trying to use tls/certificate instead of user/pwd authentica

drvirus

hi all ,
i have openvpn server working fine with user/pwd authentication.

but i need to use cert authentication without user/pwd propmpoton the client side.

so , i ussed a certificate for a client that contains :

client.crt
client.key
ca.crt

i need some help , wt i need to modify on the client side and server side so that the connection authentication done by certs and no user/pwd requiration

??

here is my server & client config :

[root@pbx1 keys]# cat /etc/openvpn/server.conf
port 1194 #- port
proto udp #- protocol
dev tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
reneg-sec 0
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so /etc/pam.d/login #- Comment this line if you are using FreeRADIUS
#plugin /etc/openvpn/radiusplugin.so /etc/openvpn/radiusplugin.cnf #- Uncomment this line if you are using FreeRADIUS
#client-cert-not-required
username-as-common-name
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 5 30
comp-lzo
persist-key
persist-tun
status 1194.log
verb 3

======================
client side on win7 with opevpn client :

client
dev tun
proto udp
remote xxxxxx 1194 # - Your server IP and OpenVPN Port
resolv-retry infinite
nobind
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
persist-key
persist-tun
ca ca.crt
key newclient1.key
cert newclient1.crt
comp-lzo
reneg-sec 0
verb 3
route-nopull
route 192.168.1.10 255.255.255.255 vpn_gateway

================
i have alread files
ca ca.crt
key newclient1.key
cert newclient1.crt
in the same fiolder of file.ovpn.

anyhelp ??

i just need to authenticate without user/pwd and just as i click on the .ovpn file

regards

drvirus

Traffic wrote
drvirus wrotei need to use cert authentication without user/pwd propmpoton the client side
Removing these lines and restarting your server should be sufficient.
drvirus wroteserver.conf
plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so /etc/pam.d/login #- Comment this line if you are using FreeRADIUS
username-as-common-name

thank you thank you thank you thank you thank you thank you thank you thank you thank you thank you thank you thank you
sooooooooooooooooooooooooooooooooooooooo much

it worked.

thanks alot alot alot for you and for your support

regards