Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSL VPN (OpenVPN on iOS) dont want users to be able to save password

Hello

I just set up SSL VPN and it works as intended on windows clients.
(They must type username and password each time they connect).

The same is not the case on iOS. 

Here is what I done.

- Installed OpenVPN on my iOS device.
- Logged on to the user portal and under Remote Access i clicked "install» for iOS. Opened the file in OpenVPN. 
- Imported these settings to OpenVPN
- Connected. 

All works fine. I would just like to disable the saving of the password on the client.

Googling lead me to an FAQ on OpenVPN.

****************************************
Why is the save password switch sometimes disabled?
A: The save password switch on the authentication password field is normally enabled, but can be disabled by the following:
• The following OpenVPN directive, if present in a profile, will disable the password save switch:
setenv ALLOW_PASSWORD_SAVE 0 
Note however that the above directive only applies to the authentication password. The private key password, if it exists, can always be saved.
****************************************************


This suggests that the setting can be added to the configuration file. 
However I have not found anywhere in the sophos UTM GUI (Web Admin) where I can set settings for the SSL client / configuration file.

Do I need to SSH into the UTM and edit the file?
If anyone got any tips on how to disable the “save password” feature in OpenVPN on iOS (Guess the same settings also applies for Android), please leave a note.


This thread was automatically locked due to age.
  • Look in /var/sec/chroot-openvpn/etc/openvpn/client for the config-default file.  Were you able to get this to work as you want?

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Hm.. did not work, do i need to restart a service or somehting.. 

    And does it matter much where i put the setting in the config file: Here is how the file looks now:

    daemon
    setenv ALLOW_PASSWORD_SAVE 0
    client
    dev tun

    proto []
    multihome
    remote [] []
    tls-remote "[]"

    resolv-retry infinite
    mark 4458
    nobind

    ca /etc/openvpn/client/[]/ca_cert
    cert /etc/openvpn/client/[]/certificate
    key /etc/openvpn/client/[]/key
    auth-user-pass /etc/openvpn/client/[]/credentials
    auth-retry nointeract

    []
    cipher []
    auth []
    comp-lzo []

    verb []
    reneg-sec 0
    keepalive 10 60
    remap-usr1 SIGHUP

    []

    management [] unix
    management-client-user root
    management-client-group root

    down-pre
    plugin /usr/lib/openvpn/plugins/openvpn-plugin-utm.so []
  • Did you re-download the config to the client after making the change?
    __________________
    ACE v8/SCA v9.3

    ...still have a v5 install disk in a box somewhere.

    http://xkcd.com
    http://www.tedgoff.com/mb
    http://www.projectcartoon.com/cartoon/1
  • yes, offcause. [:)]
    I deleted the config from my iOS device. And downloaded the new one.
    I actually also uninstalled open VPN just to test that too.

    Even rebooted the UTM, then redownloaded the config yet again.
  • According to the OpenVPN docs, you cannot prevent the user from saving their username/password combination.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Really?
    Because that it was on OpenVPN FAQI found this information:
    https://docs.openvpn.net/docs/openvpn-connect/openvpn-connect-ios-faq.html

    Q: Why is the save password switch sometimes disabled?

    A: The save password switch on the authentication password field is normally enabled, but can be disabled by the following:

    •The following OpenVPN directive, if present in a profile, will disable the password save switch:

     setenv ALLOW_PASSWORD_SAVE 0 

    Note however that the above directive only applies to the authentication password. The private key password, if it exists, can always be saved.



    My understanding of this is that the authentication password (the password user types in GUI) can be "save disabled".

    Am I mistaken?
  • I dunno - we need an OpenVPN guru.  My reading of the docs indicated that the command you found applies to the password not associated to the user name.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • hm.. any OpenVPN guru around? [:)]

    Because what i want to do is disable the save password switch.
    And that is FAQ says that this command should do it:
    setenv ALLOW_PASSWORD_SAVE 0
  • auth-user-pass /etc/openvpn/client/[]/credentials


    The setenv ALLOW_PASSWORD_SAVE 0 is working, but you also specified a path to the user's credentials after the auth-user-pass option, essentially allowing the user to login without typing a password.  Don't put anything after auth-user-pass and try again:

    setenv ALLOW_PASSWORD_SAVE 0
    auth-user-pass


    If that doesn't fix it, verify your OpenVPN client version.  Some older versions do not support ALLOW_PASSWORD_SAVE
  • Hi,

    Yes, remove the path for the user credential specified after auth-user-pass. That forces auto login during the system startup. 

    Thanks

    Sachin Gurung
    Team Lead | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.