How can I stop/deny multiple tunnelling/sessions with same user-name/password (From different client machine)? Right now I am using openvpn-2.3.2 community version on server and client. I am using Fedora 16_x64 as server and Fedora 17_x86 as client. With the following server configuration I can successfully create two separate tunnels from two different clients using same user-name/password which I don't want. [b]NOTE : [/b]Duplicate-cn is not present in my server configuration file. [b]Server Configuration[/b] ================= push "redirect-gateway bypass-dhcp" push "dhcp-option DNS 8.8.8.8" script-security 3 system client-connect /opt/iss/isec/etc/vpn/clientconnect.sh client-disconnect /opt/iss/isec/etc/vpn/clientdisconnect.sh client-cert-not-required plugin /opt/iss/isec/vpn/lib/openvpn/plugins/openvpn-plugin-auth-pam.so login username-as-common-name topology subnet If you need any more information please let me know. Thanks, Prosenjit

You are using an external program for the authentication and authorisation: [quote]plugin /opt/iss/isec/vpn/lib/openvpn/plugins/openvpn-plugin-auth-pam.so login[/quote] And when the PAM-modules returns "succesfull validation", OpenVPN will continue to connect the client. So your external validation should, in this case, allso check if the client if allready connected.

Disable multiple tunnel with same username/password

prosenjit@innovaidesystems.com

How can I stop/deny multiple tunnelling/sessions with same user-name/password (From different client machine)? Right now I am using openvpn-2.3.2 community version on server and client. I am using Fedora 16_x64 as server and Fedora 17_x86 as client. With the following server configuration I can successfully create two separate tunnels from two different clients using same user-name/password which I don't want.

NOTE : Duplicate-cn is not present in my server configuration file.

Server Configuration
=================
push "redirect-gateway bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
script-security 3 system
client-connect /opt/iss/isec/etc/vpn/clientconnect.sh
client-disconnect /opt/iss/isec/etc/vpn/clientdisconnect.sh
client-cert-not-required
plugin /opt/iss/isec/vpn/lib/openvpn/plugins/openvpn-plugin-auth-pam.so login
username-as-common-name
topology subnet

If you need any more information please let me know.

Thanks,
Prosenjit

mwandelaar

You are using an external program for the authentication and authorisation:

plugin /opt/iss/isec/vpn/lib/openvpn/plugins/openvpn-plugin-auth-pam.so login

And when the PAM-modules returns "succesfull validation", OpenVPN will continue to connect the client.
So your external validation should, in this case, allso check if the client if allready connected.