Re: PostUp/PreUp/PostDown/PreDown Dangerous?

[Andy Dorman <adorman@ironicdesign.com>]

On 6/22/18 8:08 AM, Jacob Baines wrote:
> There also seems to be an expectation that users should understand these 
> config files. I'm not sure why that is. Excuse my speaking in 
> generalities but a majority of users aren't going to understand how 
> OpenVPN works, let alone how the configuration file affects the program. 
> Many users (myself included) simply receive config files from our bosses 
> or our IT guy and trust that they aren't malicious. Call me naive or 
> foolish but I don't review every single file passed my way for malicious 
> content.

We run an email security service and we MUST understand the action of 
every line in the config files on our servers. Of course we also 
carefully limit the applications on these servers so we have a limited 
set of config files to deal with. ;-)

But I agree that perhaps the warning should be to either know what the 
config is doing OR it should be from a trusted source (ie, your boss or 
IT person or some other known, trusted entity).

The main point about a warning for wg-quick is to try and help the 
average user know that there can be a danger in the pre- and post- 
commands so they will perhaps look twice before using a config that they 
grabbed off an untrusted source.

-- 
Andy Dorman
Ironic Design, Inc.
AnteSpam.com