melnikovpetr
Dear Colleagues,
please could you advise how can i avoid storing a password for BindDN in an openvpn-auth-ldap plugin config file (as this is completely insecure)
openvpn runs as a systemd unit with 'user=openvpn' and 'group=openvpn', so if i specify the BindDN password in the plugin config file, then the 'openvpn' user should be able to read the config file. And then, if a badass does hack the openvpn process, he gets access to the config file storing password for reading AD/domain = that's bad.
please could you help me to deal with these questions:
1. how to avoid storing BindDN password in an openvpn-auth-ldap plugin config file?
2. how to pass this password to systemd unit (without storing this as a plain text in a running process command line, which every user can read then)
3. how to pass this password from pacemaker resource config (as pacemaker commands i run with sudo, i belive i can limit access to its config files for root only)
thanks in advance!!!
