george
I have gotten OpenVPN to work with pam authentication, using the local system's /etc/passwd to as the second factor of authentication. Now the issue I have is, how would a vpn user, (windows openvpn gui), be able to change the password associated with thier system account. I have tried passwd -e username, but the openvpn gui does not seem to take the output from login to change the user's password.
Here is my server config:
local 192.168.1.140
port 1194
proto udp
dev tun0
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key # This file should be kept secret
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
server 10.8.0.0 255.255.0.0
ifconfig-pool-persist ipp.txt
push "route 192.168.1.0 255.255.255.0"
push "route 192.168.40.5 255.255.255.255"
push "dhcp-option DNS 192.168.40.5"
keepalive 10 120
comp-lzo
daemon
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
verb 9
management localhost 7505
plugin /usr/lib/openvpn/plugin/lib/openvpn-auth-pam.so /etc/pam.d/login
client-config-dir ccd
and my client config:
client
dev tun
proto udp
remote 208.xx.xxx.xx 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
comp-lzo
verb 3
auth-user-pass
Thanks in advance
ecrist
The password change, as far as I know, needs to take place outside the OpenVPN process. We don't currently have OpenVPN integrated with our LDAP directory, but for password changes there is a web page users go to, internally, to change the password.
george
We are not integrating openvpn in to ldap either, we are using the openvpn server's user database for authentication.
Right now we add a new vpn user to the system with:
useradd username -M -s /bin/false
Then:
passwd username
Then give the initial password to the user via phone.
Is there a way to offer a web page to vpn users that will allow them to manage thier passwords themselves? Is it perhaps webmin?
george
We are using the openvpn server's user database for the second suthentication factor.
We add a user to the server like this:
useradd username -M -s /bin/false
Then we:
passwd username
We would like to be able to provide an initial password to the vpn users and allow them to change it themselves from then on.
Can this be done for internal and external, (to our networks), via a secure web page? Using webmin perhaps?
Thanks again
ecrist
Yes, this is a common feature. Some people have actually set the users' shell on the given system to /usr/bin/passwd and allowed SSH to the box via the VPN.
So, user logs in to VPN, ssh's into passwd.yourhost.com, and they get the password change prompts.
System password files are compiled copies of flat-files. You can edit the flat file, simply replacing the password hash in field 2 and (in freebsd, not sure about linux) running cap_mkdb to compile the password file.
I would do the first method, or migrate to something more friendly to distributed management.
george
ecrist, your solution works like a charm!! Thanks so much for your help on this. I was looking to over complicate this issue for some reason, thanks again for coming through with a simple clean solution!!
If you are ever in the St. Louis, MO area I owe you a beer!!
ecrist
Glad I could help!
call
and using this method to create the users for the VPN:
useradd username -M -s /bin/false
Then we:
passwd username
Where can i Check all the users that I created?
There must be a file that contain a relation of all the users created. Correct?
