On my GNU/Linux system I use
pass as a command-line password manager. This tool can be invoked so that it outputs to stdout a username and password (on two separate lines) for a given VPN connection. However, I can't get this to work with the
openvpn command-line client.
According to the man page, the
--auth-user-pass option can be used to enter a username and password. It can take as its optional argument the name of a file containing the username and password on separate lines, or if the argument is omitted it is supposed to read these values from the console. The documented behaviour works when specifying the filename, but if I omit the argument and direct a file or a pipe to stdin, the client just hangs, and if I manually kill the proces it outputs the error "Failed retrieving username or password".
Why isn't
openvpn reading from stdin? I'd much rather that I pipe the output of
pass directly to
openvpn, as this way I don't need to leave my credentials on the file system in plaintext. Is it possible there's something in my client configuration
foo.ovpn (see anonymized version below) which is incompatible with this feature?
client
dev tun
proto udp
remote vpn.example.com 1198
resolv-retry infinite
nobind
persist-key
persist-tun
cipher aes-128-cbc
auth SHA1
tls-client
remote-cert-tls server
comp-lzo
verb 1
reneg-sec 0
crl-verify crl.rsa.2048.pem
ca ca.rsa.2048.crt
disable-occ
To reiterate, what I want to be able to do is to run
pass foo | openvpn --config foo.ovpn --auth-user-pass
but this simply emits OpenVPN's welcome message and then hangs. The same thing happens if I first redirect the output of pass to a file and then try to get openvpn to read it via stdin:
pass foo > foo_credentials.txt
openvpn --config foo.ovpn --auth-user-pass < foo_credentials.txt
However, if I pass the credentials file as an argument to
--auth-user-pass, then everything works fine:
pass foo > foo_credentials.txt
openvpn --config foo.ovpn --auth-user-pass foo_credentials.txt
A previous thread here describing the same problem suggests using
--auth-retry nointeract but this has no effect for me.
Further information:
openvpn --version
OpenVPN 2.4.9 x86_64-suse-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 16 2020
library versions: OpenSSL 1.1.1g 21 Apr 2020, LZO 2.10
Originally developed by James Yonan
Copyright (C) 2002-2018 OpenVPN Inc <sales@openvpn.net>
Compile time defines: enable_async_push=no enable_comp_stub=no enable_crypto=yes enable_crypto_ofb_cfb=yes enable_debug=yes enable_def_auth=yes enable_dependency_tracking=no enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=needless enable_fragment=yes enable_iproute2=yes enable_libtool_lock=yes enable_lz4=yes enable_lzo=yes enable_management=yes enable_multihome=yes enable_pam_dlopen=no enable_pedantic=no enable_pf=yes enable_pkcs11=yes enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_small=no enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=yes enable_werror=no enable_win32_dll=yes enable_x509_alt_username=yes with_aix_soname=aix with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_sysroot=no
