Add OpenVPN private key password (askpass) support

[orcnd]

What

Adds an optional Private key password field to the OpenVPN client settings, in the Certificates panel. With it, .ovpn profiles that contain an encrypted inline <key> can be used.

Why

Without the passphrase, openvpn-client@client cannot decrypt the key without user input, so it exits with "can't ask for 'Enter Private Key Password'".

Fixes #2109

How

• SaveOpenVPNConfig() accepts an optional $keyPassword. When it is set:
  • It is written to /tmp/ovpn/keypass (umask 0077, chmod 0600).
  • It is moved to /etc/openvpn/client/<name>_keypass.conf and symlinked as keypass.conf, the same way login.conf is handled.
  • These commands match the existing sudoers rules, so no sudoers changes are needed.
• configauth.sh takes a 4th argument. When it is 1, the script replaces any existing askpass directive with askpass keypass.conf.
• Activating a profile relinks keypass.conf, and deleting a profile removes its _keypass.conf.
• Passwords that contain line breaks are rejected, because OpenVPN only reads the first line. The value is never echoed back into the form.
• Arguments passed to configauth.sh are now shell-escaped.
• The field is optional, so existing setups (username/password or certificate only) behave as before.

How tested

• php -l passes on PHP 7.4, 8.2 and 8.5, and parallel-lint passes. phpcs (PSR-2) reports no new findings in the touched files.
• I generated a CA and a client certificate with an encrypted key, built an inline .ovpn, and ran configauth.sh with sudo/iptables stubbed. The stale askpass line was removed and the new one was appended.
• I ran OpenVPN 2.6 against that profile:
  • With the keypass file, the key loads and the client starts connecting.
  • With a wrong password, it fails with "private key password verification failed".
  • Without askpass, it fails the way the issue describes.
• Not tested on a Raspberry Pi through the full web UI and systemd flow.

Notes

• OpenVPN does not allow askpass together with auth-nocache.
• Unrelated to this change: del_ovpncfg.php already used rm -f, which may not match the sudoers rule /bin/rm /etc/openvpn/client/*.conf. I kept the existing pattern rather than change it here.

AI disclosure: this change was prepared with the help of Claude Code and reviewed by me.

🤖 Generated with Claude Code