6

I am looking forward to create an as-simple-as-possible OpenVPN set-up.

I would like to use a single password to secure the communication instead of a set of key files.

How can I set it up this way?

3 Answers 3

4

Yes, OpenVPN calls this the "static key" setup:

http://openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html

Note the listed disadvantages:

  • Limited scalability -- one client, one server
  • Lack of perfect forward secrecy -- key compromise results in total disclosure of previous sessions
  • Secret key must exist in plaintext form on each VPN peer
  • Secret key must be exchanged using a pre-existing secure channel
2
  • Really "one client, one server"? AFAIK one key can be used for many clients in a normal key-based setup if configured this way, isn't it possible the same way with a "static key"? I mean can't 2 clients connect to one server with the same password?
    – Ivan
    Aug 14, 2012 at 15:29
  • I actually don't know, and I'm just citing the docs. I've never done pre-shared keys on OpenVPN, only certificates. There is a configuration that will allow multiple clients to connect using the same certificate, though, so it's possible that may also apply to the PSK configuration. I imagine that you won't be able to set static IPs for each client using CCD files, as the server can't distinguish between the clients, but DHCP on the tunnel should work.
    – cjc
    Aug 14, 2012 at 15:43
4

To use password authntification from file, you should use this directives in server configuration file:

  • client-cert-not-required to allow authentification with user/password only
  • username-as-common-name to get common name from username, because it can't be taken from certificate
  • script-security 2 to allow calling external scripts
  • auth-user-pass-verify <script> <method> to force server ask for user/password. <script> is executable file used to check user/password pair. <method> is on of "via-env" and "via-file". Read manual about auth-user-pass-verify directive for details

You should write script by yourself.

0

At least you need server certificate. Then you can use mysql backend for user/password management. You can read more here

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .