Link individual keys to individual users

Alex Morris

I expect I'm just not searching with the correct search terms, but I haven't been able to find anything either on this forum or through Google.

In an OpenVPN deployment which uses both keys and usernames for authentication, how can I link a specific key to a specific user so that attempts to connect with a different username will fail?

Right now I have an OpenVPN server on Debian. The server has been configured to use plugin openvpn-auth-pam.so login, and combined key/username authentication has been tested and works.

The server has three local user accounts: Alice, Bob, and Carol (for illustrative purposes; the real account names are different). Alice and Bob are allowed to use the VPN so they each have a unique key. Carol isn't allowed to use the VPN so doesn't have a key.

How do I configure OpenVPN to ensure that Alice's key can only be used with Alice's username and that attempts to connect with her key but Bob's or Carol's username will be rejected? Ditto for Bob.

Similarly, how do I configure OpenVPN to reject any connection attempts from Carol if she happens to obtain either Alice or Bob's key?

Traffic

Alex Morris wrotehow can I link a specific key to a specific user

The common_name of the cert provides you with the hook to link to a user name.

However:

The manual wrote--auth-user-pass-verify cmd method

Require the client to provide a username/password (possibly in addition to a client certificate) for authentication.

OpenVPN will run command cmd to validate the username/password provided by the client.

The command cmd is up to you to create your own for your specific environment.

Alex Morris wrotehow do I configure OpenVPN to reject any connection attempts from Carol if she happens to obtain either Alice or Bob's key?

Check the source ip .. with a script or firewall setting ..

If Carol gets access to Alice or Bobs cert/key and user/pass then you have to filter on source address but that is beyond the scope of this forum.

Alex Morris

In other words, OpenVPN's built-in functionality isn't sufficient for such a granular approach. Anyone in possession of a valid key and username can connect, and anything more granular than that requires additional programming.

Traffic

There is no "one size fits all" .. you have been living in a dream world Neo.

The cert/key mathematics for OpenVPN is actually provided by OpenSSL

Google OpenSSL

or discuss ..

Alex Morris

Traffic wroteThere is no "one size fits all" .. you have been living in a dream world Neo.

The cert/key mathematics for OpenVPN is actually provided by OpenSSL

Google OpenSSL
or discuss ..

That was an observation to ensure I'd understood your point. It was not a complaint.

Traffic

There is another level of security you may like to add ..

When you create your client cert/key (with easy-rsa) encrypt the files with a password.
This is the default behavior for easy-rsa 3 ..

That way, if an untrusted third party gets access to the files they will not be able to use them without the password. But bear in mind .. it is quite trivial to mount a brute force attack on an individual file.