You can also use the script to add further security to your server.
We use easy-rsa to generate a unique certificate for each client machine - baked into the .ovpn file. It has the hostname of the client as the "cn" in the certificate. Users need to sign in with AD user/password and google authenticator TOTP, and must be members of an AD vpn_users group.
Additionally, on the server we have a text file that lists which users are allowed to connect using each certificate. A simple text file list of
<user1>[,<user2>,...<userN>]<TAB><hostname>
In the script we have
# first, search for the common_name (cn) in the user_certs.txt file, and set the cert_user environment variable to the listed user(s)
# note: multiple users are permitted for a cert to allow for shared laptops, and emergency admin user logins.
# seperate multiple users with commas (no spaces)
# ordinary users should not be allowed to use each other's certs
declare $(/usr/bin/awk -v cn="$common_name" -v tmp="CERT_NOT_FOUND" '$0 ~ cn{tmp=$1} END {print "cert_user=" tmp}' /etc/openvpn/server/user-certs.txt )
export cert_user
# $(cert_user,,} converts $cert_user to lowercase, ${username,,} converts $username to lowercase
# [[ ]] statement looks for *username* to not match cert_user - effectively - if username is not a substring of cert_user
if [[ "${cert_user,,}" != *"${username,,}"* ]]; then
echo "$(date '+%Y-%m-%d %H:%M:%S') DENIED username=$username cert_user=$cert_user cert=$common_name" >> $logfile
exit 1
fi
echo "$(date '+%Y-%m-%d %H:%M:%S') GRANTED username=$username cert_user=$cert_user cert=$common_name" >> $logfile
exit 0
