Hi Everyone I am using OPENVPN server version 2.4.6 with with LDAP as a backend authentication mechanism. To this end, I use the LDAP plugin in the form of: [code]plugin /usr/lib64/openvpn/plugin/lib/openvpn-auth-ldap.so /etc/openvpn/auth/ldap.conf[/code] For security reasons, I would like to check using an additional perl script whether the same user who has the generated certificate authenticates based about LDAP. The Common Name (CN) value in the generated user certificate is identical to the username LDAP. It comes down to checking in the script whether the CN = username value in LDAP. My question: Whether using the add-in plug-in supporting LDAP libraries (presented above) can simultaneously use the auth-user-pass-verify directive in the form of: [code]auth-user-pass-verify "/root/openvpn/script/ucheck.pl" via-env[/code] ? Below is the fragment server config: [oconf=server.conf] script-security 3 plugin /usr/lib64/openvpn/plugin/lib/openvpn-auth-ldap.so /etc/openvpn/auth/ldap-stud.conf verify-client-cert require auth-user-pass-verify "/root/openvpn/script/ucheck.pl" via-env [/oconf] [oconf=client.conf] proto udp port 1194 remote x.x.x.x 1194 udp remote-cert-tls server resolv-retry infinite nobind persist-key persist-tun auth-retry interact auth-user-pass auth-nocache key-direction 1 tls-auth [inline] 1 comp-lzo verb 3 cipher AES-256-CBC auth SHA512 tls-version-min 1.2 tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384 ... ... ... key-direction 1 ... [/oconf] Perl script [code]#!/usr/bin/perl -t # OpenVPN --auth-user-pass-verify script. # Only authenticate if username equals common_name. $username = $ENV{'username'}; $common_name = $ENV{'common_name'}; exit !(length($username) > 0 && length($common_name) > 0 && $username eq $common_name); [/code] After taking into account the above changes, when client1 trying to connect authentication ends unsuccessful. Fragment of logs on the server: [code] Tue Apr 14 16:07:32 2020 us=565998 x.x.x.x:52123 PLUGIN_CALL: POST /usr/lib64/openvpn/plugin/lib/openvpn-auth-ldap.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0 Tue Apr 14 16:07:32 2020 us=575757 x.x.x.x:52123 WARNING: Failed running command (--auth-user-pass-verify): could not execute external program Tue Apr 14 16:07:32 2020 us=575879 x.x.x.x:52123 TLS Auth Error: Auth Username/Password verification failed for peer WRTue Apr 14 16:07:32 2020 us=576805 x.x.x.x:52123 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA Tue Apr 14 16:07:32 2020 us=576892 x.x.x.x:52123 [client1] Peer Connection Initiated with [AF_INET]x.x.x.x:52123 RTue Apr 14 16:07:33 2020 us=830908 x.x.x.x:52123 PUSH: Received control message: 'PUSH_REQUEST' Tue Apr 14 16:07:33 2020 us=831033 x.x.x.x:52123 Delayed exit in 5 seconds Tue Apr 14 16:07:33 2020 us=831075 x.x.x.x:52123 SENT CONTROL [client1]: 'AUTH_FAILED' (status=1) WWWTue Apr 14 16:07:38 2020 us=953881 x.x.x.x:52123 SIGTERM[soft,delayed-exit] received, client-instance exiting [/code] ucheck.pl file access rights are as follows: [code]-rwxr-x---. 1 root nobody 344 Apr 14 15:33 ucheck.pl[/code] I will be grateful for any tip or answer. :)

LDAP & auth-user-pass-verify script

Ralf80

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

TinCanTech

Ralf80 wrote Tue Apr 14 16:07:32 2020 us=575757 x.x.x.x:52123 WARNING: Failed running command (--auth-user-pass-verify): could not execute external program

This is the ERROR (not warning!) which you need to fix.

Ralf80

Unfortunately, this is my first OPENVPN server and I'm a beginner.
At first I thought that this is a problem in access rights to the ucheck.pl script file,
but after the modification the same error still appears.
I don't really understand what this error message can be caused: auth-user-pass-verify: could not execute external program.

I have read many posts here in this forum, and I have searched many similar OPENVPN forums.
Unfortunately, I did not find a clue that could give me a specific answer to this error.