Using no backend for authentication ?
-
Hi all!!
newbie here so be patient please… :)
1st question:
while in my setting, user authentication is done with an external software which communicates with openvpn via PAM, I was wondering if I can setup an openvpn server without having to define user backend.2nd question:
in the above setting (with user backend defined...), in server.conf lines "user nobody" and "group nobody" are commented (when I uncomment them user authentication fails). Isn't there a security problem ?thank you
-
hi again…
I found these :
1st question:
while in my setting, user authentication is done with an external software which communicates with openvpn via PAM, I was wondering if I can setup an openvpn server without having to define user backend.found out that creating an openvpn server with the "+" icon (not using the wizard) I can define "Server mode: Remote Access (SSL/TLS)" and not be forced to define an backend authentication scheme. So adding in the client conf the directive "auth-user-pass" the client asks me for credentials and those are pushed in the PAM…
it works fine till now2nd question:
in the above setting (with user backend defined…), in server.conf lines "user nobody" and "group nobody" are commented (when I uncomment them user authentication fails). Isn't there a security problem ?with the above modifications, the users connect's as a local pfsense user (haven' t try more than one simultaneous connections).
Uncommenting "user nobody" and "group nobody" directives in server.conf (via command line tool) and restarting the server, the user login fails with:openvpn[48542]: TCP connection established with [AF_INET]x.x.x.x:1499 openvpn[48542]: x.x.x.x:1499 WARNING: Failed running command (--tls-verify script): could not execute external program openvpn[48542]: x.x.x.x:1499 TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned openvpn[48542]: x.x.x.x:1499 TLS Error: TLS object -> incoming plaintext read error openvpn[48542]: x.x.x.x:1499 TLS Error: TLS handshake failed openvpn[48542]: x.x.x.x:1499 Fatal TLS error (check_tls_errors_co), restarting
though I haven't changed anything in the setup…
any suggestions on this error, or any advice on the use of "user nobody", "group nobody" directives ?
regards