Remove --enable-password-save option

This options is enabled in virtually all distributions and gives no real security benefit.

---
 configure.ac       | 8 --------
 src/openvpn/misc.c | 8 --------
 src/openvpn/misc.h | 2 +-
 src/openvpn/ssl.c  | 8 ++++----
 4 files changed, 5 insertions(+), 21 deletions(-)

index a8675fe..721395d 100644
@@ -170,13 +170,6 @@ AC_ARG_ENABLE(
 )
 
 AC_ARG_ENABLE(
-	[password-save],
-	[AS_HELP_STRING([--enable-password-save], [allow --askpass and --auth-user-pass passwords to be read from a file @<:@default=no@:>@])],
-	,
-	[enable_password_save="no"]
-)
-
-AC_ARG_ENABLE(
 	[iproute2],
 	[AS_HELP_STRING([--enable-iproute2], [enable support for iproute2 @<:@default=no@:>@])],
 	,

@@ -1054,7 +1047,6 @@ test "${enable_port_share}" = "yes" && AC_DEFINE([ENABLE_PORT_SHARE], [1], [Enab
 test "${enable_def_auth}" = "yes" && AC_DEFINE([ENABLE_DEF_AUTH], [1], [Enable deferred authentication])
 test "${enable_pf}" = "yes" && AC_DEFINE([ENABLE_PF], [1], [Enable internal packet filter])
 test "${enable_strict_options}" = "yes" && AC_DEFINE([ENABLE_STRICT_OPTIONS_CHECK], [1], [Enable strict options check between peers])
-test "${enable_password_save}" = "yes" && AC_DEFINE([ENABLE_PASSWORD_SAVE], [1], [Allow --askpass and --auth-user-pass passwords to be read from a file])
 
 case "${with_crypto_library}" in
 	openssl)

index 31815cb..5713d2e 100644
@@ -1110,14 +1110,6 @@ get_user_pass_cr (struct user_pass *up,
 
           if (fgets (password_buf, USER_PASS_LEN, fp) != NULL)
             {
-#ifndef ENABLE_PASSWORD_SAVE
-              /*
-               * Unless ENABLE_PASSWORD_SAVE is defined, don't allow sensitive passwords
-               * to be read from a file.
-               */
-              if (flags & GET_USER_PASS_SENSITIVE)
-                msg (M_FATAL, "Sorry, '%s' password cannot be read from a file", prefix);
-#endif
               chomp (password_buf);
             }
 

index be93daa..dbe899e 100644
@@ -242,7 +242,7 @@ struct static_challenge_info {};
  * Flags for get_user_pass and management_query_user_pass
  */
 #define GET_USER_PASS_MANAGEMENT    (1<<0)
-#define GET_USER_PASS_SENSITIVE     (1<<1)
+/* GET_USER_PASS_SENSITIVE     (1<<1)  not used anymore */
 #define GET_USER_PASS_PASSWORD_ONLY (1<<2)
 #define GET_USER_PASS_NEED_OK       (1<<3)
 #define GET_USER_PASS_NOFATAL       (1<<4)

index 817bc49..887bd75 100644
@@ -332,7 +332,7 @@ void
 pem_password_setup (const char *auth_file)
 {
   if (!strlen (passbuf.password))
-    get_user_pass (&passbuf, auth_file, UP_TYPE_PRIVATE_KEY, GET_USER_PASS_MANAGEMENT|GET_USER_PASS_SENSITIVE|GET_USER_PASS_PASSWORD_ONLY);
+    get_user_pass (&passbuf, auth_file, UP_TYPE_PRIVATE_KEY, GET_USER_PASS_MANAGEMENT|GET_USER_PASS_PASSWORD_ONLY);
 }
 
 int

@@ -375,11 +375,11 @@ auth_user_pass_setup (const char *auth_file, const struct static_challenge_info
        get_user_pass_cr (&auth_user_pass,
                          auth_file,
                          UP_TYPE_AUTH,
-                         GET_USER_PASS_MANAGEMENT|GET_USER_PASS_SENSITIVE|GET_USER_PASS_DYNAMIC_CHALLENGE,
+                         GET_USER_PASS_MANAGEMENT|GET_USER_PASS_DYNAMIC_CHALLENGE,
                          auth_challenge);
       else if (sci) /* static challenge response */
        {
-         int flags = GET_USER_PASS_MANAGEMENT|GET_USER_PASS_SENSITIVE|GET_USER_PASS_STATIC_CHALLENGE;
+         int flags = GET_USER_PASS_MANAGEMENT|GET_USER_PASS_STATIC_CHALLENGE;
          if (sci->flags & SC_ECHO)
            flags |= GET_USER_PASS_STATIC_CHALLENGE_ECHO;
          get_user_pass_cr (&auth_user_pass,

@@ -390,7 +390,7 @@ auth_user_pass_setup (const char *auth_file, const struct static_challenge_info
        }
       else
 # endif
-       get_user_pass (&auth_user_pass, auth_file, UP_TYPE_AUTH, GET_USER_PASS_MANAGEMENT|GET_USER_PASS_SENSITIVE);
+       get_user_pass (&auth_user_pass, auth_file, UP_TYPE_AUTH, GET_USER_PASS_MANAGEMENT);
 #endif
     }
 }

2.4.9 (Apple Git-60)

Hi.

