The whole point of this place is to answer the question (assuming that you know the answer).
Answer like "read the manual" is arrogant in this case because I'm asking unambiguous question about one specific detail in the configuration. Even if the answer is there, I don't see it. Hence, the original post...
Still, you keep being arrogant and I accepted the game. But now you don't like it any more.
I expect you to keep playing this trolling game instead of writing an answer which would end this (if you know it).
Just for the record, here is the quote for the auth-user-pass-verify:
–auth-user-pass-verify script method
Require the client to provide a username/password (possibly in addition to a client certificate) for authentication.OpenVPN will execute script as a shell command to validate the username/password provided by the client.
If method is set to “via-env”, OpenVPN will call script with the environmental variables username and password set to the username/password strings provided by the client. Be aware that this method is insecure on some platforms which make the environment of a process publicly visible to other unprivileged processes.
If method is set to “via-file”, OpenVPN will write the username and password to the first two lines of a temporary file. The filename will be passed as an argument to script, and the file will be automatically deleted by OpenVPN after the script returns. The location of the temporary file is controlled by the –tmp-dir option, and will default to the current directory if unspecified. For security, consider setting –tmp-dir to a volatile storage medium such as /dev/shm (if available) to prevent the username/password file from touching the hard drive.
The script should examine the username and password, returning a success exit code (0) if the client’s authentication request is to be accepted, or a failure code (1) to reject the client.
This directive is designed to enable a plugin-style interface for extending OpenVPN’s authentication capabilities.
To protect against a client passing a maliciously formed username or password string, the username string must consist only of these characters: alphanumeric, underbar (‘_’), dash (‘-‘), dot (‘.’), or at (‘@’). The password string can consist of any printable characters except for CR or LF. Any illegal characters in either the username or password string will be converted to underbar (‘_’).
Care must be taken by any user-defined scripts to avoid creating a security vulnerability in the way that these strings are handled. Never use these strings in such a way that they might be escaped or evaluated by a shell interpreter.
For a sample script that performs PAM authentication, see sample-scripts/auth-pam.pl in the OpenVPN source distribution.
I don't see a part answering "is auth-user-pass-verify redundant?", nor do I see how the script with return 0 disables username/pwd checking.
