Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Few quick questions.

  1. To install and run OpenVPN you must be an administrator on the machine. We have a few groups that are not local admins on their machines so how do we go about them being able to run OpenVPN?

  2. We have custom key files that we push out in the install and have been doing this by sfx files. Currently we say install to C:\Program Files\OpenVPN and then come in behind them and auto unzip the config files to C:\Program Files\OpenVPN\config. Some users are complaining about changing the default install and then having to most the config files.

Thanks for the help.

share|improve this question

5 Answers 5

To install most applications you need to be administrator on Windows. OpenVPN is no different and if anything really requires it since it installs drivers for a virtual network adapter and a service. If the computers are part of a domain you may be able to push a silent install on the machines using using WSUS, a logon script, or wkpg.org.

Where I used to work we rolled our own nullsoft installers for OpenVPN which included all the custom config files, certificates, etc. The end user still had to generate a csr using the My Certificate Wizard app, with all fields filled out other than name and email address. We would double check the name and email address before signing the request and the end user were then have to install the signed certificate themselves. But the directions to do this was clear and we never had any problems. I'm sure most of this could be automated and web driven if you have a large number of users.

share|improve this answer
1  
What about the users just running the program? If the program isn't ran as an administrator too the routes don't get pushed correctly. –  user22492 Oct 28 '09 at 18:52
    
Part of the OpenVPN installation is the OpenVPN service. This runs as the System account which has the necessary rights to change routes etc. The OpenVPN GUI is the unprivileged user process that talks to it. Its job is to read in the configuration files and send the appropriate commands to the service to connect, disconnect, etc. –  3dinfluence Oct 28 '09 at 19:14

3dinfluence has aptly explained what the problem is, but to actually fix it depends on how you're doing the install in the first place; bottom line is that you'll need to give administrative privileges (local or domain) to the installer process so that it can create services, write to C:\Program Files, etc. Are these manual installs, or are you pushing it out with GP/ZEN/Somthing else?

share|improve this answer
    
I work in a university environment where management is semi decentral as far as techs go. We have a custom sfx install that we are letting the users install and most departments it's fine b/c they are admins, but some departments don't allow them to be admins. That is fine b/c their tech can install it for them (would have to anyway). The problem is once it is installed, how can they properly run it without admin rights? I was told you have to be admin to have the routes push correctly. –  user22492 Oct 28 '09 at 20:14

Consider using the new access server they have come up with. It's not completely free but the licensing cost is VERY reasonable.

http://openvpn.net/index.php/access-server/download-openvpn-as.html

share|improve this answer
    
I wish we could but we have a fairly large user base and with budget cuts lately it's out of the question. –  user22492 Oct 28 '09 at 20:39
    
You do realize it's only $5 per concurrent user, right? openvpn.net/index.php/access-server/section-faq-openvpn-as/… –  Matt Oct 28 '09 at 22:55

Or... make the problem user a "network operator" - bit of a fudge, grants add route perms, but not much else harmful.

share|improve this answer
    
From what I can see this might be my only option for our environment. I would have to add the users to the network config group and also give the users modify/write access to C:\Program Files\OpenVPN so it can create and write to the \log directory in there. –  user22492 Nov 2 '09 at 21:14

I've found that if I have our domain group policy add the OpenVPN AD group to Network Configuration Operators by default this fixes a lot of my problems with the non-admin user not being able to run OpenVPN GUI. The only real problem now is that normal users by default can't write to C:\Program Files\OpenVPN to create the \log directory and the client.log files. So I guess I will just have to work around that by creating some sort of script to change the directory permissions if no one else has any ideas. I also appreciate all the input from the guys above.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.