Where does GNOME Network Manager store passwords

gnome3networkmanageropenvpnSecurity

In Network Manager, under the Identity tab, I can enter a username and password for my OpenVPN connection. I can also enter a password for the "User private key".

Both password fields have the following options:

Store the password only for this user
Store the password for all users
Ask for this password every time
The password is not required

If I choose to store the password ("for this user" or "for all users") where is it stored?

Best Answer

Go to the /etc/NetworkManager/system-connections/ directory, here all the connection details are saved.

And use the cat command or any text editor as root to view the saved passwords. There should be a security related entry, like [vpn-secrets] or [wifi-security].

[wifi-security]
auth-alg=open
group=
key-mgmt=wpa-psk
pairwise=
psk=sat004321

For VPN,

[vpn-secrets] password=arnab002

The string after psk= is the password. I think it's the same location for all users.

Related Solutions

Ubuntu – How to Start 2FA-Using OpenVPN with Systemd

I try to start it via normal service call:
# service openvpn start work

No, that's not normal. That's a quirk of System 5 rc toolsets that invokes a System 5 rc script with two arguments. The rc script takes the non-standard second argument as the basename of the OpenVPN configuration to use.

This is Ubuntu Linux. You aren't using System 5 rc. You aren't using its rc script. You are using systemd. You are using systemd service units, which OpenVPN has in fact had for many years now. systemd service units aren't scripts and don't have script arguments.

What they have are template parameters, and OpenVPN was in fact one of the earlier adopters of the template units mechanism when it came along, having had templatized units since at least 2011. (Templatized upstart jobs for OpenVPN have been floating around since at least 2012.)

You're looking at /lib/systemd/system/openvpn.service. What you should be looking at is /lib/systemd/system/openvpn@.service. Instantiate that on the configuration name:

systemctl preset openvpn@work.service
systemctl disable openvpn@work.service
systemctl start openvpn@work.service
systemctl stop openvpn@work.service
systemctl status openvpn@work.service

Or just let Debian/Ubuntu do the heavy lifting. There's a unit generator in /lib/systemd/system-generators/openvpn-generator that automatically instantiates this template against every *.conf file in /etc/openvpn at bootstrap or when systemctl daemon-reload is run.

Further reading

Using OpenVPN with systemd

Change password in OpenVPN configuration file

If the key is in its own file, decrypt and re-encrypt it with a new passphrase:

$ openssl rsa -aes256 -in acme.key -out acme.key.new
$ openssl rsa -in acme.key.new -check
$ mv acme.key.new acme.key

With the first command, you'll be prompted for the old passphrase once, and a new passphrase twice. The second command isn't necessary, but is an additional sanity check that your new passphrase works with the new key file before you overwrite the original.

If your openvpn config is in the newer unified style, use your favorite editor to copy the key (including the -----BEGIN ... and -----END ... lines) from the config file into a separate file; change the passphrase as above; then copy the key back into the configuration file.

Related Question