Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been using Shibby's build of Tomato (64k NVRAM version) on my Asus N66U router in order to run an OpenVPN server.

I'm curious whether it's possible to setup this OpenVPN server to require both a certificate AND a username/password before a user is allowed access.

I noticed there's a "challenge password" entry when filling out the certificate details, but everyone says to leave it blank "or else"; I have no idea why, and I can't find an explanation. In addition, I've Google'd this issue a bunch and have noticed people talking about a PAM module for OpenVPN in order to authenticate via username/password, but that appeared to be an either/or option; in other words, I can force authentication via username/password OR certificate. I want to require both.

Is this possible? If so, how?

share|improve this question

The OpenVPN feature you're looking for, which will allow the server to authenticate clients based on both their certificate and a credential, is auth-user-pass-verify. This feature allows the server to pass the username/password provided by the remote user to a script that performs the authentication. At that point you can validate the credentials against anything you want-- PAM, RADIUS, LDAP, smoke signals, etc.

I know nothing about the "Tomato" firmwares so I'm not even going to attempt to give you a step-by-step here. I did some quick searching and I suspect you could use the OpenVPN "Custom Configuration" option to include a auth-user-pass-verify reference. You'll need a script to perform the authentication.

Do some searching and I suspect you'll find "Tomato"-specific references.

share|improve this answer

The challenge password is a passphrase used to allow decryption of the key. That's the only way you can really do a "password" and a key.

You can really only verify by password or key, not both. If you have both methods enabled, it will try key authentication first, and if that fails, it will fall back to password authentication.

Not having a passphrase on a key makes it easier for someone to mimic your identity if they happen to get a hold of the key.

I'd suggest finding out why the interwebz say you shouldn't use passphrases on keys and see if it's actually a problem.

share|improve this answer
Ya that's what I've been having trouble answering. Hopefully someone else can enlighten us in that regard; it seems like a counterintuitive suggestion. – Eric Aug 23 '12 at 15:24
In the meantime, is there a quantifiable way to compare the strength of a certificate+requirement to only a username/password combo? I'm assuming orders of magnitude more difficult to crack, but that's just an assumption based on my circumstantial knowledge. – Eric Aug 23 '12 at 15:35

auth-user-pass-verify is the right thing todo. In addition you can force auth-user username has to be the certified CN you can also force openvpn to make only one connection each cert at a time.

That way an "mimic" has to have the right user compared to the certc CN and the right pass and he has to logon at a time the real owner doenst

In addition you may think about an IDS, depending which one you choose you can even narrow it down there like allowed external ip ranges, logon times and so on.

Any exposed cert should be revoked immediately. The signing server should be off net - transfer key by usb - then you have a real tight secure access.

and no you should not password a cert.

  1. Easy to bruteforce.
  2. You cannot lock an user (cert pass is offline only).
  3. People loose their passwords all the time forcing you to revoke and recreate a cert everytime - big risk of having a lot of certs out there where you maybe sometimes forget the revoke.

But if you really want you can use auth-user and cert password same time there will be no fallback or something.

First openvpn will use the cert password to decrypt the private key to establish a connection - then auth-user kicks in serversidly - if credentials are wrong you're out.

However if an attacker get the regular credentials you're already in trouble and chances are high he got the cert password too.

So I don't see real benefit here just a lot of downsides and a wrong feeling of more security.

share|improve this answer

I followed this tutorial (with TomatoUSB Shibby 1.28 on my Asus N66U): This may help you a lot.

share|improve this answer
AndyZ - welcome to SF, but we like answers here to contain more substance than just a link (which can rot with age). If you can overhaul this answer to contain the important bits of the method you've followed as well as the link to the article, it could be a really good answer. – MadHatter Jan 17 '14 at 20:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.