Why is an authentication file accepted in the config file and not on the command line?

Question

I connect to a VPN server which requires authentication via

/usr/sbin/openvpn --config /etc/openvpn/server.ovpn

This prompts me for a login/password (= OK).

I added the login and password to a file and updated the /etc/openvpn/server.ovpn configuration with

auth-user-pass /etc/openvpn/auth.txt

I am not prompted for the password anymore (= OK).

I wanted to provide the authentication credentials from the command line instead of sourcing them from the config file:

/usr/sbin/openvpn --auth-user-pass /etc/openvpn/auth.txt --config /etc/openvpn/server.ovpn

This time, I am prompted for credentials. Why is it so?

The credentials file is the same, as well as the config (except for the auth-user-pass line which I removed for the last test).

The OpenVPN version is 2.3.10 and it was compiled with enable_password_save=yes (which must be the case since providing the credentials via the config file works, the package is installed from the standard Ubuntu repository)

Solution

You have to change position of parameters, --auth-user-pass should be passed after --config parameter like this:

sudo openvpn --config "$HOME/your_file.ovpn" --auth-user-pass "$HOME/auth.txt"

Comments

[WoJ]

Yes, both calls are made as root and the file is visible to root

[Esa Jokinen]

Please explain, why the order of command line parameters matters, if possible. Interesting.

[Kellen Stuart]

This is why Powershell is better (ducks head and runs for cover)

[muru]

In all likelihood, auth-user-pass line in the config file overrides the command line option if that came first.