Package: openvpn-ldap-auth
Python OpenVPN LDAP AuthAn auth verify script forOpenVPNto authenticate via LDAP. Each VPN login is
forwarded to this script and the script in turn attempts a simple bind against the specified LDAP server. When the bind
is successful the script returns exit code 0 telling OpenVPN that the credentials are valid.Although there already is theopenvpn-auth-ldapplugin I felt the
need to write this auth script. First the source code is more accessible due to it being written in Python. Second it
offers more possibilities regarding
OpenVPN'sstatic-challengeparameter (see
below).The downsides of using a script instead of a C-plugin
areless performance and slightly reduced security.
If you are fine with that go ahead.QuickstartInstall the package via pip:pipinstallopenvpn-ldap-authThen create/etc/openvpn/ldap.yaml:ldap:url:'ldaps://first.ldap.tld:636/ldaps://second.ldap.tld:636/'bind_dn:'uid=readonly,dc=example,dc=org'password:'somesecurepassword'timeout:5# optionalauthorization:base_dn:'ou=people,dc=example,dc=org'search_filter:'(uid={})'# optional, {} will be replaced with the usernamestatic_challenge:'ignore'# optional, other values are prepend, appendFind out whereopenvpn-ldap-authlives:whichopenvpn-ldap-authAdd the following line to your OpenVPN server configuration:script-security 2
auth-user-pass-verify /path/to/openvpn-ldap-auth via-fileNow you can start your OpenVPN server and try to connect with a client.InstallationSingle ExecutableFor those who wish tosacrifice a little more performancefor not having to install or compile a Python interpreter or you just want to quickly try the script out this option might be interesting.
Eachreleasealso has executables attached to it:openvpn-ldap-auth-<distro>-<distro-version>-<arch>. They are created viaPyInstalleron the respective Linux distro, version and architecture. They might also work on other distros provided they use the same or a later libc version that the distro uses.Important: /tmp must not be read only.From SourceDownload or clone this repository, cd into it and runpipinstallpoetry
poetryinstall--no-dev
poetrybuild
pipinstall--upgrade--find-links=distopenvpn-ldap-authExchangepipwithpip3if applicable.ConfigurationStatic ChallengeIf you want users to provide a normal password combined with a one-time-password OpenVPN'sstatic-challengeparameter is what you
are looking for.In the client configuration you need to add a line likestatic-challenge "Enter OTP" 1 # use 0 if the OTP should not be echoedWhen connecting you will now be prompted for your password and your OTP. By settingauthorization.static_challengeyou
can now influence how the OTP is used:ignore (default): Just use the password for binding.prepend: Prepend the OTP to your password and use that for binding.append: Append the OTP to your password and use that for binding.The last two options are useful if your LDAP server offers internal 2FA validation
likeoath-ldap.Usingvia-envIn the server configuration the following alternative setting is also supported but discouraged:auth-user-pass-verify /path/to/openvpn-ldap-auth via-envOpenVPN's manpage about that topic:If method is set to "via-env", OpenVPN will call script with the environmental variables username and password set to
the username/password strings provided by the client. Be aware that this method is insecure on some platforms which
make the environment of a process publicly visible to other unprivileged processes.If you still want to usevia-envmake sure to setscript-securityto3.Running TestsFirst make sure to installDockerwithdocker-composeandtox. Then runtoxTo run a specific Python-OpenVPN combination run something liketox-epython38-openvpn25To see a full list of current environment see thetool.toxsection inpyproject.toml.