Write Protect /var/etc/openvpn/client1.conf

olapola

Hi

I need to write protect /var/etc/openvpn/client1.conf because otherwise pfsense overwrites it and my openvpn connection goes down.

I can only access the root folder when I ssh to my pfsense. Anyone know how to do this? At least have any tips? :)

phil.davis

Firstly, why do you need to protect this file?
It is written by pfSense from the settings you make in the webGUI.
What is the deficiency/problem in the webGUI that means you feel the need to edit this file directly and then protect it?

olapola

In order to get it to work with Ipredator I had to edit the file manually. And now I need to protect it to get overwritten from the webgui

phil.davis

Can you tell us what exactly did not work with Ipredator, and what edits you needed to make it work?

Maybe we can help get that fixed. I see there have been a few other threads about Ipredator.

I suspect that whatever you do to change the protections on the file will be ineffective, because the pfSense code that re-generates it will be running with full root privileges…

If you really have to, you can edit the pfSense PHP code in /etc/inc that generates the config, to leave out or add in what you need. That would be a real one-off hard-coded hack to get it working, and of course would have to be re-done after each pfSense firmware upgrade.

olapola

This is what my client1.conf looks like after I´ve modified it

client
dev ovpnc1
dev-type tun
proto udp
remote pw.openvpn.ipredator.se 1194
remote pw.openvpn.ipredator.me 1194
remote pw.openvpn.ipredator.es 1194
dev-node /dev/tun1
writepid /var/run/openvpn_client1.pid
script-security 3
resolv-retry infinite
nobind
daemon

auth-user-pass /root/ipredator_password
auth-retry nointeract

ca /var/etc/openvpn/client1.ca

tls-client
tls-auth /var/etc/openvpn/client1.tls-auth
ns-cert-type server

keepalive 10 30
cipher AES-256-CBC
persist-key
persist-tun
comp-lzo
tun-mtu 1500
mssfix 1200
passtos
verb 3

up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
management /var/etc/openvpn/client1.sock unix

Isnt there a way to protect a file that not even root can edit?

olapola

@phil.davis:

Can you tell us what exactly did not work with Ipredator, and what edits you needed to make it work?

Maybe we can help get that fixed. I see there have been a few other threads about Ipredator.

I suspect that whatever you do to change the protections on the file will be ineffective, because the pfSense code that re-generates it will be running with full root privileges…

If you really have to, you can edit the pfSense PHP code in /etc/inc that generates the config, to leave out or add in what you need. That would be a real one-off hard-coded hack to get it working, and of course would have to be re-done after each pfSense firmware upgrade.

See post above :)

olapola

Made a new thread regarding this issue in the openVPN forum

https://forum.pfsense.org/index.php?topic=84748.0