Greetings,
I had assumed that OpenVPN automatically compared the 'Common Name' of a cert to the username provided when using auth-user-pass, but this weekend I discovered it does not.
In other words:
If you are using OpenVPN with private certificates + username/password authentication, as long as the username/password is valid, and the cert is valid, you will be authenticated even if the username does not match the 'Common Name' signed to the certificate.
Is there an option I am overlooking that forces the comparison of username to Common Name? The only post I could find on this topic is here (but I'd like to avoid modifying the pam plugin if at all possible, and I'm not entirely sure what was referenced there by janjust):
https://forums.openvpn.net/topic7733.html
