6

Is anyone successfully running OpenVPN with Active Directory integration? Are you using the openvpn.net or the openvpn.net/opensource version of OpenVPN? Any tips, tricks or gotchas or did it "just work?" (yes, I've seen this How To but sometimes how tos aren't as simple as they look for me).

Backstory: I have a very old Cisco Concentrator (3000 series) that needs to be replaced. I'd like the replacement to be something that integrates with AD user/passwords. I have a stack of reasonably modern HP DL320 boxes laying around and that led me to the OpenVPN idea...

5 Answers 5

6
+150

I prefer having OpenVPN auth against PAM (with LDAP, or Kerberos), since this is the most flexible solution. I've had the impression that the LDAP plugin provided by OpenVPN is sorta dirty ad-hoc solution -- nothing compared to the LDAP or Kerberos plug-ins for PAM. I've had problems from time to time where proper user credentials where refused access, a retry solved that problem. My current (production) setup authenticates against PAM. The PAM stack has Kerberos (pam_krb5) on top for OpenVPN authentication. Daily use by nearly 100 users. You can do a lot of stuff with PAM (multiple authentication mechanisms, multiple sources, etc. etc.).

2
  • 1
    I'm probably a little slow... but in your production setup is something authenticating back to Active Directory? If so, could you add a few more sentences on that?
    – Chris_K
    Jan 9, 2010 at 17:43
  • 2
    The chain looks like this: openvpn client -> openvpn server -> PAM -> PAM kerberos plugin -> AD
    – pfo
    Jan 10, 2010 at 1:50
7

With the open source version you can write your own authentication script using the 'auth-user-pass-verify' option.

I never put it into production, but I did hack together a working script that authenticates users against my directory.

Another option is the openvpn-auth-ldap plugin.

3
  • 1
    In the spirit of the original question: Have you successfully used the auth-ldap plugin in a live environment?
    – Chris_K
    Jan 6, 2010 at 0:27
  • For those who have upvoted this one, have you done what's described in this response? I'm simply trying to find someone who has -- and hear a little about the experience.
    – Chris_K
    Jan 10, 2010 at 23:33
  • @Chris, no I have not used auth-ldap in production.
    – Zoredache
    Jan 11, 2010 at 0:46
4

we require AD authentication for our openvn installation(which group/OU integration) and found the easiest was using the radius plugin using windows internet authentication services (i.e. win2003 radius)

not that the auth-ldap doesn't work well, just the radius integration ended up being easier for us to get working (YMMV)

for what it's worth, discovered in hindsight: the commercial offering - openvpn-AS (or openvpn.net as you've referred to it) - works really well out of the box, for both radius and LDAP authentication, and the license fee is really low - works with concurrent connections rather than named users (at $250 for 50 concurrent connections with smaller bundles available). Also, the user take-on is well put together and makes new user and migration of existing clients relatively painless.

2
  • Windows 2003 radius is IAS, yes? Any licensing costs or issues associated with installing that?
    – Chris_K
    Jan 9, 2010 at 17:44
  • IAS is a radius implementation, yes. No additional licensing that I'm aware of, it's a standard optional add-on for a 2003 server (AFAIK) Jan 9, 2010 at 18:20
1

I've implemented solution like that :

OpnVPNClient ---> OpenVPNServeur + plugin Radius---> Windows2003SRV(IAS+AD)

It's working fine !

You could find it with search "blog laurent besson"...

This article made from many others, don't forget it :)

-2

I guess my only question is why deal with open VPN when MS has a perfectly acceptable vpn solution built in. Of course it does depend on your situation, but my god is it easy to implement.

6
  • For some places "free and open source" is a requirement for deployment -- the non-profit where I work especially. Also, IMHO OpenVPN is very easy to implement.
    – scraft3613
    Jan 9, 2010 at 16:02
  • While "free and open source" aren't hard requirements, the fact that I'd have to buy another OS license is definitely part of the reason I'm looking at OpenVPN.
    – Chris_K
    Jan 9, 2010 at 17:40
  • You already indicated that AD integration was part of the requirement. Therefore, license purchased. You can even do it with one NIC on your DC if you have to (not exactly recommended though.) I've seen well over 200 people logged in to a w2k3 server at my old office with nary a complaint. Jan 10, 2010 at 2:35
  • While this debate is fun, it certainly isn't in the spirit of the question I asked: Have you run OpenVPN with AD integration? If not, we're done right? Thanks for the alternatives.
    – Chris_K
    Jan 10, 2010 at 23:07
  • 1
    Also, the OP my not want to run his VPN on his DC, there are many reasons for that, particularly for security, so if he wanted to run an RRAS VPN, he would need another OS licence.
    – Sam Cogan
    Jan 11, 2010 at 10:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .