The title says it all. I've setup OpenVPN to prompt for a username and password, but after testing, anything I put in the username/password field seems to let me connect. Here is my server config:
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
keepalive 10 120
verb 3
mute 3
syslog
writepid /var/run/openvpnd.pid
management 127.0.0.1 14
management-log-cache 100
topology subnet
script-security 3
port 1194
proto udp
cipher bf-cbc
auth sha256
client-config-dir /jffs/etc/openvpn/ccd
comp-lzo adaptive
tls-server
ifconfig-pool-persist /tmp/openvpn/ip-pool 86400
client-to-client
fast-io
tun-mtu 1500
mtu-disc yes
server 10.10.8.0 255.255.255.0
dev tun2
tun-ipv6
push "route 10.10.10.0 255.255.255.0"
auth-user-pass-verify /jffs/etc/openvpn/auth/verify.sh via-file
As you can see the last two lines come from my additional config settings. The auth-user-pass-verify command is pointing to the verify.sh file. I'll post the contents of that shortly. First, here is the client config:
remote xxxxxxxxxx.org 1194
auth-user-pass
client
dev tun
proto udp
resolv-retry infinite
ns-cert-type server
nobind
persist-key
persist-tun
float
cipher BF-CBC
auth SHA256
ca ca.crt
cert client.crt
key client.key
script-security 3
comp-lzo
verb 5
I used this howto in order to create the verify file I'm using:
http://www.dd-wrt.com/wiki/index.php/OpenVPN#Auth_with_username_and_password
And here is the contents of that file:
#!/bin/sh
USERS=`cat ./users`
genhash() {
HASHPASS=`echo -n "$1$2" | md5sum | sed s'/\ -//'`
i=0
while [ $i -lt 10 ]; do
HASHPASS=`echo -n $HASHPASS$HASHPASS | md5sum | sed s'/\ -//'`
i=`expr $i + 1`
done
echo -n $HASHPASS
}
verify() {
Login=`echo $1 | awk '{print tolower($0)}'`
echo Logging in as: $Login
#echo Password is: $2
[[ $# -eq 2 ]] || exit 1
for i in $USERS; do
Name=${i%:*}
PassHash=${i#*:}
Logincmp=`echo $Name | awk '{print tolower($0)}'`
#echo Logincmp is: $Logincmp
if [ "$Logincmp" == "$Login" ]
then
#echo "Login('$Login') is equal to Logincmp('$Logincmp')"
GENHASH=`genhash "$Login" "$2"`
#echo genhash returned $GENHASH
#echo and PassHash is: $PassHash
if [ "$GENHASH" == "$PassHash" ]
then
echo Password hashes match
exit 0
fi
fi
done
}
if [ "$1" == "--genhash" ]
then
Login=`echo $2 | awk '{print tolower($0)}'`
echo `genhash "$Login" "$3"`
exit 1
fi
There is a users file in the same directory with a username and password hash in this format:
username:password
I only have one username/password input so far, but the problem as stated in the beginning is not that I can't connect, but that it seems any username and password combo I use will connect successfully from the client. How is this happening when clearly it should verify against the users file, and then reject it based off of not being correct?
P.S - I've also made sure that both the verify.sh and the users are wide open as far as permissions go. I'm stumped. Any help you guys could provide would be greatly appreciated.
