Home / server / Questions / 163033
Accepted
user49032
Asked: 2010-07-23 05:01:30 +0800 CST

How can I get my OpenVPN server running OpenBSD 4.3 to authenticate against my Windows domain?

  • 772

I've googled all over the place but none of the pages I have come across include a step-by-step guide showing how to set this up. I'm not a Linux master (although I'm working hard to increase my knowledge of it), and I need to be walked through how to set this up.

I'm aware of things like openldap and what not, but I still need to see each step I need to complete during the entire process which I haven't been able to find.

If anybody can help out I'd greatly appreciate it.

Thanks!

Edit: Sorry, it is OpenBSD 4.3

openvpn openbsd

2 Answers

  1. Best Answer

    Below are my notes for authing OpenVPN off of AD via a RADIUS server. All of the instructions are based on Red Hat. It's been a while since I've done this but from what I remember you do this:

    1. Add PAM files

      • cd /location/of/openvpn-x.x._rcx/plugin/auth-pam
      • make
      • sudo cp openvpn-auth-pam.so /etc/openvpn/
      • sudo cp openvpn-auth-pam.so /lib/security
      • Download the pam_radius_auth pam module (will have to edit the .spec file to point to what raddb folder/file and then compile it)
      • cp the new pam_radius_auth module to /lib/security/

    2. vi /etc/raddb/server

      • radius_server1_ip radius_server1_secret
      • radius_server2_ip radius_server2_secret (if you want redundant servers)
      • Configure what groups you want to be able to access it via AD and the RADIUS setup

    3. vi /etc/pam.d/openvpn-auth

      • auth required /lib/security/pam_radius_auth.so debug
      • account sufficient /lib/security/pam_permit.so
      • session sufficient /lib/security/pam_permit.so

    4. Install the PAM modules

      • vi server.conf
      • plugin /etc/openvpn/openvpn-auth-pam.so /etc/pam.d/openvpn-auth

    Things may have changed a little bit since I've done it but this should at least get you going in the right direction.

    • 1

  2. Sounds like you plan to authenticate based on username and password?

    The last time I had to setup something similar I used the auth-user-pass-verify option. It tells OpenVPN to pass along the incoming username and password to a custom script, to then grant or deny access based on the return code from the script.

    This is a pretty convenient solution, as you generally can expect your scripting language of choice to have a good set of modules for various kinds of authentication. It is also a very flexible solution in defining the authentication criterias.

    Assuming that the Windows domain is an Active Directory perhaps you might want to base your script on a simplified Kerberos auth module? After all, the only response you need is a true or a false.

    In any case the auth-user-pass-verify option is pretty well documentated in the openvpn(8) man page.

    • 0