Important notices
Before you add a new report, we ask you kindly to acknowledge the following:
Is your feature request related to a problem? Please describe.
When OpenVPN authenticates users with the auth-user-pass-verify directive, the traffic stalls while executing the script (https://community.openvpn.net/openvpn/ticket/222). The is quite unpractical when offering access to many users and/or using a slow authentication scheme.
Describe the solution you like
As of OpenVPN 2.6 seems to support deferred authentication for script types, which means one may fork the authentication sequence into it's own process so other connected clients don't have to wait for the main process to exit.
According to the manual (https://openvpn.net/community-resources/reference-manual-for-openvpn-2-6/), the script should fork the actual process and make openvpn aware of the fact:
If the authentication is deferred, the script must fork/start a background or another non-blocking operation to continue the authentication in the background. When finshing the authentication, a 1 or 0 must be written to the file specified by the auth_control_file.
Since we also write client specific overwrites, we should make sure we do persist them before signaling via the control file that the sequence has completed.
Describe alternatives you considered
Use plugins (like https://github.com/fac/auth-script-openvpn) for deferred authentication, the downside is that it adds dependancies and complexity which often isn't the best option security wise.
Additional context
- https://github.com/OpenVPN/openvpn/blob/master/sample/sample-scripts/totpauth.py
|
// configure user auth modes |
|
switch ($settings['mode']) { |
|
case 'server_user': |
|
$conf .= "verify-client-cert none\n"; |
|
/* FALLTHROUGH */ |
|
case 'server_tls_user': |
|
/* username-as-common-name is not compatible with server-bridge */ |
|
if (stristr($conf, "server-bridge") === false && empty($settings['use-common-name'])) { |
|
$conf .= "username-as-common-name\n"; |
|
} |
|
if (!empty($settings['authmode'])) { |
|
$strictusercn = "false"; |
|
if ($settings['strictusercn']) { |
|
$strictusercn = "true"; |
|
} |
|
$conf .= "auth-user-pass-verify \"/usr/local/etc/inc/plugins.inc.d/openvpn/ovpn_auth_verify " . |
|
"user '{$settings['authmode']}' '{$strictusercn}' '{$mode_id}'\" via-env\n"; |
|
} |
|
break; |
|
} |
sponsored by m.a.x. it (https://www.max-it.de/)
Important notices
Before you add a new report, we ask you kindly to acknowledge the following:
Is your feature request related to a problem? Please describe.
When OpenVPN authenticates users with the
auth-user-pass-verifydirective, the traffic stalls while executing the script (https://community.openvpn.net/openvpn/ticket/222). The is quite unpractical when offering access to many users and/or using a slow authentication scheme.Describe the solution you like
As of OpenVPN 2.6 seems to support deferred authentication for script types, which means one may fork the authentication sequence into it's own process so other connected clients don't have to wait for the main process to exit.
According to the manual (https://openvpn.net/community-resources/reference-manual-for-openvpn-2-6/), the script should fork the actual process and make openvpn aware of the fact:
Since we also write client specific overwrites, we should make sure we do persist them before signaling via the control file that the sequence has completed.
Describe alternatives you considered
Use plugins (like https://github.com/fac/auth-script-openvpn) for deferred authentication, the downside is that it adds dependancies and complexity which often isn't the best option security wise.
Additional context
core/src/etc/inc/plugins.inc.d/openvpn.inc
Lines 656 to 675 in 5586e49
sponsored by m.a.x. it (https://www.max-it.de/)