swimboy
I currently have an OpenVPN server set up with a self-signed CA for the server and issue certs for each client that needs to connect, per easy-rsa. This has been working fine for the few users that have been using it; but now I need to support hundreds of users.
The users are currently managed in FreeIPA with OTP. My server can manage the OTP via PAM, but I'd like to be able to push out a single configuration to all the users and have them authenticate with their username, password and OTP. I see how to use my already-issued certs on the server side, and plan on using "--client-cert-not-required" so I don't need to worry about issuing or collecting user certs, but I don't know how to generate the dh file for the server.
Does this sound workable? Am I headed in the right direction?
