briancampitf
Hi,
I have an OpenVPN 2.6.2 server with a tun & subnet topology, running on Centos 6. The server has roughly a hundred users and each are authenticated via a custom auth-user-pass-verify via-env script.
The problem that I'm running into is that while the external auth-user-pass-verify script is authenticating a connecting user, the openvpn process completely freezes, affecting all users. If the authentication happens quickly, other users will see a minor blip in traffic flow. If the authentication includes a timeout of a downstream server, we're looking at 30 seconds of dead time on everyone's VPN while that user is connecting. No good.
So, to test:
1) User A establishes a VPN session to the server and kicks off a continuous ping to a device over the VPN.
2) Evil admin modifies the auth-user-pass-verify script to include a sleep(30), to simulate a delay in the plugin.
3) User B makes a connection to the VPN.
4) For 30 seconds, user A's VPN session hangs.
5) After 30 seconds user B receives a connection error and user A's VPN begins working again.
It seems like the OpenVPN process is blocking while waiting on a reply from the external plugin. It seems like that would be a known issue or common problem if it were the case though?
Unfortunately, I don't have the verbosity of the daemon turned up high enough to submit a proper report now. I'll probably be doing that in the next couple of days, unless anyone has any pointers.
Thanks
