Logging the MAC addresses of the opne VPN Clients

simongibson

I'm currently using an OpenVPN configuration with several hundred OpenVPN clients
They are connecting with a 'normal' configuration script using:
port 1194
proto udp
dev tun
ca cert and
key
dh dh1024.pem
NO duplicate cn

My openvpn-status.log contains common name and IP address issued.
Normally that is all I need to maintain records of the conenctions.
But, I'd like to record the MAC address of the interface they are using. This way I can detect if they change their hardware. Obv its not a security foolproof issue; but it would enable me to determine if something has changed.

The learn-address technique seems to be limited to IP addresses?

Any helpful hints greatly appreciated!
Thanks,
Simon

maikcat

hi there,

But, I'd like to record the MAC address of the interface they are using.

the MAC address of whom? the tun interface (which is layer3 and doesnt have MAC address) or its lan one?
how openvpn suppose to know the lan mac address?and how is it associated with the vpn itself?

the MAC address can be set (in TAP interface) using lladdr directive...

This way I can detect if they change their hardware

obviousley you need a different mech to achieve this...

regards

Michael.

simongibson

Yah - Thanks
The tun interface means it isn't available. I want to avoid re-configuring 100s of clients 🙁
Maybe there is someway of detecting the physical interface being used on the client - again not wishing to reconfigure their client configuration...
Simon