About --auth-user-pass-verify in OpenVPN

--auth-user-pass-verify script method

Require the client to provide a username/password (possibly in addition to a client certificate) for authentication.

OpenVPN will execute script as a shell command to validate the username/password provided by the client.

If method is set to "via-env", OpenVPN will call script with the environmental variables username and passwordset to the username/password strings provided by the client. Be awarethat this method is insecure on some platforms which make theenvironment of a process publicly visible to other unprivilegedprocesses.

If methodis set to "via-file", OpenVPN will write the username and password tothe first two lines of a temporary file. The filename will be passed asan argument to script, and the file will be automaticallydeleted by OpenVPN after the script returns. The location of thetemporary file is controlled by the --tmp-dir option, and will default to the current directory if unspecified. For security, consider setting --tmp-dir to a volatile storage medium such as /dev/shm (if available) to prevent the username/password file from touching the hard drive.

Thescript should examine the username and password, returning a successexit code (0) if the client's authentication request is to be accepted,or a failure code (1) to reject the client.

This directive is designed to enable a plugin-style interface for extending OpenVPN's authentication capabilities.

Toprotect against a client passing a maliciously formed username orpassword string, the username string must consist only of thesecharacters: alphanumeric, underbar ('_'), dash ('-'), dot ('.'), or at('@'). The password string can consist of any printable charactersexcept for CR or LF. Any illegal characters in either the username orpassword string will be converted to underbar ('_').

Caremust be taken by any user-defined scripts to avoid creating a securityvulnerability in the way that these strings are handled. Never usethese strings in such a way that they might be escaped or evaluated bya shell interpreter.

For a sample script that performs PAM authentication, see sample-scripts/auth-pam.pl in the OpenVPN source distribution.