Feature ACK. (I was just about to add "--enable-password-save" when building Tunnelblick from git-master because of the new "username only" in file feature; this will save me the trouble. : )

But please update the man page, too; it references "--enable-password-save". (Then again, the man page doesn't mention allowing username-only files, so it is already inaccurate.

Hi,

Good point. I'll see to that "ASAP".

gert

USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...

---
 Changes.rst   | 3 +++
 doc/openvpn.8 | 5 +----
 2 files changed, 4 insertions(+), 4 deletions(-)

index a791ca3..c2142fa 100644
@@ -72,3 +72,6 @@ User-visible Changes
 - proto udp6/tcp6 in server mode will now try to always listen to
   both IPv4 and IPv6 on platforms that allow it. Use bind ipv6only
   to explicitly listen only on IPv6.
+
+- Removed --enable-password-save from configure. This option is now
+  always enabled.

index 9889540..4297513 100644
@@ -3800,10 +3800,7 @@ over the client's routing table.
 Authenticate with server using username/password.
 .B up
 is a file containing username/password on 2 lines. If the
-password line is missing, OpenVPN will prompt for one. (Note: OpenVPN
-will only read passwords from a file if it has been built
-with the \-\-enable\-password\-save configure option, or on Windows
-by defining ENABLE_PASSWORD_SAVE in win/settings.in).
+password line is missing, OpenVPN will prompt for one. 
 
 If
 .B up

2.4.9 (Apple Git-60)

Hi,

Am 29.11.15 um 20:09 schrieb Selva Nair:

Hm but the paragraph of --askpass is not related to --enable-password-save, or do I miss something?

Arne

Hi,

please see starting line 4886 of openvpn.8 quoted below:

If
.B file
is specified, read the password from the first line of .B file.
Keep in mind that storing your password in a file
to a certain extent invalidates the extra security provided by using an encrypted key (Note: OpenVPN
will only read passwords from a file if it has been built with the \-\-enable\-password\-save configure option, or on Windows by defining ENABLE_PASSWORD_SAVE in win/settings.in).

Selva

Am 29.11.15 um 20:29 schrieb Selva Nair:

Oh, yes sorry. I totally missed that. Good catch.

Arne

ACK, thanks.

Your patch has been applied to the master and release/2.3 branch.

Changes.rst did not exist in that branch yet, so git decided to copy over the whole Changes.rst file from 2.4 :-) - adapted to 2.3.x (not complete yet)

commit 1e9c1f09cba95ebf72083c746cf847056a61c761 (master) commit fbf3763aab42c0f4de8362474edaaa2ea580dd17 (release/2.3)

Author: Arne Schwabe
Date:   Sun Nov 29 19:52:24 2015 +0100

     Reflect enable-password-save change in documentation

     Acked-by: Gert Doering <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/10665
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering

---
 doc/openvpn.8 | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

index 3519e7d..1b9dcae 100644
@@ -4886,10 +4886,7 @@ is specified, read the password from the first line of
 .B file.
 Keep in mind that storing your password in a file
 to a certain extent invalidates the extra security provided by
-using an encrypted key (Note: OpenVPN
-will only read passwords from a file if it has been built
-with the \-\-enable\-password\-save configure option, or on Windows
-by defining ENABLE_PASSWORD_SAVE in win/settings.in).
+using an encrypted key.
 .\"*********************************************************
 .TP
 .B \-\-auth\-nocache

2.4.9 (Apple Git-60)

I wanna be out of this please!!!!
NO MORE MESSAGES

Envoyé de mon iPhone

------------------------------------------------------------------------------

_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

Your patch has been applied to the master and release/2.3 branch.

commit 80442aeed408f26700ea7570ced2409e7dd3e98b (master) commit 0a9f866f78b5287e9996978898ccf213afd6b8d2 (release/2.3)

Author: Arne Schwabe
Date:   Sun Nov 29 20:38:21 2015 +0100

     Also remove second Instanz von enable-password-save in the manage

     Acked-by: Selva Nair <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/10671
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering

ACK - we agreed to do this 2014 in Munich, but nobody submitted a patch yet...

Your patch has been applied to the master and release/2.3 branch.

commit 9ffd00e7541d83571b9eec087c6b3545ff68441f (master) commit 747ae0c49d813434a70953ea05f58953d7da11c0 (release/2.3)

Author: Arne Schwabe
Date:   Sun Nov 29 15:55:59 2015 +0100

     Remove --enable-password-save option

     Acked-by: Gert Doering <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/10661
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering