rain87
Advanced Member | Редактировать | Профиль | Сообщение | ICQ | Цитировать | Сообщить модератору
DocBeen
Цитата: --auth-user-pass-verify script method
Require the client to provide a username/password (possibly in addition to a client certificate) for authentication.
OpenVPN will execute script as a shell command to validate the username/password provided by the client.
If method is set to "via-env", OpenVPN will call script with the environmental variables username and password set to the username/password strings provided by the client. Be aware that this method is insecure on some platforms which make the environment of a process publicly visible to other unprivileged processes.
If method is set to "via-file", OpenVPN will write the username and password to the first two lines of a temporary file. The filename will be passed as an argument to script, and the file will be automatically deleted by OpenVPN after the script returns. The location of the temporary file is controlled by the --tmp-dir option, and will default to the current directory if unspecified. For security, consider setting --tmp-dir to a volatile storage medium such as /dev/shm (if available) to prevent the username/password file from touching the hard drive.
The script should examine the username and password, returning a success exit code (0) if the client's authentication request is to be accepted, or a failure code (1) to reject the client.
This directive is designed to enable a plugin-style interface for extending OpenVPN's authentication capabilities.
To protect against a client passing a maliciously formed username or password string, the username string must consist only of these characters: alphanumeric, underbar ('_'), dash ('-'), dot ('.'), or at ('@'). The password string can consist of any printable characters except for CR or LF. Any illegal characters in either the username or password string will be converted to underbar ('_').
Care must be taken by any user-defined scripts to avoid creating a security vulnerability in the way that these strings are handled. Never use these strings in such a way that they might be escaped or evaluated by a shell interpreter.
For a sample script that performs PAM authentication, see sample-scripts/auth-pam.pl in the OpenVPN source distribution. |
для выдачи пользователям конкретного ип можно использовать
Цитата: --client-connect script
Run script on client connection. The script is passed the common name and IP address of the just-authenticated client as environmental variables (see environmental variable section below). The script is also passed the pathname of a not-yet-created temporary file as $1 (i.e. the first command line argument), to be used by the script to pass dynamically generated config file directives back to OpenVPN.
If the script wants to generate a dynamic config file to be applied on the server when the client connects, it should write it to the file named by $1.
See the --client-config-dir option below for options which can be legally used in a dynamically generated config file.
Note that the return value of script is significant. If script returns a non-zero error status, it will cause the client to be disconnected. |
более детально всё тут http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html
Добавлено:
если интересовали именно примеры скриптов, вот то что я юзал когда то auth-user-pass-verify.pl и client-connect.pl
----------
матрица - это система. она и есть наш враг
everyone's first vi session. ^C^C^X^X^X^XquitqQ!qdammit[esc]qwertyuiopasdfghjkl;:xwhat |
|
