openvpn3-config-acl(1)

💖 openvpn3-config-acl — the manual page, but make it bestie (OpenVPN 3 Linux Management — Configuration Access Control) 💖

okay so. you found the page for openvpn3-config-acl, part of the OpenVPN 3 Linux family. this is the one that decides who gets to touch your config. let's get into it, no cap. ✨

---

🌸 SYNOPSIS 🌸

openvpn3 config-acl -o DBUS-PATH | --path DBUS-PATH | --config CONFIG-NAME [OPTIONS]
openvpn3 config-acl -h | --help

---

🦋 DESCRIPTION 🦋

so every single configuration profile has its own Access Control List riding along with it. that's the whole point: it lets a profile be shared between more users in a way more controlled than just... vibes. specific users, or literally everybody, can be granted access to start new VPN sessions off pre-loaded configurations. 👑

it can also be used to stop users from viewing the contents of the configuration profile while still letting them start VPN sessions. like, yes you can use it, no you cannot read it. main character boundary setting, honestly. 🎀

all the options below can be used together, fr fr. and if you use the --show option, it will list the current Access Control List after any changes have been performed. so it's giving receipts. 💅

---

✨ OPTIONS ✨

• -h, --help — prints usage and help details to your terminal. the classic. 🫶
• -o DBUS-PATH, --path DBUS-PATH — the D-Bus configuration path of the configuration whose ACL you wanna manage. you can find this in openvpn3 configs-list. go look there first, bestie.
• --config-path DBUS-PATH — an alias for --path. same energy, different spelling. 🦋
• -c CONFIG-NAME, --config CONFIG-NAME — you can use this instead of --path when you've got the configuration profile name instead. available configuration names can be found via openvpn3 configs-list.
• -s, --show — shows the currently active ACL. the vibe check. 🔥
• -G USER, --grant USER — grants the given user read-only access to this configuration profile. the USER argument can be either a UID or a username belonging to the system. sharing is caring.
• -R USER, --revoke USER — revokes access to this configuration profile for the given user. the USER argument can be either a UID or a username belonging to the system. it's giving consequences. 💀
• --public-access BOOL — grants all users on the system read-only access to this configuration profile. heads up though: this effectively disables the more fine-grained access control you get via --grant. valid argument values: true, false.
• -T BOOL, --transfer-owner-session BOOL — okay so if another user is granted access to the configuration profile, that user will be the owner of the VPN session when it's started. setting this flag to true will transfer the ownership back to the profile owner while still granting the user starting the session rights to also manage the session. see openvpn3-session-acl(1) for the details on the session ACLs. passing the aux cord back to the host, basically. 🎧
• --lock-down BOOL — locks down the configuration profile so it can only be used to start new VPN sessions by users granted access. now only the configuration profile owner can show the profile contents via openvpn3 config-dump. valid argument values: true, false.
• -S, --seal — this seals the configuration profile for everyone, making it effectively read-only, even for the owner.

⚠️ a configuration profile cannot be unsealed. like, ever. no take-backs, no undo, bestie. be so sure before you do this one. 😭

---

💜 SEE ALSO 💜

openvpn3(1) openvpn3-config-import(1) openvpn3-config-manage(1) openvpn3-config-dump(1) openvpn3-configs-list(1) openvpn3-session-acl(1)

---

and that's the page, periodt. this lil doc is openvpn3-config-acl(1) from OpenVPN 3 Linux — go forth and manage those ACLs responsibly, you gorgeous sysadmin. 🧚 💜