn is built using --enable-systemd, mine was built with that option enabled. I'd be grateful if anyone can point me in the right direction. I'd be happy to post my client config if that helps.

Starting client via systemctl: no passphrase prompt shown

roboboticus

I'm trying to start a client on Linux (NixOS) using systemd:

systemctl start openvpn-myclient.service

My private key has a passphrase, but I'm not being prompted for it.
Running systemctl status shows systemd-ask-password waiting for input:

systemctl status openvpn-myclient.service
● openvpn-myclient.service - OpenVPN instance ‘myclient’
   ...
   CGroup: /system.slice/openvpn-myclient.service
           ├─11060 openvpn --suppress-timestamps --config /nix/store/...-openvpn-config-myclient
           └─11061 /nix/store/...-systemd-238/bin/systemd-ask-password --icon network-vpn Enter Private Key Password:

If I run openvpn directly on the command line, I am prompted for a password and all works as expected.

sudo openvpn --config /nix/store/...-openvpn-config-myclient

I tried adding askpass to my client config, but that didn't make a difference.
So far the only way I've found to successfully start the client using systemctl is by adding askpass /path/to/myprivate.key to the client config, but this means keeping the pass phrase in a plaintext file.

I found an old bug-ticket reporting the same issue, but it's been marked resolved and it sounds like this was fixed in version 2.3.4 (I'm running 2.4.6).
https://community.openvpn.net/openvpn/ticket/437

Though it sounds like the fix requires that openvpn is built using --enable-systemd, mine was built with that option enabled.

I'd be grateful if anyone can point me in the right direction. I'd be happy to post my client config if that helps.

TinCanTech

roboboticus wrote If I run openvpn directly on the command line, I am prompted for a password and all works as expected.

How are you trying to start openvpn when it fails to show the password prompt ?

roboboticus

TinCanTech wrote How are you trying to start openvpn when it fails to show the password prompt ?

The cases where I'm not prompted for my private key's passphrase are:

systemctl start openvpn-myclient.service

and

sudo systemctl start openvpn-myclient.service

In the first case (without sudo), I am prompted for my user password (for my user account on the OS, not for the vpn) by a graphical prompt. I've tried entering the private key passphrase here to confirm that it's not accepted, whereas my OS password is.

In the second case (with sudo), I am prompted for my user password (for the OS, not the vpn) on the command line, same as for any sudo command. No further prompt, graphical or terminal, is shown to input my private key's passphrase.

I guess I was expecting to be prompted twice, once for my OS password and again for the vpn passphrase.

While it's convenient to avoid these prompts, I'd like to know if there's a more secure way I could set it up. I'm also curious if there's a way to get the passphrase prompt to show up.

TinCanTech

roboboticus wrote I'm trying to start a client on Linux (NixOS) using systemd:

Did you build openvpn yourself ?

I am using ubuntu1804 and it works normally for me:

me@home:~$ sudo systemctl start openvpn-client@defaultc
[sudo] password for me@home: 
Enter Private Key Password: ***
me@home:~$ sudo systemctl status openvpn-client@defaultc
● openvpn-client@defaultc.service - OpenVPN tunnel for defaultc
   Loaded: loaded (/lib/systemd/system/openvpn-client@.service; disabled; vendor preset: enabled)
   Active: active (running) since Sat 2018-05-19 17:01:55 BST; 11s ago
     Docs: man:openvpn(8)
           https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
           https://community.openvpn.net/openvpn/wiki/HOWTO
 Main PID: 2888 (openvpn)
   Status: "Initialization Sequence Completed"
    Tasks: 1 (limit: 252)
   CGroup: /system.slice/system-openvpn\x2dclient.slice/openvpn-client@defaultc.service
           └─2888 /usr/sbin/openvpn --suppress-timestamps --nobind --config defaultc.conf

May 19 17:01:56 tct@ub18 openvpn[2888]: Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
May 19 17:01:56 tct@ub18 openvpn[2888]: ROUTE_GATEWAY 10.10.201.1/255.255.255.0 IFACE=eth0 HWADDR=00:15:5d:c9:6e:0c
May 19 17:01:56 tct@ub18 openvpn[2888]: TUN/TAP device tun108 opened
May 19 17:01:56 tct@ub18 openvpn[2888]: TUN/TAP TX queue length set to 100
May 19 17:01:56 tct@ub18 openvpn[2888]: do_ifconfig, tt->did_ifconfig_ipv6_setup=1
May 19 17:01:56 tct@ub18 openvpn[2888]: /sbin/ip link set dev tun108 up mtu 1500
May 19 17:01:56 tct@ub18 openvpn[2888]: /sbin/ip addr add dev tun108 local 10.8.0.186 peer 10.8.0.185
May 19 17:01:56 tct@ub18 openvpn[2888]: /sbin/ip -6 addr add 12fc:1918::10:8:0:186/112 dev tun108
May 19 17:01:56 tct@ub18 openvpn[2888]: /sbin/ip route add 10.8.0.0/24 via 10.8.0.185
May 19 17:01:56 tct@ub18 openvpn[2888]: Initialization Sequence Completed

roboboticus

TinCanTech wrote Did you build openvpn yourself ?

I didn't compile it myself, but I installed binary that was built for NixOS (from this derivation).

Running `openvpn --version` shows that "enable_systemd=yes" is among the "Compile time defines".

