Authentication with certificate and username/passwd

mtabacek

Hi,
I have a configuration for VPN tunnel with authentication certificate-based and also username/password-based authentication enabled.
But user can log in with any valid username, and given any valid certificates.
So my question is ....... How do I make sure that client1's certificate can only be used with the username "client1"? How to use the CN from the user cert as the login name (username)?
I looked in the manual but I did not come to a solution. Is there any options for this ?

I attach configuration file

config file server.conf

tls-server
server 10.20.1.0 255.255.255.0
push "route 30.1.0.0 255.255.255.0"
dev tun
proto udp
port 1194
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
comp-lzo
user nobody
group nogroup
persist-tun
persist-key
tls-auth ta.key 0
plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so login
#username-as-common-name
verb 3

config file client.conf

tls-client
pull
remote 192.168.1.102
nobind
dev tun
proto udp
port 1194
ca ca.crt
cert klient.crt
key klient.key
comp-lzo
user nobody
group nogroup
persist-tun
persist-key
verb 3
#tls-remote server
verify-x509-name server name
remote-cert-tls server
#ns-cert-type server
tls-auth ta.key 1
auth-user-pass

Thank you in advance for reply

jscarville

I am not sure this can be down with OpenVPN alone. When I was using OpenVPN with Windows clients, I had a similar problem. The solution I came up was:

issue the certificate with the CN set to the client's user name.
Force the user to a web page -- kind of like the page Hotels sometimes throw up -- where he had to enter his AD password.
If the password was accepted then set a rule allowing his OpenVPN IP address in the FORWARD table and, if applicable, the nat PREROUTING table.

A "scavenger" program ran periodically (every 30 minutes) to track usage by IP address. If an IP had no traffic between checks, it was deleted from both the FORWARD and nat PREROUTING tables.

It worked very well but there may be a less involved solution. I'd be interested in hearing of one.

I finally moved all the Windows clients to Cisco IPSec and two-factor authentication. I then dropped the web page since I now only use OpenVPN to connect to remote offices with no dedicated circuit and to let me into the network if I am traveling.

mtabacek

Thank you for this solution. I think that openvpn this alone will not be able to. I found some script http://serverfault.com/questions/358855/how-to-prevent-users-from-sharing-certificates-in-openvpn, which can be used with the options auth-user-pass-verify and it's works. I use Ubuntu 14.04 for the server and also for clients. (some clients have windows 7, there I must verify functionality).

Another problem is that I want to use authentication certtificate-based and username/password with freeRadius plugin. Everything works fine, but there is the same problem.... i need to client1's certificate can only be used with the username "client1" and I don't know how to do it......how to use the CN from the user cert as the username for freeradius.

Does anyone have experience with this???

Thank you in advance for reply

jscarville

OK, I was wrong. The are several --auth-user-pass options available.