Firstly: Thank you for your reply.
The openvpn-service itself runs under the system user, yes. But according to
this article, the interactive service does, too.
And you don't need an administrator account for the 2.3 gui. You just need to give your users privileges to start and stop the openvpn-service. Subinacl is all you need for that.
In that case I (sincerely) don't understand the difference.
I'll look into integrating the interactive service, maybe I missed something there.
