Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am looking forward to create an as-simple-as-possible OpenVPN set-up.

I would like to use a single password to secure the communication instead of a set of key files.

How can I set it up this way?

share|improve this question

3 Answers 3

Yes, OpenVPN calls this the "static key" setup:

http://openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html

Note the listed disadvantages:

  • Limited scalability -- one client, one server
  • Lack of perfect forward secrecy -- key compromise results in total disclosure of previous sessions
  • Secret key must exist in plaintext form on each VPN peer
  • Secret key must be exchanged using a pre-existing secure channel
share|improve this answer
    
Really "one client, one server"? AFAIK one key can be used for many clients in a normal key-based setup if configured this way, isn't it possible the same way with a "static key"? I mean can't 2 clients connect to one server with the same password? –  Ivan Aug 14 '12 at 15:29
    
I actually don't know, and I'm just citing the docs. I've never done pre-shared keys on OpenVPN, only certificates. There is a configuration that will allow multiple clients to connect using the same certificate, though, so it's possible that may also apply to the PSK configuration. I imagine that you won't be able to set static IPs for each client using CCD files, as the server can't distinguish between the clients, but DHCP on the tunnel should work. –  cjc Aug 14 '12 at 15:43

To use password authntification from file, you should use this directives in server configuration file:

  • client-cert-not-required to allow authentification with user/password only
  • username-as-common-name to get common name from username, because it can't be taken from certificate
  • script-security 2 to allow calling external scripts
  • auth-user-pass-verify <script> <method> to force server ask for user/password. <script> is executable file used to check user/password pair. <method> is on of "via-env" and "via-file". Read manual about auth-user-pass-verify directive for details

You should write script by yourself.

share|improve this answer

At least you need server certificate. Then you can use mysql backend for user/password management. You can read more here

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.