Страшная уязвимость в OpenVPN⁠⁠

Читаю, как OpenVPN с AD подружить, и не сразу понял, почему кофе не в то горло потек.

The 2 lines highlighted in the config file above (User: Nobody and Group: Nogroup) means that anybody who has the client profile (.ovpn) file can connect to your OpenVPN server without having to authenticate.

So the first step in configuring authentication via AD is to comment out those 2 lines or remove them so that users who have the client profile cannot login anonymously.