Skip to content

Releases: sipgate/openvpn-exporter

Privacy fix for username-as-common-name

14 Jan 14:41

Choose a tag to compare

🔒 Privacy Fix for username-as-common-name

This fork fixes a privacy issue in the ignore-individuals feature when OpenVPN server uses the username-as-common-name option.

Problem

When the OpenVPN server is configured with username-as-common-name, the common_name field contains the actual username. The previous implementation would still export common_name as a label, leaking user information despite the privacy flag being enabled.

Solution

When ignore-individuals=true, all individual client data is now hidden by aggregating metrics:

  • ✅ Counter metrics (bytes sent/received) are summed across all clients
  • ✅ Gauge metrics (like route last reference time) use the most recent timestamp
  • ✅ Only status_path label is exported
  • common_name is NOT exported, preventing username leaks

Changes

  • Add ignoreIndividuals flag to OpenVPNExporter struct
  • Implement metric aggregation in collectServerStatusFromReader
  • Remove common_name from labels when ignore-individuals=true
  • Update README with clear documentation of aggregation behavior