Problem with auth-user-pass-verify script not being called when some clients cache their credentials. The auth-user-pass-verify does a few things: Checks the Username & Password Strips a YubiCode off the end of the Password and makes sure its valid and belonging to the user Verifies they are in the the correct LDAP group for access. When some people login, it called the external script file: Wed Aug 29 08:34:26 EDT 2018 Authorization succeeded for user1: LDAP Password OK, YubiPrefix Matches, YubiCode Valid, VPN Users member Wed Aug 29 08:34:26 2018 us=338692 74.72.144.19:41966 TLS: Username/Password authentication succeeded for username 'user1' [CN SET] But when someone has "saved" their credentials, we see: Wed Aug 29 14:47:27 2018 us=375885 64.20.12.206:53848 TLS: Username/Password authentication succeeded for username 'user2' [CN SET] -- the external script is never called. OpenVPN 2.3.10 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jun 22 2017 library versions: OpenSSL 1.0.2g 1 Mar 2016, LZO 2.08 Thanks for any help! This is our server config: [oconf=Server Config] local 192.168.61.211 port 1194 proto tcp dev tun ca /etc/openvpn/easy-rsa/keys/ca.crt cert /etc/openvpn/easy-rsa/keys/server.crt key /etc/openvpn/easy-rsa/keys/server.key # This file should be kept secret dh /etc/openvpn/easy-rsa/keys/dh2048.pem server 10.8.1.128 255.255.255.128 ifconfig-pool-persist /etc/openvpn/ipp.txt push "route 192.168.10.0 255.255.255.0" push "route 192.168.11.0 255.255.255.0" push "route 192.168.61.0 255.255.255.0" push "route 192.168.122.0 255.255.255.0" push "route 192.168.100.0 255.255.255.0" push "route 10.10.10.0 255.255.255.0" push "dhcp-option DNS 192.168.61.211" push "dhcp-option DOMAIN foo.com" push "dhcp-option WINS 192.168.100.5" keepalive 10 120 comp-lzo push "comp-lzo yes" reneg-sec 43200 push "reneg-sec 43200" push "auth-nocache" max-clients 25 persist-key persist-tun status /etc/openvpn/openvpn-status.log log-append /var/log/openvpn.log verb 4 mute 3 auth-user-pass-verify /etc/openvpn/openvpn-authenticate.sh via-file script-security 3 system client-cert-not-required username-as-common-name --management 192.168.61.211 85 /etc/openvpn/admin.pwd .

Problem with auth-user-pass-verify not being used all the time

wlavallee

Problem with auth-user-pass-verify script not being called when some clients cache their credentials.
The auth-user-pass-verify does a few things:
Checks the Username & Password
Strips a YubiCode off the end of the Password and makes sure its valid and belonging to the user
Verifies they are in the the correct LDAP group for access.

When some people login, it called the external script file:
Wed Aug 29 08:34:26 EDT 2018 Authorization succeeded for user1: LDAP Password OK, YubiPrefix Matches, YubiCode Valid, VPN Users member
Wed Aug 29 08:34:26 2018 us=338692 74.72.144.19:41966 TLS: Username/Password authentication succeeded for username 'user1' [CN SET]

But when someone has "saved" their credentials, we see:
Wed Aug 29 14:47:27 2018 us=375885 64.20.12.206:53848 TLS: Username/Password authentication succeeded for username 'user2' [CN SET]

-- the external script is never called.

OpenVPN 2.3.10 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jun 22 2017
library versions: OpenSSL 1.0.2g 1 Mar 2016, LZO 2.08

Thanks for any help!

This is our server config:

local 192.168.61.211
port 1194
proto tcp
dev tun
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key # This file should be kept secret
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
server 10.8.1.128 255.255.255.128
ifconfig-pool-persist /etc/openvpn/ipp.txt

push "route 192.168.10.0 255.255.255.0"
push "route 192.168.11.0 255.255.255.0"
push "route 192.168.61.0 255.255.255.0"
push "route 192.168.122.0 255.255.255.0"
push "route 192.168.100.0 255.255.255.0"
push "route 10.10.10.0 255.255.255.0"

push "dhcp-option DNS 192.168.61.211"
push "dhcp-option DOMAIN foo.com"
push "dhcp-option WINS 192.168.100.5"

keepalive 10 120
comp-lzo
push "comp-lzo yes"
reneg-sec 43200
push "reneg-sec 43200"
push "auth-nocache"
max-clients 25
persist-key
persist-tun
status /etc/openvpn/openvpn-status.log
log-append /var/log/openvpn.log
verb 4
mute 3
auth-user-pass-verify /etc/openvpn/openvpn-authenticate.sh via-file
script-security 3 system
client-cert-not-required
username-as-common-name
--management 192.168.61.211 85 /etc/openvpn/admin.pwd
.

TinCanTech

Try without --mute

Also, 2.3.10 is quite old, you might like to use an official build.
https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos

Or at least update your source.

wlavallee

I upgraded to:
OpenVPN 2.4.6 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 24 2018
library versions: OpenSSL 1.0.2g 1 Mar 2016, LZO 2.08
Originally developed by James Yonan
Copyright (C) 2002-2018 OpenVPN Inc <sales@openvpn.net>
Compile time defines: enable_async_push=no enable_comp_stub=no enable_crypto=yes enable_crypto_ofb_cfb=yes enable_debug=yes enable_def_auth=yes enable_dependency_tracking=no enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=yes enable_fragment=yes enable_iproute2=yes enable_libtool_lock=yes enable_lz4=yes enable_lzo=yes enable_maintainer_mode=no enable_management=yes enable_multihome=yes enable_pam_dlopen=no enable_password_save=yes enable_pedantic=no enable_pf=yes enable_pkcs11=yes enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_silent_rules=no enable_small=no enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=yes enable_werror=no enable_win32_dll=yes enable_x509_alt_username=yes with_aix_soname=aix with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_plugindir='${prefix}/lib/openvpn' with_sysroot=no

and removed the --mute from the config.

I still have the same issue, that one user is able to connect without the external auth script running:

Mon Sep 10 07:36:29 EDT 2018 Authorization succeeded for user1: LDAP Password OK, YubiPrefix Matches, YubiCode Valid, VPN Users member
Mon Sep 10 07:36:29 2018 us=295400 71.83.53.182:64089 TLS: Username/Password authentication succeeded for username 'user1' [CN SET]
Mon Sep 10 07:38:19 EDT 2018 Authorization succeeded for user2: LDAP Password OK, YubiPrefix Matches, YubiCode Valid, VPN Users member
Mon Sep 10 07:38:19 2018 us=168036 173.52.99.75:56192 TLS: Username/Password authentication succeeded for username 'user2' [CN SET]
Mon Sep 10 07:41:05 EDT 2018 Authorization succeeded for user3: LDAP Password OK, YubiPrefix Matches, YubiCode Valid, VPN Users member
Mon Sep 10 07:41:05 2018 us=587224 74.72.144.19:57600 TLS: Username/Password authentication succeeded for username 'user3' [CN SET]

Mon Sep 10 09:53:50 2018 us=463321 192.168.100.74:65179 TLS: Username/Password authentication succeeded for username 'user4' [CN SET]
Mon Sep 10 09:54:02 2018 us=892058 192.168.100.74:65187 TLS: Username/Password authentication succeeded for username 'user4' [CN SET]
Mon Sep 10 09:54:15 2018 us=313413 192.168.100.74:65222 TLS: Username/Password authentication succeeded for username 'user4' [CN SET]
Mon Sep 10 09:54:26 2018 us=794570 192.168.100.74:65231 TLS: Username/Password authentication succeeded for username 'user4' [CN SET]

I appreciate any Help!