一、服務(wù)端配置

1、改動(dòng)openvpn的主配置文件，加入例如以下內(nèi)容

[root@ttt openvpn]# cat /etc/openvpn/server.conf |more

#########auth password########
script-security 3 ? ? ? ? ? ? ? ???### --增加腳本處理，如用password驗(yàn)證
auth-user-pass-verify /etc/openvpn/checkpsw.sh via-env ? ? ###指定僅僅用的認(rèn)證腳本
client-cert-not-required ? ? ??##### 不請(qǐng)求客戶的CA證書(shū)，使用User/Pass驗(yàn)證，假設(shè)同一時(shí)候啟用證書(shū)和password認(rèn)證，凝視掉該行
username-as-common-name ? ### ?? 使用客戶提供的UserName作為Common?Name

############################

2、依照配置文件里的腳本路徑放置checkpsw.sh

[root@ttt openvpn]# cat checkpsw.sh?
#!/bin/sh
###########################################################
# checkpsw.sh (C) 2004 Mathias Sundman <mathias@openvpn.se>
#
# This script will authenticate OpenVPN users against
# a plain text file. The passfile should simply contain
# one row per user with the username first followed by
# one or more space(s) or tab(s) and then the password.


PASSFILE="/etc/openvpn/psw-file"
LOG_FILE="/var/log/openvpn-password.log"
TIME_STAMP=`date "+%Y-%m-%d %T"`

###########################################################

if [ ! -r "${PASSFILE}" ]; then
? echo "${TIME_STAMP}: Could not open password file \"${PASSFILE}\" for reading." >> ${LOG_FILE}
? exit 1
fi

CORRECT_PASSWORD=`awk '!/^;/&&!/^#/&&$1=="'${username}'"{print $2;exit}' ${PASSFILE}`

if [ "${CORRECT_PASSWORD}" = "" ]; then?
? echo "${TIME_STAMP}: User does not exist: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}
? exit 1
fi

if [ "${password}" = "${CORRECT_PASSWORD}" ]; then?
? echo "${TIME_STAMP}: Successful authentication: username=\"${username}\"." >> ${LOG_FILE}
? exit 0
fi

echo "${TIME_STAMP}: Incorrect password: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}
exit 1

3、賦予該腳本運(yùn)行權(quán)限

[root@ttt ?openvpn]# chmod +x checkpsw.sh

4、準(zhǔn)備username和password認(rèn)證文件，username和password用空格隔開(kāi)，同一時(shí)候確保openvpn啟動(dòng)用戶可讀取該文件

[root@ttt openvpn]# cat psw-file?
client01 123456
client02 123456789

為了安全起見(jiàn)，將psw-file的權(quán)限盡量改小

[root@ttt openvpn]# chmod 400 psw-file

[root@ttt openvpn]#? chown nobody.nobody psw-file

5、重新啟動(dòng)openvpn的服務(wù)進(jìn)程

二、改動(dòng)client的配置文件，加入以下一行

auth-user-pass

三、開(kāi)啟windowsclient，進(jìn)行password認(rèn)證