oberman
Hi,
I haven't used OpenVPN AS before, so I'm a step behind in that I didn't actually install OpenVPN AS and instead used the AMI provided by OpenVPN Tech Inc.
I was messing around with enabling custom authentication. One thing that is unclear from the documentation:
-are there 2 levels of authentication, one for the website and one for the VPN?
-is custom authentication (auth-user-pass-verify) only for the VPN level auth?
If so, then I won't bother, as I was trying to reduce the number of passwords my end users would have to memorize.
But, if auth-user-pass-verify *can* work to provide "one password to rule them all", then I'm having issues getting it set up. First I added to the server:
auth-user-pass-verify redacted via-env
and was getting:
WARNING: External program may not be called unless '--script-security 2' or higher is enabled.
So I added:
script-security 3 system
Then, I was getting:
WARNING: Failed running command (--auth-user-pass-verify): could not execute external program
I messed with various file/dir permissions, eventually making "redacted" 777 in /tmp (which itself is 777), but I *still* get "could not execute external program" from openvpn (yes, I can exec the script from the command line). It looks like openvpn runs as openvpn_as on the AWS AMI. I was NOT able to "su openvpn_as -c" exec the script, as that user seems to be locked from logging in.
I kept adding more and more settings without luck, eventually having this set:
SERVER
auth-user-pass-verify redacted via-env
script-security 3 system
tmp-dir /tmp
verb 10
client-cert-not-required
username-as-common-name
CLIENT
auth-user-pass
But, still no joy.
During my testing, it appears to me that the website still uses the "local" auth for the web form. If that's true, then I don't want to bother with auth-user-pass-verify, so this post is somewhat moot. Though, I would be curious to know why I failed :-)