$ openvpn --version | grep -oP 'enable_systemd=\S+'
enable_systemd=yes

The full list (maybe we could compare?):

$ openvpn --version | grep -oP 'Compile time defines: \K.+' | tr ' ' '\n'
enable_async_push=no
enable_comp_stub=no
enable_crypto=yes
enable_crypto_ofb_cfb=yes
enable_debug=yes
enable_def_auth=yes
enable_dependency_tracking=no
enable_dlopen=unknown
enable_dlopen_self=unknown
enable_dlopen_self_static=unknown
enable_fast_install=yes
enable_fragment=yes
enable_iproute2=yes
enable_libtool_lock=yes
enable_lz4=yes
enable_lzo=yes
enable_management=yes
enable_multihome=yes
enable_pam_dlopen=no
enable_pedantic=no
enable_pf=yes
enable_pkcs11=no
enable_plugin_auth_pam=yes
enable_plugin_down_root=yes
enable_plugins=yes
enable_port_share=yes
enable_selinux=no
enable_server=yes
enable_shared=yes
enable_shared_with_static_runtimes=no
enable_small=no
enable_static=no
enable_strict=no
enable_strict_options=no
enable_systemd=yes
enable_werror=no
enable_win32_dll=yes
enable_x509_alt_username=no
with_aix_soname=aix
with_crypto_library=openssl
with_gnu_ld=yes
with_mem_check=no
with_sysroot=no

The full output of --version:

$ openvpn --version
OpenVPN 2.4.6 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Apr 24 2018
library versions: OpenSSL 1.0.2o  27 Mar 2018, LZO 2.10
Originally developed by James Yonan
Copyright (C) 2002-2018 OpenVPN Inc <sales@openvpn.net>
Compile time defines: enable_async_push=no enable_comp_stub=no enable_crypto=yes enable_crypto_ofb_cfb=yes enable_debug=yes enable_def_auth=yes enable_dependency_tracking=no enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=yes enable_fragment=yes enable_iproute2=yes enable_libtool_lock=yes enable_lz4=yes enable_lzo=yes enable_management=yes enable_multihome=yes enable_pam_dlopen=no enable_pedantic=no enable_pf=yes enable_pkcs11=no enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_small=no enable_static=no enable_strict=no enable_strict_options=no enable_systemd=yes enable_werror=no enable_win32_dll=yes enable_x509_alt_username=no with_aix_soname=aix with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_sysroot=no

I'm running a Gnome3 desktop environment -- not sure if that's relevant.

TinCanTech

roboboticus wrote I didn't compile it myself, but I installed binary that was built for NixOS (from this derivation).

I think you will need to ask on that link ..

AFAICS Openvpn is working but your systemd-ask-password does not appear to connect to your interactive session, the systemctl status shows that here:

roboboticus wrote systemctl status openvpn-myclient.service
● openvpn-myclient.service - OpenVPN instance ‘myclient’
...
CGroup: /system.slice/openvpn-myclient.service
├─11060 openvpn --suppress-timestamps --config /nix/store/...-openvpn-config-myclient
└─11061 /nix/store/...-systemd-238/bin/systemd-ask-password --icon network-vpn Enter Private Key Password:

My details:

/usr/sbin/openvpn --version
OpenVPN 2.4.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 10 2018
library versions: OpenSSL 1.1.0g  2 Nov 2017, LZO 2.08
Originally developed by James Yonan
Copyright (C) 2002-2017 OpenVPN Technologies, Inc. <sales@openvpn.net>

/usr/sbin/openvpn --version | grep defines | tr ' ' '\n'
Compile
time
defines:
enable_async_push=no
enable_comp_stub=no
enable_crypto=yes
enable_crypto_ofb_cfb=yes
enable_debug=yes
enable_def_auth=yes
enable_dependency_tracking=no
enable_dlopen=unknown
enable_dlopen_self=unknown
enable_dlopen_self_static=unknown
enable_fast_install=needless
enable_fragment=yes
enable_iproute2=yes
enable_libtool_lock=yes
enable_lz4=yes
enable_lzo=yes
enable_maintainer_mode=no
enable_management=yes
enable_multihome=yes
enable_pam_dlopen=no
enable_pedantic=no
enable_pf=yes
enable_pkcs11=yes
enable_plugin_auth_pam=yes
enable_plugin_down_root=yes
enable_plugins=yes
enable_port_share=yes
enable_selinux=no
enable_server=yes
enable_shared=yes
enable_shared_with_static_runtimes=no
enable_silent_rules=no
enable_small=no
enable_static=yes
enable_strict=no
enable_strict_options=no
enable_systemd=yes
enable_werror=no
enable_win32_dll=yes
enable_x509_alt_username=yes
with_aix_soname=aix
with_crypto_library=openssl
with_gnu_ld=yes
with_mem_check=no
with_sysroot=no

systemd --version
systemd 237
+PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD -IDN2 +IDN -PCRE2 default-hierarchy=hybrid

roboboticus

TinCanTech wrote I think you will need to ask on that link ..

Ok cool, I'll do that. Thanks for the help, I really appreciate it. I'm still finding my way around Linux (and systemd, Gnome, etc.), so knowing the right question to ask helps a lot. The interaction (or lack thereof) between sytemd-ask-password and my interactive session does seem to be where things go wrong.

I'll post back if I find a solution.

TinCanTech

Please see:
https://nixos.org/nixos/manual/index.html#idm140737325829152