Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an OpenVPN server which uses certificates and LDAP authentication.

The problem is that, one user could share his certificate and other valid LDAP users could use this certificate.


How do I make sure that Bob's certificate can only be used with the LDAP user "bob"?

share|improve this question

There are many options, since OpenVPN is an open source project, and it has a ability to write your own-authentication hook there are many people who have done many different things to provide different levels of authentication.

I haven't tried most of these just seen them mentioned in the docs/blogs/maillists. Some of these may require patches or the non-free version.

One main method will be to make your the private portion of your key-pair prohibitively difficult to extract/copy.

If protecting they key is cost-prohibitive, not supported on your client platforms or not possible for some other reason then you are left with a few options.

  • Require frequent renewals of the cert, so a copied certificate cannot be used for long.
  • Set a lot of logging on your server, to watch for anomalies. If Bob normally only logs in from his house, and then one day, he starts logging in from Acme Inc. then you may need to investigate.

  • Setup multi-factor authentication. Your certificate counts as the 'something you have'. So you should be looking at alternatives in the 'something you are', or 'something you know'. This includes bio metrics, or passwords/pass-phrases.

  • As I mentioned OpenVPN provides for very flexible authentication. This uses the auth-user-pass-verify option. This option passes the provided username and password to an external script/program which will make the authentication decision based on whatever you want.
share|improve this answer
I can use the auth-user-pass-verify /etc/openvpn/scripts/ via-env to get the username of the user. Do you know if I also can get the ID from the certificate the user is using? If so, then I can write a Perl script that checks a yaml file with known cert IDs. – Sandra Feb 10 '12 at 16:59
Unfortunately I don't know of a method to get the id/subject/details from the cert used, but that doesn't meant that it isn't possible. – Zoredache Feb 10 '12 at 17:58
Found the solution and posted it. – Sandra Feb 15 '12 at 15:25
up vote 8 down vote accepted

According to this post, common_name can not be faked by the user.

Add this to openvpn server.conf

script-security 2

# untrusted state
auth-user-pass-verify /etc/openvpn/scripts/ via-env

/etc/openvpn/scripts/ contains


# username and common_name must be the same to allow access.
# users are not allowed to share their cert
if [ $username != $common_name ]; then
   echo "$(date +%Y%m%d-%H%M%S) DENIED  username=$username cert=$common_name" >> /var/log/openvpn-access.log
   exit 1

echo "$(date +%Y%m%d-%H%M%S) GRANTED username=$username cert=$common_name" >> /var/log/openvpn-access.log

exit 0


This is for OpenVPN 2.1.4. In 2.2.0 have they added many new variables that you can see by env >> /tmp/env, where one of these new variables is the certificates fingerprint/serial number.

share|improve this answer

I'm not a security pro I am strict about security. Your question precisely reaches the core of IT security: trust. As i see it one should never assume that Bob can be trusted. Sure, Bob might be a really nice and trustworthy guy. He's worked at your company for 20+ years. However, the person "Bob" is entirely irrelevant in your IT infrastructure.

Bob uses arbitrary 'relays' that permit access. Relays can be anything: a password, certificate, hardware token, iris scan, DNA. They're keys that permit access to your system. If your question is about verifying the identity of the person who is using a key, the only honest answer probably is that you'll have to be in the same room. In all other cases I think you mustn't assure yourself that that Bob really is Bob and currently not being held at gun point while gaining his access. So in your IT infrastructure design plan the logical thing is not to refer to "Bob": an entity gained access to your site.

Because you can only really know that 'an entity' gained access with a key that you passed out in the past the proper perspective probably is to limit the number of doors the key can open. The more keys you pass out the less doors they open.

OpenVPN also has an option to permit only one concurrent connection per key. Then if Alice does log in with Bob's key while Bob is already inside, Alice is denied access. Unfortunately this also means that Bob can't login when Alice is logged in with Bob's key. So you should configure your system to inform you of concurrent login attempts from multiple source IPs. And kick off both when some violation occurs so Bob will have to dial for help.

The point is: don't assure yourself of things you can't be sure of and keep this in mind when designing your security plan. Assume there's always a smarter person out there, way ahead of you, who can't wait to prove you wrong... just 'for the lulz.' :-)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.