Настроена авторизация OpenVPN + Ldap
# cat vpn.conf
port 1194
proto tcp
dev tun1
ca keys-vpn/ca.crt
cert keys-vpn/server.crt
key keys-vpn/server.key
dh keys-vpn/dh1024.pem
server 172.16.3.0 255.255.255.0
route 172.16.3.0 255.255.255.252
push "route 172.16.2.0 255.255.255.0"
push "route 172.16.1.0 255.255.255.0"
push "route 172.16.10.0 255.255.255.252"
ifconfig-pool-persist ipp.txt
client-cert-not-required
username-as-common-name
tun-mtu 1400
# tun-mtu-extra 32
# mssfix 1372
# Push DNS WINS
push "redirect-gateway def1"
script-security 2
client-to-client
auth MD5
cipher BF-CBC
keepalive 10 120
comp-lzo
max-clients 100
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
log /var/log/openvpn/openvpn-vpn.log
verb 3
plugin /usr/lib/openvpn/openvpn-auth-ldap.so "/etc/openvpn/openvpn-auth-ldap"
# cat openvpn-auth-ldap
<LDAP>
# Адрес OpenLDAP сервера
URL ldap://x.x.x.x:389
# Пользователь в LDAP с правом поиска
BindDN cn=admin,dc=oc,dc=local
# Его пароль
Password pass
Timeout 15
TLSEnable no
FollowReferrals yes
</LDAP>
<Authorization>
BaseDN "ou=People,dc=oc,dc=local"
SearchFilter "(&(uid=%u))"
RequireGroup false
</Authorization>
Все хорошо работает, пользователи авторизуются и спокойно подключаются.
Мне нужно теперь ограничить доступ пользователей к ВПН, отдельно завел группу в OpenLdap vpn и добавил пользователей, которым разрешен VPN.
поправил конфиг # cat openvpn-auth-ldap
<LDAP>
# Адрес OpenLDAP сервера
URL ldap://x.x.x.x:389
# Пользователь в LDAP с правом поиска
BindDN cn=admin,dc=oc,dc=local
# Его пароль
Password pass
Timeout 15
TLSEnable no
FollowReferrals yes
</LDAP>
<Authorization>
BaseDN "ou=People,dc=oc,dc=local"
SearchFilter "(&(uid=%u))"
RequireGroup true
#PFTable ips_vpn_users
<Group>
BaseDN "ou=Group,dc=oc,dc=local"
SearchFilter "(|(cn=vpn))"
MemberAttribute memberUid
# Add group members to a PF table (disabled)
#PFTable ips_vpn_eng
</Group>
</Authorization>
При попытке авторизоваться openvpn ругается:
LDAP user "marat" was not found.
Fri Jun 29 12:03:27 2012 89.184.25.141:39682 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-ldap.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
Fri Jun 29 12:03:27 2012 89.184.25.141:39682 PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/lib/openvpn/openvpn-auth-ldap.so
Fri Jun 29 12:03:27 2012 89.184.25.141:39682 TLS Auth Error: Auth Username/Password verification failed for peer
Fri Jun 29 12:03:27 2012 89.184.25.141:39682 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Fri Jun 29 12:03:27 2012 89.184.25.141:39682 [] Peer Connection Initiated with [AF_INET]89.184.25.141:39682
Fri Jun 29 12:03:29 2012 89.184.25.141:39682 PUSH: Received control message: 'PUSH_REQUEST'
Fri Jun 29 12:03:29 2012 89.184.25.141:39682 Delayed exit in 5 seconds
Fri Jun 29 12:03:29 2012 89.184.25.141:39682 Delayed exit in 5 seconds
Fri Jun 29 12:03:29 2012 89.184.25.141:39682 SENT CONTROL [UNDEF]: 'AUTH_FAILED' (status=1)
Fri Jun 29 12:03:30 2012 89.184.25.141:39682 Connection reset, restarting [0]
Fri Jun 29 12:03:30 2012 89.184.25.141:39682 SIGUSR1[soft,connection-reset] received, client-instance restarting
Fri Jun 29 12:03:30 2012 89.184.25.141:39682 SIGUSR1[soft,connection-reset] received, client-instance restarting
Fri Jun 29 12:03:30 2012 TCP/UDP: Closing socket
Пользователь в группе есть:
ldapsearch -W -x -D cn=admin,dc=oc,dc=local -b "ou=Group,dc=oc,dc=local" "(&(cn=vpn))"
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <ou=Group,dc=oc,dc=local> with scope subtree
# filter: (&(cn=vpn))
# requesting: ALL
#
# vpn, Group, oc.local
dn: cn=vpn,ou=Group,dc=oc,dc=local
objectClass: posixGroup
objectClass: top
gidNumber: 10010
cn: vpn
description: vpn
memberUid: a
memberUid: b
memberUid: c
memberUid: d
memberUid: marat
memberUid: x
memberUid: y
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
Помогите разобраться?