OPENWRT Where is openvpn-auth-pam-so?

pacofe

Hi everybody:

I have installed openvpn-openssl y openvpn-easy-rsa in my router with OPENWRT.

The VPN connection runs ok but I want authenticate users with system users.

I have inserted in the client configuration "auth-user-pass" and it runs ok, it asks me for an user/password.

But in the server configuration I have to insert a line like this: plugin /usr/lib/openvpn/openvpn-auth-pam.so /etc/pam.d/login.

Well I'm not bi able to know where "openvpn-auth-pam.so" is, I have look up it in the router and not it is.

I have to install something else or this is not the correct system to get the authentication that I want?

Could you help me?

Thanks!

Greetings!

Traffic

plugin /usr/lib/openvpn/openvpn-auth-pam.so

Is it in:

plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so

:?:

https://forum.openwrt.org/viewtopic.php?id=2869

Alex Morris

Traffic wrote

plugin /usr/lib/openvpn/openvpn-auth-pam.so

Is it in:

plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so

:?:

https://forum.openwrt.org/viewtopic.php?id=2869

Been trying to do the same thing tonight. Got OpenVPN working with PAM and Google Auth on my Raspberry Pi, so wanted to do the same on OpenWRT.

It looks like there isn't a ready-made PAM plugin for OpenVPN for the latest OpenWRT, which will scupper any attempts to use OpenVPN with Google Authenticator on OpenWRT. At least, I can't see an OpenVPN PAM plugin in the make menu for OpenWRT (Chaos Calmer).

I've never attempted to cross-compile from source, but when I get some spare time I may give it a go. Who knows? I might get lucky and somehow make it work.

Alex Morris

Confirmed: https://dev.openwrt.org/ticket/18610 says I need to do it myself if I want it done.

Traffic

Technically, that link says:

it's not supported. if you want to change that, feel free to submit a patch

Compiling the openvpn source is relatively easy .. but compiling it for openwrt may not be :shock:

rseiler

Another way to do is to use the "auth-user-pass-verify" directive in the OpenVPN config file in OpenWRT, and point it to a verification script, which in turn accesses a file where you've stored the usernames and passwords (or usernames and hashes, perhaps).

I haven't see that script around for OpenWRT, however, just DD-WRT.

rseiler

Found one which works:
https://github.com/troydm/ovpnauth.sh