Using no backend for authentication ?

alexxtasi

Hi all!!

newbie here so be patient please… :)

1st question:
while in my setting, user authentication is done with an external software which communicates with openvpn via PAM, I was wondering if I can setup an openvpn server without having to define user backend.

2nd question:
in the above setting (with user backend defined...), in server.conf lines "user nobody" and "group nobody" are commented (when I uncomment them user authentication fails). Isn't there a security problem ?

thank you

alexxtasi

hi again…

I found these :

1st question:
while in my setting, user authentication is done with an external software which communicates with openvpn via PAM, I was wondering if I can setup an openvpn server without having to define user backend.

found out that creating an openvpn server with the "+" icon (not using the wizard) I can define "Server mode: Remote Access (SSL/TLS)" and not be forced to define an backend authentication scheme. So adding in the client conf the directive "auth-user-pass" the client asks me for credentials and those are pushed in the PAM…
it works fine till now

2nd question:
in the above setting (with user backend defined…), in server.conf lines "user nobody" and "group nobody" are commented (when I uncomment them user authentication fails). Isn't there a security problem ?

with the above modifications, the users connect's as a local pfsense user (haven' t try more than one simultaneous connections).
Uncommenting "user nobody" and "group nobody" directives in server.conf (via command line tool) and restarting the server, the user login fails with:

openvpn[48542]: TCP connection established with [AF_INET]x.x.x.x:1499
openvpn[48542]: x.x.x.x:1499 WARNING: Failed running command (--tls-verify script): could not execute external program
openvpn[48542]: x.x.x.x:1499 TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
openvpn[48542]: x.x.x.x:1499 TLS Error: TLS object -> incoming plaintext read error
openvpn[48542]: x.x.x.x:1499 TLS Error: TLS handshake failed
openvpn[48542]: x.x.x.x:1499 Fatal TLS error (check_tls_errors_co), restarting

though I haven't changed anything in the setup…

any suggestions on this error, or any advice on the use of "user nobody", "group nobody" directives ?

regards