Problem with auth-user-pass-verify

guenterg

Hi,
I upgraded my OpenVPN server on Windows Server 2003 from OpenVPN version 2.1.3 to 2.3.2
After the upgrade the ldpa authentication doesn't work any more. The following error is found in the openvpn.log:

Options error: --auth-user-pass-verify script fails with 'php C:\Progra~1\OpenVPN\scripts\ldap.php': Invalid argument
Options error: Please correct this error.

I have the following line in the configuration file:

auth-user-pass-verify "php C:\\Progra~1\\OpenVPN\\scripts\\ldap.php" via-file

The ldap.php file is from Sherk Chung (2007-08-15). I have it somewhere from the internet.

Is anyone using this ldap.php file and know what's the problem? Do you know any alternatives for Windows LDAP Access?

Thanks!

Günter

maikcat

just a though...

maybe openvpn cant find php binary?

can you use absolute path for the php binary itself?

Michael.

guenterg

Thanks for your reply!
I tried it already. Didn't help :-(

maikcat

can you post your complete server config?
also server logs with verb4...

Michael.

guenterg

Here is my server config

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh2048.pem
server 172.16.8.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route xxx.xxx.xxx.xxx 255.255.0.0"
push "route xxx.xxx.xxx.xxx 255.255.255.0"
push "route xxx.xxx.xxx.xxx 255.255.255.0"
push "route xxx.xxx.xxx.xxx 255.255.255.255"
client-config-dir ccd
route xxx.xxx.xxx.xxx 255.255.255.0
push "dhcp-option DNS xxx.xxx.xxx.xxx"
push "dhcp-option DOMAIN abf.co.at"
keepalive 15 90
tls-auth ta.key 0 # This file is secret
comp-lzo
max-clients 50
persist-key
persist-tun
status "C:\\Program Files\\OpenVPN\\log\\openvpn-status.log"
log-append  "C:\\Program Files\\OpenVPN\\log\\openvpn.log"
verb 3
script-security 3 system
tmp-dir "C:\\Program Files\\OpenVPN\\log"
auth-user-pass-verify "php C:\\Progra~1\\OpenVPN\\scripts\\ldap.php" via-file
#auth-user-pass-verify "C:\\Progra~1\\PHP\\php C:\\Progra~1\\OpenVPN\\scripts\\ldap.php " via-file

I have removed all comments to keep it short. At the moment I can't send you the logfile with verb 4 because I reinstalled the old version.
I'll try to install a test environment later on.

maikcat

please read this

--script-security level
This directive offers policy-level control over OpenVPN's usage of external programs and scripts. Lower level values are more restrictive, higher values are more permissive. Settings for level:

0 -- Strictly no calling of external programs.
1 -- (Default) Only call built-in executables such as ifconfig, ip, route, or netsh.
2 -- Allow calling of built-in executables and user-defined scripts.
3 -- Allow passwords to be passed to scripts via environmental variables (potentially unsafe).

OpenVPN releases before v2.3 also supported a method flag which indicated how OpenVPN should call external commands and scripts. This could be either execve or system. As of OpenVPN v2.3, this flag is no longer accepted. In most *nix environments the execve() approach has been used without any issues.

To run scripts in Windows in earlier OpenVPN versions you needed to either add a full path to the script interpreter which can parse the script or use the system flag to run these scripts. As of OpenVPN v2.3 it is now a strict requirement to have full path to the script interpreter when running non-executables files. This is not needed for executable files, such as .exe, .com, .bat or .cmd files. For example, if you have a Visual Basic script, you must use this syntax now:

--up 'C:\\Windows\\System32\\wscript.exe C:\\Program\ Files\\OpenVPN\\config\\my-up-script.vbs'

Please note the single quote marks and the escaping of the backslashes (\) and the space character.

The reason the support for the system flag was removed is due to the security implications with shell expansions when executing scripts via the system() call.

Michael.

guenterg

Thank you Michael for this hint!
I'll try it the next days.

guenterg

Hi Michael,

I installed the actual version of OpenVPN on a Testserver and I know now with your help what was wrong. I had to replace

auth-user-pass-verify "php C:\\Progra~1\\OpenVPN\\scripts\\ldap.php" via-file

auth-user-pass-verify 'C:\\Progra~1\\PHP\\php.exe C:\\Progra~1\\OpenVPN\\scripts\\ldap.php' via-file

Have to use
* single quotes and
* full path with fileextension

Thanks for your help!

Regards
Günter

maikcat

hello gunter,

good news then... 😃 😃 😃

Closing topic

Michael.