2

Is it safe to only use username and password (and server certificate) for OpenVPN connection authentication? Are username or password ever transmitted in plaintext to the OpenVPN server? I found a (german) website which claims so:

Original Text:

Achtung: Dieser Schutz ist ohne Verschlüsselung sinnlos, da Username und Passwort unverschlüsselt übertragen werden! Es ist in jedem Fall zu empfehlen, die zusätzliche Authentifizierung nur in Verbindung mit der zertifikatbasierten Authentifizierung und Verschlüsselung zu nutzen

English translation:

Warning: This protection is meaningless without encryption because username and password are transmitted unencrypted! It is recommended in any case to use the additional authentication only in conjunction with the certificate-based authentication and encryption

I used wireshark to prove this is true but I could not find my username nor password in plaintext in any OpenVPN package.

I am using OpenVPN server version 2.3 on a Ubuntu 14.04 host.

3

The user name and password are encrypted; this is confirmed in the OpenVPN documentation:

OpenVPN 2.0 and later include a feature that allows the OpenVPN server to securely obtain a username and password from a connecting client, and to use that information as a basis for authenticating the client.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.