Time Based VPN Access

nomykhan

Hi

I am currenly using local user database.
I have a scenario where i need to give access to my users for a particular time e.g
User 1: fomr 1st July 2017 to 1st Aug 2017 ( 12 am to 11:59 pm)
User 2: from 1st July 2017 to 8th July 2017 ( 12 am to 11:59 pm)

etc

How can i achieve this scenario?

if not possible in openvpn any thrid party radius/ldap solution that can achieve it?

rsenio

If you have a Windows server, setup Network Policy Server and use the time of day restrictions. Configure OpenVPN AS to Authenticate via radius to your server.

The Johan

Or you could set up an iptables rule that blocks access, and run a cronjob to lift this rule whenever you want to allow access. Crude. But effective. Or do the same thing to the openvpn access server service itself, just stop the whole thing when you don't want it on, then start it again when you do want it on. Or if you want to do it per user, use post-auth script to evaluate what time it is and based on that deny access.

nomykhan

rsenio wroteIf you have a Windows server, setup Network Policy Server and use the time of day restrictions. Configure OpenVPN AS to Authenticate via radius to your server.

thanks.
I deployed and it worked . thanks for the suggestion.
I used AD account restrictions to expire the account at a certain date.

I could not find any option of activating an account at a particular time. How can you do it via NPS?

chilinux

In the NPS application, select the NPS server and expand Policies and the right click on Connection Request Policy and select New. Then choose a policy name and click next, you can then specify multiple conditions for the policy including which User Name and Day/Time Restrictions apply.

It should be noted that NPS will only enforce when authentication is permitted, already authenticated sessions will not end during the restricted time window using this method.

It might be better to set up a pair of cron jobs where the first one uses sacli to set the user's prop_deny to true and also uses sacli to issue a DisconnectUser. The second cron job could then turn the prop_deny back to false.

So if user "consultant" is only allowed to work 9 to 5 on Monday through Friday, setup the following:

--- /usr/local/bin/consultantdeny.bash ---
#!/bin/bash
/usr/local/openvpn_as/scripts/sacli --user consultant --key prop_deny --value true UserPropPut
/usr/local/openvpn_as/scripts/sacli -u consultant DisconnectUser

--- /usr/local/bin/consultantallow.bash ---
#!/bin/bash
/usr/local/openvpn_as/scripts/sacli --user consultant --key prop_deny --value false

Then run crontab -e and set:
0 9 * * 1-5 /usr/local/bin/consultantallow.bash
0 17 * * 1-5 /usr/local/bin/consultantdeny.bash

More information on the format of the crontab can be found by running: man 5 crontab