Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I managed to setup openvpn but now I want to integrate a user/pass authentication method so, even though I haven't added the auth-nocache in the server config, whenever I try to connect it returns with the following message on the client side:

ERROR: could not read Auth username from stdin

My server.conf file contains basic stuff, everything works up untill I try to implement this for of authentication.

mode server
dev tun
proto tcp
port 1194

keepalive 10 120

plugin /usr/lib/openvpn/openvpn-auth-pam.so login

client-cert-not-required
username-as-common-name

auth-user-pass-verify /etc/openvpn/auth.pl via-env

ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem

user nobody
group nogroup
server 10.8.0.0 255.255.255.0

persist-key
persist-tun
#persist-local-ip

status openvpn-status.log
verb 3
client-to-client

push "redirect-gateway def1"
push "dhcp-option DNS 10.8.0.1"
log-append /var/log/openvpn
comp-lzo

I searched all over the net for a solution and all answers seems to be related to the auth-nocache param which I haven't set.

The directive auth-user-pass-verify /etc/openvpn/auth.pl via-env points to a script which is executed to perform the authentication. A false authentication should result in a exit 1 while a true one should result with exit 0. For testing, that script auth.pl returns exit 0 no matter what the input is but it seems that the file is not executed before the error raises.

auth.pl file contents:

#!/usr/bin/perl


my $user = $ENV{username};
my $passwd = $ENV{password};

printf("$user : $passwd\n");
exit 0;

Any ideas?

share|improve this question
1  
does auth.pl have execution permission ? –  eicto Nov 7 '12 at 5:18
add comment

1 Answer

Have you tried providing the script-security 3 option to allow openvpn to run external programs?

Although a better solution for requesting a password would probably be to setup OpenVPN to listen on a management port and to be hold. You can write a script/interface that will collect the credentials from the user and then you can make a socket connection and provide the credentials and release the hold.

share|improve this answer
    
Setting script-security 3 didn't help unfortunately. I still receive the same message. Openvpn keeps asking for username and password. –  user56231 Oct 12 '10 at 12:42
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.