diff --git a/openvpn-script-security.patch b/openvpn-script-security.patch
new file mode 100644
index 0000000..693f0cf
--- /dev/null
+++ b/openvpn-script-security.patch
@@ -0,0 +1,15 @@
+--- openvpn-2.1_rc9/sample-scripts/openvpn.init.orig	2008-06-13 02:54:58.000000000 -0500
++++ openvpn-2.1_rc9/sample-scripts/openvpn.init	2008-08-13 13:51:46.000000000 -0500
+@@ -151,7 +151,11 @@
+ 		. $bn.sh
+ 	    fi
+ 	    rm -f $piddir/$bn.pid
+-	    $openvpn --daemon --writepid $piddir/$bn.pid --config $c --cd $work
++            # Handle backward compatibility, see Red Hat Bugzilla ID #458594
++            if [ -z "$( grep '^[[:space:]]*script-security[[:space:]]' $c )" ]; then
++                script_security="--script-security 2"
++            fi
++	    $openvpn --daemon --writepid $piddir/$bn.pid --config $c --cd $work $script_security
+ 	    if [ $? = 0 ]; then
+ 		successes=1
+ 	    else
diff --git a/openvpn.spec b/openvpn.spec
index 2fa0dac..a96a810 100644
--- a/openvpn.spec
+++ b/openvpn.spec
@@ -4,7 +4,7 @@
 
 Name:              openvpn
 Version:           2.1
-Release:           0.27%{?prerelease:.%{prerelease}}%{?dist}
+Release:           0.28%{?prerelease:.%{prerelease}}%{?dist}
 Summary:           A full-featured SSL VPN solution
 URL:               http://openvpn.net/
 #Source0:           http://openvpn.net/beta/%{name}-%{version}%{?prerelease:_%{prerelease}}.tar.gz
@@ -17,6 +17,7 @@ Source2:           roadwarrior-server.conf
 Source3:           roadwarrior-client.conf
 # Don't start openvpn by default.
 Patch0:            openvpn-init.patch
+Patch1:            openvpn-script-security.patch
 License:           GPLv2
 Group:             Applications/Internet
 BuildRoot:         %{_tmppath}/%{name}-%{version}-%{release}-%(id -un)
@@ -51,6 +52,7 @@ for compression.
 %prep
 %setup -q -n %{name}-%{version}%{?prerelease:_%{prerelease}}
 %patch0 -p0
+%patch1 -p1
 sed -i -e 's,%{_datadir}/openvpn/plugin,%{_libdir}/openvpn/plugin,' openvpn.8
 
 # %%doc items shouldn't be executable.
@@ -166,6 +168,10 @@ fi
 %config %dir %{_sysconfdir}/%{name}/
 
 %changelog
+* Wed Aug 13 2008 Steven Pritchard <steve@kspei.com> 2.1-0.28
+- Add "--script-security 2" by default for backwards compatibility
+  (see bug #458594).
+
 * Fri Aug 01 2008 Steven Pritchard <steve@kspei.com> 2.1-0.27.rc9
 - Update to 2.1_rc9.