Authentication and plugins
Apart from X.509 tools, OpenVPN provides a mechanism to use authentication plugins along with client connection scripts. It is possible to remove the requirement for client certificates using --client-cert-not-required (deprecated in 2.4, removed in 2.5 in favor of --verify-client-cert). In this case, authentication rests solely upon the --auth-user-pass-verify option.
If --client-config-dir is still desired without client certificates, you will need to leverage --username-as-common-name. Of course, if you're going to require usernames and passwords, it is necessary to add the --auth-user-pass option to all the client configuration files.
The --auth-user-pass-verify script is the last in a long chain of scripts that are ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access