1

I'm running a headless Ubuntu 14.04.1 server. I'd like to use a commercial VPN service to secure the server's internet connection, and my VPN provider uses passphrases for authentication. I've installed openvpn on the server, and it has the necessary .ca, .conf files to initiate a connection to my VPN.

However, to initiate said connection, I need to ssh in and issue the commands (sudo openvpn --config <conf-file> followed by my VPN credentials), then keep my terminal open for as long as I want the server to remain connected to the VPN.

This is impractical on a headless setting. I've been trying to issue the command remotely in such a way that it can run in the background while I disconnect from the server, but I'm facing the following issues:

  • I could set the server to connect automatically on startup, but that would require storing my VPN credentials in plain-text, which I'm averse to.
  • I can't run a single ssh command as root (without connecting to the server as root, but then I'm not sure setting a password for root is a good idea. Opinions?). That is, if I send ssh <user>@<server> "sudo <command>" I get

    sudo: no tty present and no askpass program specified

  • Any combination of the fN flags I try to pass to ssh results in the command going to the background before I'm asked for my VPN credentials.
Please don't hesitate to offer a different avenue of initiating the connection even if you think these ideas are unfeasible. However, please note that the server doesn't have a GUI installed, so any idea relying on that is unsuitable (for example, I'd love to use nmcli to initiate my VPN, but I can't create a network-manager connection without GUI, or at least I don't know how to).

(PS I tried finding a solution online, but there are too many results dealing with setting an OpenVPN connection to one's server, and if anything relevant is hiding among them I wasn't able to find it.)

  • Do you need to use a static passphrase VPN? Any reason to not use certificates? – gertvdijk Dec 15 '14 at 11:35
  • Do you mean you do not control the other server endpoint the OpenVPN is connecting to? Then you cannot change the way of authentication. I don't know what 'PIA' is. Please edit your question to include information on this. – gertvdijk Dec 15 '14 at 11:40
  • Well, perhaps just adding something like 'my VPN provider requires me to use the passphrase mechanism for authentication.' will do the trick. I could then answer the question with something 'then it's not possible, find another provider with support for certificates' with some additional information on how to set up OpenVPN headless in a regular set up. – gertvdijk Dec 15 '14 at 11:49
4

You can log in to the server and start a screen (type screen. If not installed, you can get it with apt-get install screen in debian or ubuntu or yum install screen in fedora), which creates a new terminal session that can keep running even when your ssh connection is closed. Inside the screen session start your OpenVPN. You can detach the session (exit and let it keep running) by ctrl-a d. You can then log out and OpenVPN will keep running inside screen. If you log in again you can reconnect to your screen session using screen -x.

Inside screen you can also start a new session by ctrl-a c (create) and switch between sessions with ctrl-a n (next) or ctrl-a p (previous). Use man screen to learn more or use Google ;) You have to press ctrl-a esc inside screen to scroll up. If you close the last shell inside screen, screen will terminate.

0

screen is a command (use apt-get install screen in debian or ubuntu or yum install screen in fedora to get it if not installed-). It creates a new session and keeps that running even when your ssh connection is closed. You can reconnect by screen -x. Inside screen you can start a new session by ctrl-a c (create.) and switch betweeb sessions by ctrl-a n (next) or ctrl-a p (previous). use man screen to learn more or use google ;) You have to press ctrl-a esc insude screen to scroll up. If you close the last shell inside screen, screen will terminate.

  • I believe SE sites usually prefer that you edit the original answer instead of posting another one. (Not an expert on AU.SE etiquette, but that's how they do it elsewhere.) Will you please add this to the previous answer (use the edit function) and remove the redundant answer? (PS I'd like to wait a couple of days before accepting an answer, but thanks for this!) – Jonathan Y. Dec 15 '14 at 13:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.