password question

dmcdivitt

I'd like to have password authentication in addition to certificates. I've never seen this work. The client connects by way of the gui. When reading it says to use "build-key-pass" when making certificates. Is an additional password file created at that time? Can I do this standalone without having to start from scratch with new certificates? I also read "auth-user-pass-verify" can be included in the server config to call a script for authentication and a sample script exists in the source code download. How do others do this and where can I see an example? My server config is below. Thanks

port 443
proto tcp
dev tap
dh ..\\easy-rsa\\keys\\dh1024.pem
ca ..\\easy-rsa\\keys\\ca.crt
cert ..\\easy-rsa\\keys\\server.crt
key ..\\easy-rsa\\keys\\server.key
server-bridge
push "redirect-gateway local def1 bypass-dhcp"
push "dhcp-option DNS 192.168.213.1"
client-to-client
keepalive 10 120
cipher AES-256-CBC
auth MD5
comp-lzo
persist-key
persist-tun
verb 3
mute 20

maikcat

hi there,

When reading it says to use "build-key-pass" when making certificates.

build key pass simply creates a certificate and PROTECTS the key with a password...

nothing more nothing less...

the user is forced to enter key's password every time he connects...

i assume that you want to create username/password pairs in addition to certificate use..

Can I do this standalone without having to start from scratch with new certificates?

if my above statement is true , yes you can

How do others do this and where can I see an example?

they are using a pam plugin read below:

http://openvpn.net/index.php/open-source/documentation/howto.html#auth

regards,

Michael.