Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking to deploy openvpn as a linux RAS server (rather than site-to-site) and i'd like to use two factor authentication, specifically the use of ssl certificates and passwords tied into an ntlm domain or ldap server.

Is this even possible ? I'm really struggling to dig up information on doing such a thing so I'm starting to doubt it a little. If anyone has done this it'd be good to know (or knows of an open source way to do such a thing), or even better has the openvpn server config needed to pull this off.

edit: i know an ssl cert isn't an ideal factor. :)

share|improve this question
up vote 5 down vote accepted

From the client side you need the following option to prompt the user for username/password


On the server side you need the following option to verify the username/password

auth-user-pass-verify scriptname method

scriptname is a script or program that openvpn will execute in order to verify the user/pass. If the script's return code is true (0), the user gets logged in, otherwise invalidated. method is the way user and pass parameters are passed to the scriptname.

So you need to have a script/program to validate users based on an ldap server and you're done.

Edit: related documentation Using alternative authentication methods

share|improve this answer
can you put the auth-user-pass part onto the server side ? Otherwise im liking this as an option – Sirex Mar 14 '11 at 13:06
No, that is a client only argument. It doesn't make sense to put it in the server side, since it's there to ask credentials from the user. If you don't want the user to enter any credentials, you can use the auth-user-pass filename option, which reads a user/pass pair from a txt file filename. You can put anything in that file and have scriptname authenticate the user based on other info, either way what matters is only if it returns 0 (success) or not. – forcefsck Mar 14 '11 at 13:31
May have jumped the gun slightly. I have this working in terms of certificates and user/passwords, but i have no way currently to tie a certificate to a particular domain user. i.e: if they have any valid cert and any valid password, they are let in. – Sirex Mar 14 '11 at 15:16
never mind, there's an env_var $common_name which can be used to compare against $username. awesome – Sirex Mar 14 '11 at 15:22

I have a friend who is doing exactly that: OpenVPN with SSL certificates used to authenticate each endpoint, then a username/password prompt appears and the user's credentials are authenticated off an AD server via LDAP before the OpenVPN connection will come up. I know that's what he's doing, as I have on occasion had credentials to use it, and thus logged in myself. So yes, it's possible, but I don't have the configs; sorry.

share|improve this answer
ohhh so tantalising ! lol -- any chance you could pass him the url for this question ? (please + cherry ?) – Sirex Mar 14 '11 at 8:57
He's a good egg, and a big believer in the GPL and knowledge-sharing, so we might get lucky. I've emailed him, and we'll see. – MadHatter Mar 14 '11 at 9:08
The reply comes that he found LDAP to be unreliable so switched to openVPN+radius for the user auth step. I have some configs if you're open to that option. – MadHatter Mar 14 '11 at 13:51
I'm currently getting somewhere with forcefsck's option, so I'll see where that takes me. I'll send you a message if i hit a wall on it though, currently it looks encouraging. Thanks for the help so far :) I'm actually using "net user" rather than ldap as the machine is already on the domain. Avoids messing with radius/ldap – Sirex Mar 14 '11 at 14:21
@MadHatter : Yes. please =) I would very much like to look at your config files. – Sandra Aug 29 '11 at 16:57

Have you tried to follow and use the openvpn-auth-pam ?

Have not done it myself, but would go the path described in to setup pam against AD. After that's done, telling openvpn to use pam shouldn't be hard.

share|improve this answer
I don't have the facility to extend the AD schema to include unix attributes – Sirex Mar 14 '11 at 10:52
@Sirex, ...and your AD is pre WS2003R2? (the article states that R2 and anything post that already has them) – Unreason Mar 14 '11 at 11:44
i believe so. At least, this was the blocker on the recent move from winbind to pam_krb5. May be wrong. – Sirex Mar 14 '11 at 12:53
Well ok, then winbind+pam (as described…) – Unreason Mar 14 '11 at 13:25

I use OpenVPN as a RAS server on Ubuntu and for two-fold uthentication I have a Deepnet Authentication Server which generates One Time Passwords to be used in conjunction with static passwords - which in turn authenticates the VPN users to AD.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.