Deny user if it not exists

it2

Hi guys! I need your help.
I have next config for my server:

mode server
local 10.0.10.4
port 1194
tls-server
tls-auth /etc/openvpn/keys/ta.key 0
proto udp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh1024.pem
topology subnet
reneg-sec 36000
server 10.0.30.0 255.255.255.0
plugin /usr/lib/openvpn/openvpn-auth-ldap.so /etc/openvpn/ldap-auth.config
client-config-dir /etc/openvpn/ccd
max-clients 200
push "route-gateway 10.0.30.1"
#push "redirect-gateway def1 bypass-dhcp"
push "route 192.168.90.0 255.255.255.0"
push "route 192.168.88.0 255.255.255.0"
push "route 192.168.97.0 255.255.255.0"
push "route 192.168.98.0 255.255.255.0"
push "route 192.168.99.0 255.255.255.0"
push "route 192.168.100.0 255.255.255.0"
push "route 192.168.102.0 255.255.255.0"
push "route 192.168.95.0 255.255.255.0"
push "route 192.168.93.0 255.255.255.0"
push "route 10.0.0.0 255.0.0.0"
push "dhcp-option DNS 10.36.223.10"
push "dhcp-option DNS 192.168.102.52"
push "dhcp-option DNS 8.8.8.8"
keepalive 10 120
comp-lzo
persist-key
persist-tun
verb 3
tmp-dir /etc/openvpn/tmp
script-security 3
status /var/log/openvpn/openvpn-status.log
log /var/log/openvpn/openvpn.log
log-append /var/log/openvpn/openvpn-server.log
tls-version-min 1.2

As you can see I have 2factor auth from LDAP+CERTIFICATE. I'm also have CCD directory with binding names. For example there is file named 'peter' with static ip from 10.0.30.0/24 range
So my question is:
If i connecting as Peter (not peter!) - i'm getting the ip from DHCP range.
How can I permit ALL these logins that are not from ccd file ??
Thanks!

TinCanTech

You will have to explain your question more clearly ..

it2

Sorry for my english 🙂
I have 2factor OpenVPN server CERTIFICATE+PASSWORD from LDAP
I have a record in LDAP server:

UserName: Peter Brown
CommonName: peter

I have a client config for peter in /etc/openvpn/ccd folder

root@openvpn-new:~# cat /etc/openvpn/ccd/peter
ifconfig-push 10.0.30.12 255.255.255.0

So when I'm connecting to OpenVPN as peter - I'm getting 10.0.30.12 and this is correct

I have another record in LDAP:

UserName: James Green
CommonName: JAMES <---- UPPERCASE

And also I have a client config(wrong) for james in /etc/openvpn/ccd folder

root@openvpn-new:~# cat /etc/openvpn/ccd/james <-- LOWCASE
ifconfig-push 10.0.30.13 255.255.255.0

And yesterday I found a (bug?) feature,
When I'm connecting to OpenVPN and promt JAMES as login I still get an ip address, but from DHCP range of 10.0.30.0/24 subnet (for example 10.0.30.3)
I need to close this feature and I need to connect to OpenVPN only users with right common-name (casesensitive).

TinCanTech

it2 wroteroot@openvpn-new:~# cat /etc/openvpn/ccd/james <-- LOWCASE

Make the file name JAMES (Uppercase)

If you want to stop login for incorrect name; ie. james (lowercase) use --ccd-exclusive

it2

TinCanTech wrote
it2 wroteroot@openvpn-new:~# cat /etc/openvpn/ccd/james <-- LOWCASE
Make the file name JAMES (Uppercase)

If you want to stop login for incorrect name; ie. james (lowercase) use --ccd-exclusive

Thanks! thats what I'm looking for!

it2

I'm also have a little question.
For example I have on client config a certificate with common name peter.
But when I'm connecting to OpenVPN I can use login+pass of james user and I'm successfully getting ip of peter.

I mean there is no matching of common-name and login.
How can I make it the same?

TinCanTech

See --username-as-common-name in The Manual v23x

it2

TinCanTech wroteSee --username-as-common-name in The Manual v23x

Thank you!

TinCanTech

You are welcome 8-)

it2

Unfortunately, with this parametr, I still can connect with username other than a common name in certificate 🙁