OpenVPN技术问询：能否加密auth-user-pass参数指定的账号密码文件？

Great question—keeping your OpenVPN credentials out of plaintext is a smart move, and there are several reliable ways to pull this off. Let’s walk through the most practical methods:

1. On-the-Fly Decryption with a Script #

Instead of handing OpenVPN a plaintext file directly, you can use a script that decrypts your encrypted credentials on the fly and feeds them to OpenVPN. Here’s how to set this up with GPG (a widely used encryption tool):

• First, encrypt your plaintext credentials.txt file:

  gpg -c credentials.txt
  

  This will prompt you for a passphrase and create an encrypted credentials.txt.gpg file. Delete the plaintext credentials.txt immediately—no need to leave it lying around.
• Next, create a simple bash script (name it something like decrypt-creds.sh) that handles decryption:

  #!/bin/bash
  gpg --batch --passphrase-fd 0 -d /full/path/to/credentials.txt.gpg
  

  Make the script executable with:

  chmod +x decrypt-creds.sh
  

• Finally, update your OpenVPN command to use this script. The --auth-user-pass-verify flag tells OpenVPN to use the script to retrieve credentials:

  openvpn --auth-user-pass-verify /full/path/to/decrypt-creds.sh via-file --auth-nocache [your other flags]
  

  When you run this, you’ll be prompted for your GPG passphrase, which decrypts the credentials temporarily just for OpenVPN to use.

2. Store Credentials on an Encrypted Filesystem #

If you prefer a system-level approach, store your credentials file on an encrypted filesystem that you only mount when you need to use OpenVPN. This way, the credentials are encrypted on disk most of the time.

• On Linux, tools like ecryptfs or LUKS work well. Here’s a quick ecryptfs example:
  1. Create a directory and encrypt it:

     mkdir ~/encrypted-openvpn-creds
     sudo mount -t ecryptfs ~/encrypted-openvpn-creds ~/encrypted-openvpn-creds
     

     Follow the prompts to set a passphrase and encryption settings (stick to the defaults if you’re unsure).
  2. Copy your credentials.txt into the mounted, encrypted directory.
  3. When you need to run OpenVPN, mount the directory first, run your OpenVPN command pointing to the file inside, then unmount it afterward:

     sudo umount ~/encrypted-openvpn-creds
     

• For macOS, you can use Disk Utility to create an encrypted disk image, and for Windows, BitLocker or a third-party encrypted container tool works similarly.

3. Use a System Keyring to Avoid Files Altogether #

Why store credentials in a file at all? You can use a system keyring (like GNOME Keyring, KWallet, or the pass password manager) to store your credentials securely, then pipe them directly to OpenVPN.

• Here’s how to do it with pass (a lightweight, command-line password manager):
  1. Store your OpenVPN credentials in pass—enter your username first, then your password when prompted:

     pass insert openvpn/my-vpn-creds
     

  2. Run OpenVPN and pipe the output of pass directly into it. This skips the file entirely:

     pass openvpn/my-vpn-creds | openvpn --auth-user-pass /dev/stdin [your other flags]
     

• For desktop environments, you can also use GUI tools to store credentials in the system keyring and configure OpenVPN to pull from it directly (many OpenVPN GUI clients support this out of the box).

Critical Best Practices #

• Never leave plaintext credentials lying around: After encrypting or moving them to a secure location, delete the original plaintext file and empty your trash/recycle bin.
• Lock down permissions: Any scripts or encrypted files should have strict permissions (e.g., chmod 700 for scripts) so only your user can access them.
• Be cautious with automated setups: If you’re running OpenVPN as a service and need automatic decryption, avoid storing decryption passphrases in plaintext. Use a hardware security key (like YubiKey) or a dedicated key file with restricted permissions instead.

内容的提问来源于stack exchange，提问作者gecharita