3

So I have an openvpn running on a debian machine and I have set it up to work with PAM authentication via the pam module AND NOT the provided example script. However, requirements changed and now I need to start pushing specific client configuration to my users. After digging up a bit I used the client-config-dir directive and username-as-common-name but unfortunately my client specific settings aren't pushed. I suspect it is due to the fact that username-as-common-name might only be working if used with auth-user-pass-verify auht-pam.pl via-file setting. I'm pasting my configuration file here:

port 1194
proto udp
daemon
dev tun
keepalive 5 15
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh1024.pem
server 10.10.11.0 255.255.255.0
;push "redirect-gateway def1"
push "route 87.121.59.0 255.255.255.0"
push "route 77.95.0.0 255.255.0.0"
push "route 72.233.0.0 255.255.0.0"
push "route 193.47.74.0 255.255.255.0"
push "route 72.233.107.0 255.255.255.0"
push "route 184.107.160.211 255.255.255.255"
push "route 85.17.103.0 255.255.255.0"
push "route 173.201.97.0 255.255.255.0"
push "route 95.211.34.0 255.255.255.0"
push "route 80.72.68.217 255.255.255.255"
push "route 87.121.59.0 255.255.255.0"
push "route 85.14.44.0 255.255.255.0"
;route-gateway 10.10.11.5
verb 5
log /var/www/random_log
;client-to-client
status openvpn-status.log 7200
plugin /usr/lib/openvpn/openvpn-auth-pam.so common-auth
client-cert-not-required
;auth-user-pass-verify auth-pam.pl via-file
username-as-common-name
client-config-dir ccd
#comp-lzo

In essence I want client-specific settings to work AND to retain logging using the PAM module and not the provided script.

  • 1
    client-config-dir works fine with username-as-common-name and plugin openvpn-auth-pam.so for me. Anything in the server logs? – mgorven Feb 11 '13 at 21:40
0

same for me i used your post to find put how to do it without cert in a server-client scenario

just placed in openvpn config file:

  • route for vpnserver to manage the route (not push because i'm not pushing routes to clients yet)

  • plus these two lines

username-as-common-name

client-config-dir /etc/openvpn/ccd

and a similar iroute command in ccd directory in a file called as the username.

  • 1
    Hi Erwin and welcome on serverfault. Please take a read at how to post a good answer in the help section. Also, please edit your question and add more details, like the "similar iroute command in ccd directory". Try to be more precise, Imagine you're explaining it to your kid sister. – Marco Oct 12 '17 at 6:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.