OpenVpn Server Disable MasterKey at start

Veeh

Hi,

I've look around internet a bit about my issue, and I found a lot of similar problem for client but not for server sadly.

When I start my vpn server a prompt ask me the server master key.
I've this message:

Broadcast message from root@Stargate (Thu 2020-07-09 19:26:03 UTC):

Password entry required for 'Enter Private Key Password:' (PID 2272).
Please enter password with the systemd-tty-ask-password-agent tool!

I can shorten this prompt by adding "askpass" in the server.conf
But I still need to enter the server master key to allow my vpn server to start.

When I add the password in a file to pass it with server.conf I got this error

Thu Jul  9 19:31:26 2020 us=237928 library versions: OpenSSL 1.0.2k-fips  26 Jan 2017, LZO 2.06
Thu Jul  9 19:31:26 2020 us=238254 Error opening 'Private Key' auth file: srvmkey.key: Permission denied (errno=13)

Either with "askpass srvmkey.key" in server.conf
or "--askpass srvmkey.key" in /usr/lib/systemd/system/openvpn@.service
I got the same issue.

I tryed to go around it with a bash script, so far no success.

Is there a way to disable this password ? Or can I add a line in my server.conf to allow askpass to read my password from a file ?

Thanks for your help.

Cheers
Veeh.

TinCanTech

Veeh wrote ve look around internet a bit about my issue, and I found a lot of similar problem for client but not for server sadly

It is the same for server as it is for client.

300000

Veeh wrote Hi,

I've look around internet a bit about my issue, and I found a lot of similar problem for client but not for server sadly.

When I start my vpn server a prompt ask me the server master key.
I've this message:
Broadcast message from root@Stargate (Thu 2020-07-09 19:26:03 UTC):

Password entry required for 'Enter Private Key Password:' (PID 2272).
Please enter password with the systemd-tty-ask-password-agent tool!
I can shorten this prompt by adding "askpass" in the server.conf
But I still need to enter the server master key to allow my vpn server to start.

When I add the password in a file to pass it with server.conf I got this error
Thu Jul  9 19:31:26 2020 us=237928 library versions: OpenSSL 1.0.2k-fips  26 Jan 2017, LZO 2.06
Thu Jul  9 19:31:26 2020 us=238254 Error opening 'Private Key' auth file: srvmkey.key: Permission denied (errno=13)
Either with "askpass srvmkey.key" in server.conf
or "--askpass srvmkey.key" in /usr/lib/systemd/system/openvpn@.service
I got the same issue.

I tryed to go around it with a bash script, so far no success.

Is there a way to disable this password ? Or can I add a line in my server.conf to allow askpass to read my password from a file ?

Thanks for your help.

Cheers
Veeh.

if you dont like to input pass every time start your server you can make a file contain your password and add to your config . it shoud work for you

askpass "/etc/openvpn/stdin.txt"

adding askpass and the full path to the file . inside stdin.txt contain your password and it will do the job.

if you want to remove password from private key just install XCA from internet . import you key and export without password so you can get risk of password

Veeh

Hi,

Thanks for your advises.
askpass "/etc/openvpn/stdin.txt" didn't do the trick as I said in my original post, I tried different file format and each time openvpn crash at start.
I reinstalled it and didn't set a passphrase for my server.crt
It's all good now.

Cheers