Hi guys, my OpenVPN server (verison 2.4.3) is running on a openSUSE Leap 15.1 server. Today I have implemented Google Authentication - it works great. My problem is, that the openvpn process runs as user root. => ps aux | grep vpn [code]openvpn 30964 0.0 0.1 51376 5800 ? Ss 18:53 0:00 /usr/sbin/openvpn --cd /etc/openvpn --daemon --config my-server.conf --askpass /etc/xxxxxxxx/secret.pw root 30965 0.0 0.0 50952 748 ? S 18:53 0:00 /usr/sbin/openvpn --cd /etc/openvpn --daemon --config my-server.conf --askpass /etc/xxxxxxxx/secret.pw[/code] If I remove the line [b]plugin /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so openvpn[/b] in the server.conf and restart the OpenVPN server, I have just one process (with the correct user from the server.conf file). The plugin line is the only thing I have changed in the server.conf. => ps aux | grep vpn without the plugin line [code]openvpn 7850 0.7 0.1 45000 5916 ? Ss 19:10 0:00 /usr/sbin/openvpn --cd /etc/openvpn --daemon --config my-server.conf --askpass /etc/xxxxxxxx/secret.pw[/code] This is the "/etc/pam.d/openvpn" file: [code]auth required /lib64/security/pam_google_authenticator.so secret=/etc/openvpn/google-auth/${USER} user=google-user forward_pass account include common-account[/code] Thanks for your help! :) Christus

[quote=christus post_id=89689 time=1582661522 user_id=49335] That means this configuration is "secure"? [/quote]Define [i]secure[/i] ..

OpenVPN server with Google Authentication runs as root

christus

Hi guys,

my OpenVPN server (verison 2.4.3) is running on a openSUSE Leap 15.1 server.
Today I have implemented Google Authentication - it works great.

My problem is, that the openvpn process runs as user root.

=> ps aux | grep vpn

openvpn  30964  0.0  0.1  51376  5800 ?        Ss   18:53   0:00 /usr/sbin/openvpn --cd /etc/openvpn --daemon --config my-server.conf --askpass /etc/xxxxxxxx/secret.pw
root     30965  0.0  0.0  50952   748 ?        S    18:53   0:00 /usr/sbin/openvpn --cd /etc/openvpn --daemon --config my-server.conf --askpass /etc/xxxxxxxx/secret.pw

If I remove the line plugin /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so openvpn in the server.conf and restart the OpenVPN server, I have just one process (with the correct user from the server.conf file). The plugin line is the only thing I have changed in the server.conf.

=> ps aux | grep vpn without the plugin line

openvpn   7850  0.7  0.1  45000  5916 ?        Ss   19:10   0:00 /usr/sbin/openvpn --cd /etc/openvpn --daemon --config my-server.conf --askpass /etc/xxxxxxxx/secret.pw

This is the "/etc/pam.d/openvpn" file:

auth     required       /lib64/security/pam_google_authenticator.so secret=/etc/openvpn/google-auth/${USER} user=google-user forward_pass
account  include        common-account

Thanks for your help! 🙂
Christus

TinCanTech

christus wrote My problem is, that the openvpn process runs as user root.

=> ps aux | grep vpn

openvpn  30964  0.0  0.1  51376  5800 ?        Ss   18:53   0:00 /usr/sbin/openvpn --cd /etc/openvpn --daemon --config my-server.conf --askpass /etc/xxxxxxxx/secret.pw
root     30965  0.0  0.0  50952   748 ?        S    18:53   0:00 /usr/sbin/openvpn --cd /etc/openvpn --daemon --config my-server.conf --askpass /etc/xxxxxxxx/secret.pw

openvpn is running as user openvpn. The plugin is running as root because openvpn initialises as root before dropping privileges.

christus

OK, thank you!

That means this configuration is "secure"?

TinCanTech

christus wrote That means this configuration is "secure"?

Define secure ..

christus

I mean "secure", because I always read "never run a service as root" and now the plugin runs as root.

Is there a way to run the plugin process as an unprivileged user?

TinCanTech

Openvpn must be initialised as root in order to setup the VPN end points and routing.
Using either --user/--group or --chroot the same is true and openvpn will initialise as root.

You can try this to run as non-root: https://community.openvpn.net/openvpn/wiki/UnprivilegedUser