Re: [Openvpn-users] OpenVPN GUI

["John A. Sullivan III" <jsullivan@xxxxxxxxxxxxxxxxxxx>]

On Thu, 2006-08-03 at 18:14 -0300, Andrew And wrote:
>  
>  I am using "openvpn-2.0.7-gui-1.0.3-install.exe" and I am using in
> winXP when I am like ADMINISTRATOR. But I need to use OpenVPN
> with users differents of the administrator, how can I use OpenVPN Gui
> with users differents of the administrator?
>  
<snip>
We encountered the same issue for one of the clients for whom we were
creating a highly secure environment using the ISCS open source network
security management project (http://iscs.sourceforge.net).  After using
it to restrict all LAN and Remote Access to as needed access using ISCS,
we did not want to open the door by having users running with admin
privileges.  This is from an old internal engineering document of ours:

We were dissatisfied with the some of the user limitations of OpenVPN.
If the user did not have administrator privileges, we seemed to be left
with two choices:

     1. Install OpenVPN as a service. This has two major disadvantages –
        all the configs are started at once which eliminates the ability
        to choose individual configurations and one cannot encrypt and
        password protect the private key. It also requires using
        something like subinctl to give the user the ability to control
        the service.
        
     2. Allow a standard user to run OpenVPN using the RunAs feature.
        This requires entering the administrator password every time
        OpenVPN is started on Win2K. One can save the password in XP but
        it creates a security hole where users can potentially run other
        applications as the administrator.
        

We worked around all these problems by using CPAU from
http://www.joeware.net/win/free/tools/cpau.htm which allows us to
encrypt the administrator password and use it only for OpenVPN. The
OpenVPN installation must be run as an administrative user. The user is
prompted if they want to run OpenVPN as a different (non-privileged)
user. If so, they are prompted for the administrative user's password
and the non-privileged user's ID. We install CPAU to the user's computer
and then, during the installation routine, run the command:

CPAU.exe -u <administrator user> -p <administrator password> -enc -hide
-file OpenVPN.cpau -ex openvpn-gui.exe

We then run OpenVPN from a batch file placed on the user's desktop and
start menu which consists of the following single line:

"C:\Program Files\openvpn\bin\CPAU.exe" -lwop -dec -file "C:\Program
Files\openvpn\bin\OpenVPN.cpau"

This allows the non-privileged user to run OpenVPN as a privileged user
(and thus able to set OpenVPN routes as needed) without the above
mentioned limitations. They can start and stop individual configurations
and use encrypted private keys.


We also wrote the installer scripts to prompt for the admin password,
handle all the CPAU stuff automatically and do all kinds of neat things.
If you'd like, I can post the installer file although it is quite long.
I'll also be away starting tomorrow and so probably can't do so until
Monday.  Good luck - John
-- 
John A. Sullivan III
Open Source Development Corporation
+1 207-985-7880
jsullivan@xxxxxxxxxxxxxxxxxxx

Financially sustainable open source development
http://www.opensourcedevel.com

______________________
OpenVPN mailing lists
https://lists.sourceforge.net/lists/listinfo/openvpn-users