一、服務端配置

1、改動openvpn的主配置文件，加入例如以下內容

[root@ttt openvpn]# cat /etc/openvpn/server.conf |more

#########auth password########
script-security 3 ? ? ? ? ? ? ? ???### --增加腳本處理，如用password驗證
auth-user-pass-verify /etc/openvpn/checkpsw.sh via-env ? ? ###指定僅僅用的認證腳本
client-cert-not-required ? ? ??##### 不請求客戶的CA證書，使用User/Pass驗證，假設同一時候啟用證書和password認證，凝視掉該行
username-as-common-name ? ### ?? 使用客戶提供的UserName作為Common?Name

############################

2、依照配置文件里的腳本路徑放置checkpsw.sh

[root@ttt openvpn]# cat checkpsw.sh?
#!/bin/sh
###########################################################
# checkpsw.sh (C) 2004 Mathias Sundman <mathias@openvpn.se>
#
# This script will authenticate OpenVPN users against
# a plain text file. The passfile should simply contain
# one row per user with the username first followed by
# one or more space(s) or tab(s) and then the password.


PASSFILE="/etc/openvpn/psw-file"
LOG_FILE="/var/log/openvpn-password.log"
TIME_STAMP=`date "+%Y-%m-%d %T"`

###########################################################

if [ ! -r "${PASSFILE}" ]; then
? echo "${TIME_STAMP}: Could not open password file \"${PASSFILE}\" for reading." >> ${LOG_FILE}
? exit 1
fi

CORRECT_PASSWORD=`awk '!/^;/&&!/^#/&&$1=="'${username}'"{print $2;exit}' ${PASSFILE}`

if [ "${CORRECT_PASSWORD}" = "" ]; then?
? echo "${TIME_STAMP}: User does not exist: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}
? exit 1
fi

if [ "${password}" = "${CORRECT_PASSWORD}" ]; then?
? echo "${TIME_STAMP}: Successful authentication: username=\"${username}\"." >> ${LOG_FILE}
? exit 0
fi

echo "${TIME_STAMP}: Incorrect password: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}
exit 1

3、賦予該腳本運行權限

[root@ttt ?openvpn]# chmod +x checkpsw.sh

4、準備username和password認證文件，username和password用空格隔開，同一時候確保openvpn啟動用戶可讀取該文件

[root@ttt openvpn]# cat psw-file?
client01 123456
client02 123456789

為了安全起見，將psw-file的權限盡量改小

[root@ttt openvpn]# chmod 400 psw-file

[root@ttt openvpn]#? chown nobody.nobody psw-file

5、重新啟動openvpn的服務進程

二、改動client的配置文件，加入以下一行

auth-user-pass

三、開啟windowsclient，進行password認證