Both certificate OR plugin-auth-pam authentication

jgould

Hello,

My issue is that I have VoIP phones (yealink) that support openvpn and have a need to actually use this feature to connect them back to my main office where our PBX is so they can register. The implementation on these phones is pretty simple though and only supports client certificate based authentication. I have made this work after some trial and error.

However, I'd also like to have users connect back to our network using openvpn from their PC's. I've made this work with client certificates plenty of times. I've also made it work using the user/password by including;

plugin /usr/lib/openvpn/openvpn-auth-pam.so login
client-cert-not-required
username-as-common-name

However, I'm not sure if it is possible to have both of these functional at the same time. Basically, allow the phones to connect using just the certificates and require desktops to connect using username/password (and the ca). Is this possible? So far I have not been able to make it work. If I just include the client certificates with the above lines added it won't connect.

Also, do you have any suggestions on a better way to handle this? Should I just use unique client certificates for everything (would that be safer then the user/password)? Or should I have another openvpn interface for the phones (currently using vtun0 for everything, was thinking perhaps I could do vtun0 and vtun1 and configure them differently). Just looking for any advice or best practice for something like this.

Thanks.

jgould

debbie10t wrote
jgould wroteallow the phones to connect using just the certificates and require desktops to connect using username/password (and the ca). Is this possible?
Not on the same server instance .. you require two server instances on two separate ports (Same machine and Local IP) - One with user auth, the other without.

Thanks, that sort of the impression I was getting.

I'm using a Ubiquiti Edgerouter to run OpenVPN. So if I understand correctly, I could create another interface (already have vtun0, so vtun1), set it up basically the same exact way except tell it to use a different port and to include/exclude the username/password parts of the configuration, correct?

And while I have your ear, the how to articles I've read seem to imply the right way to setup OpenVPN is certificate based authentication. It at least sounds like that is the preference and perhaps stronger method. Is that the case, or would the username/password be stronger?

Thanks