In the .bat file I capture the username and pass as follows
set /A count=0
for /F "tokens=*" %%A in (%~1) do (
if !count!==1 (
set password=%%A
set /A count=2
)
if !count!==0 (
set username=%%A
set /A count=1
)
)
This part works and is verified, both when the script is run by myself and when it is called by openvpn. I then call an external .exe to verify the password.
for /f %%i in ('path\to\foo.exe %password%') do set RESULT=%%i
Now this last parts works when I call the .bat from command prompt myself, but it fails when the .bat is run by openvpn -- nothing is written to "RESULT". I don't even know if the exe is being called at all.
I have tried openvpn server with admin privileges. Openvpn documentation says it calls the script "as a shell command" for what it's worth.
I'm using the .exe as it compares the password to a stored hash of the password. Is there an easier way I can avoid plain text passwords here?
EDIT: in the server config I have tried both --script-security 2 and 3.
