Permit only N connection for a user/config in openvpn

Question

I have openvpn on a server and a few client configs. How can I permit only a single connection for a user? Or if not necessarily single connection, but no more than N connections for user. I've not found anything regarding this matter in the documentation.

Answer 1

If you provide your own connect scripts, you can control how many connections are allowed per user. The only catch is that you need to have a persistent storage of some kind. Note that the default behavior is to allow a client only once.

Here is what you need to do.

On the server, include the following lines in the config:

script-security 2
duplicate-cn
up /etc/openvpn/connectScript.sh
client-connect /etc/openvpn/connectScript.sh
client-disconnect /etc/openvpn/connectScript.sh

The duplicate-cn is needed for having simultaneous client connections, the script-security 2 is needed for running external scripts. On the client, you need to add the explicit-exit-notify option, because without that, the server won't receive a disconnect message when the client exits or disconnects, thus, the disconnect script will be called only upon timeout.

The following environmental variables will be exported for the script (along with others -- see the "Environmental Variables" section of the manpage of openvpn):

• script_type can be either up, client-connect or client-disconnect, depending on when the script is called.
• common_name will contain the name of the user connecting, that is, the value of the CN field of the certificate or the username, depending on what kind of authentication you have on the server.

If script_type is up, you need to clear all client connection data, since at that time openvpn just started, and no client connections are present.

If script_type is client-connect, then your script needs to decide if the user specified in the common_name variable has already been connected, and if so, how many times. If the connection is permitted, the script should exit with a value of 0. Any other exit value is interpreted as an error, and the client won't connect. So you need to count the clients with the same name, and exit with an error if there are too many connections for that user. You should decrease the count when script_type is client-disconnect.

You need to make sure that the script is runnable by the user who runs the openvpn process, which is preferably not root (specified by the user and group configuration variables).

Here is a sample connect script. using this, every client can have two connections, the third will be denied. This is a very primitive sample only, you should create a more sophisticated one, but it's a good start.

#!/bin/bash

PERSIST_DIR=/tmp/pDir
mkdir -p $PERSIST_DIR

function handle_connect {
  CLIENTFILE=$PERSIST_DIR/$common_name
  if [ -e "$CLIENTFILE" ]; then
     NUMCONN=$(cat $CLIENTFILE)
     NEWCONN=$(expr $NUMCONN + 1)
     if [ $NEWCONN -gt 2 ]; then exit 1; fi
     echo $NEWCONN >$CLIENTFILE
  else
     echo 1 >$CLIENTFILE
  fi
}

function handle_disconnect {
  CLIENTFILE=$PERSIST_DIR/$common_name
  if [ -e "$CLIENTFILE" ]; then
     NUMCONN=$(cat $CLIENTFILE)
     NEWCONN=$(expr $NUMCONN - 1)
     echo $NEWCONN >$CLIENTFILE
  fi
}

case "$script_type" in
  up)
        rm -f $PERSIST_DIR/*
        ;;
  client-connect)
        "handle_connect"
        ;;
  client-disconnect)
        "handle_disconnect"
        ;;
esac

Answer 2

I don't think this is possible with password authentication, as you can only limit global max-clients. However, this is default the behavior with certificate authentication.

# Uncomment this directive if multiple clients
# might connect with the same certificate/key
# files or common names.  This is recommended
# only for testing purposes.  For production use,
# each client should have its own certificate/key
# pair.
#
# IF YOU HAVE NOT GENERATED INDIVIDUAL
# CERTIFICATE/KEY PAIRS FOR EACH CLIENT,
# EACH HAVING ITS OWN UNIQUE "COMMON NAME",
# UNCOMMENT THIS LINE OUT.
;duplicate-cn

Using certificates for authentication is well explained in OpenVPN PKI HOWTO. While you need one client certificate per every client computer, you could allow more simultaneus connections for a single user by allocating him more certificates.

• The blue user has two computers and needs both client1.crt and client2.crt + keys + CA (for connecting them both at the same time: if there's no need for simultaneous use, 1 is enough).
• The red user has only one computer, so client3.crt + key + CA is enough.
• Clients don't need server.crt and the server doesn't need to know clients: they all trust the CA.