kr_yh
Hi all - we have an openvpn server configured to authenticate connection attempts against LDAP. With this setup, if our LDAP server goes down or is for some reason unreachable, we would effectively be locked out of our vpn and unable to connect. Is there a way to create a master user, that can connect WITHOUT being authenticated to LDAP, for use in this scenario?
Thanks very much
SomeGuy
On the OpenVPN server check out option "auth-user-pass-verify" and build your own authentication method. Within that method, select keys that are not required to use ldap validation by key/cert CN and/or username+password, and rely on static, non-ldap authentication (local hash in a separate password file on the server with restricted rights just for openvpn, for example) or the less secure inclusion of literal strings for a password stored in plain-text in the script you have made to perform the authentication.
This would give you a default behaviour of LDAP for all users/keys/certs that do not match the CN, username, password you specify as exceptions, and a local, OpenVPN-server-only method to validate a user without relying on ldap.
