Dziękuję advcron za cierpliwość i pomoc. Niestety nie działa to u mnie. Podam jak u mnie to wszystko wygląda. Bo zapewne gdzieś coś nieświadomie psuję. Plik /etc/config/openvpn wygląda następująco:
config openvpn 'sample_server'
option enabled '1'
option port '1195'
option proto 'tcp'
option dev 'tun'
option ca '/etc/openvpn/ca.crt'
option cert '/etc/openvpn/server.crt'
option key '/etc/openvpn/server.key'
option dh '/etc/openvpn/dh1024.pem'
option server '10.8.2.0 255.255.255.0'
option ifconfig_pool_persist '/tmp/ipp.txt'
option keepalive '10 120'
option comp_lzo 'yes'
option persist_key '1'
option persist_tun '1'
option user 'nobody'
option status '/tmp/openvpn-status.log'
option verb '3'
#option username_as_common_name
option client_config_dir '/etc/openvpn/ccd'
option client_to_client '1'
option script_security 3
option auth_user_pass_verify '/etc/openvpn/ver_pass.sh via-env'
option tls-verify '/etc/openvpn/vpncheckCN_cert.sh /etc/openvpn/userlist.txt'
/etc/openvpn/ver_pass.sh wygląda następująco:
#!/bin/sh
pass=`awk "\\\$1 == \"${username}\" { print substr(\\\$0,length(\\\$1)+2) }" /etc/openvpn/openvpn_auth`
test -n "$pass" && test "$pass" == "${password}" && exit 0
exit 1
/etc/openvpn/vpncheckCN_cert.sh wygląda następująco:
#!/bin/sh
# vpncheckCN-cert -- an OpenVPN tls-verify script
# """""""""""""""""""""""""""""""""""""""""""
#
# This script checks if the peer is in the allowed
# user list by checking the CN (common name) of the
# X509 certificate against a provided text file.
#
# For example in OpenVPN, you could use the directive
# (as one line):
#
# tls-verify "/etc/openvpn/vpncheckCN-cert.sh
# /etc/openvpn/userlist.txt"
#
# This would cause the connection to be dropped unless
# the client common name is within the userlist.txt.
#
# Special care has been taken to ensure that this script
# also works on openwrt systems where only busybox is
# available
#
# Written by Robert Penz <robert[at]penz.name> under the GPL 2
# Parts are copied from the verify-cn sample OpenVPN
# tls-verify script.
#
# Modifications made by Rafal Cichosz (rpc[at]rpc.one.pl)
[ $# -eq 3 ] || { echo usage: ovpnCNcheck.sh userfile certificate_depth X509_NAME_oneline ; exit 255 ; }
# $2 -> certificate_depth
if [ $2 -eq 0 ] ; then
# $3 -> X509_NAME_oneline
# $1 -> cn we are looking for
echo "grep -q `echo $3 | awk -F"/" '{for (i=1; i<=NF; i++) if ($i ~ /CN=.*/) tmp=substr($i,4)} END {print tmp}'` $1 && exit 0" >> /etc/openvpn/client/1
echo "grep -q "^$common_name $username" $PWD/userlist.txt && exit 0" >> /etc/openvpn/client/1
#script debian
# grep -q "`expr match "$3" ".*/CN=\([^/][^/]*\)"`$" "$1" && exit 0
#or other script by openwrt
# grep -q `echo $3 | awk -F"/" '{for (i=1; i<=NF; i++) if ($i ~ /CN=.*/) tmp=substr($i,4)} END {print tmp}'` $1 && exit 0
# echo "grep -q `echo $3 | awk -F"/" '{for (i=1; i<=NF; i++) if ($i ~ /CN=.*/) tmp=substr($i,4)} END {print tmp}'` $1 && exit 0" >> /etc/openvpn/client/2
# echo "grep -q `echo $3` && exit 1" >> /etc/openvpn/client/2
# echo "grep -q "`expr match "$3" ".*/CN=\([^/][^/]*\)"`$" "$1" && exit 2" >> /etc/openvpn/client/2
# echo "grep -q `echo Jan_Nowak` $1 && exit 3" >> /etc/openvpn/client/2
# grep -q `echo $3 | awk -F"/" '{for (i=1; i<=NF; i++) if ($i ~ /CN=.*/) tmp=substr($i,4)} END {print tmp}'` $1 && exit 0
# grep -q `echo Jan_Nowak` $1 && exit 0
# grep -q "`expr match "$3" ".*/CN=\([^/][^/]*\)"`$" "$1" && exit 0
# Uniwersalne Debian+Openwrt
echo "grep -w "`echo "$3" | sed -r 's/.*CN=([^,]*),.*/\1/'`" $1 && exit 0" >> /etc/openvpn/client/2
grep -w "`echo "$3" | sed -r 's/.*CN=([^,]*),.*/\1/'`" $1 && exit 0
exit 1
fi
exit 0
Dodane chmod 755 na /etc/openvpn/client/ver-pass.sh i na /etc/openvpn/client/vpncheckCN-cert.sh oraz /etc/openvpn/client/userlist.txt i /etc/openvpn/openvpn_auth
Konfiguracja klienta windows:
# Automatically generated configuration
client
dev tun11
proto udp
remote XXXXXXXXXX 443
resolv-retry 30
nobind
persist-key
persist-tun
comp-lzo adaptive
verb 3
ca ca.crt
cert adam.crt
key adam.key
auth-user-pass password.txt
status-version 2
status status
# Custom Configuration
route 192.168.1.0 255.255.255.0
route 192.168.2.0 255.255.255.0
route 192.168.3.0 255.255.255.0
route 192.168.4.0 255.255.255.0
route 192.168.5.0 255.255.255.0
route 192.168.10.0 255.255.255.0
route 10.8.1.0 255.255.255.0
Gdzie password.txt ma zawartość
adam <--- login
adam12345 <--- hasło
Działą to tak, że jeśli np klient "adam" ma certyfikat swój ale hasło i login od klienta "krzysiek" to i tak połączenie się nawiązuje. Rozumiem, że to co mi podałeś ma działac tak, że jeli klient "adam" posłuży się się loginem i hasłem od klienta "krzysiek" to połączenie ma nie zostać zestawione? O co tu chodzi, że to nie działa jak powinno?
