openvpn-auth-pamSYNOPSISThe openvpn-auth-pam module implements username/passwordauthentication via PAM, and essentially allows any authenticationmethod supported by PAM (such as LDAP, RADIUS, or Linux Shadowpasswords) to be used with OpenVPN.  While PAM supportsusername/password authentication, this can be combined with X509certificates to provide two indepedent levels of authentication.This module uses a split privilege execution model which willfunction even if you drop openvpn daemon privileges using the user,group, or chroot directives.BUILDTo build openvpn-auth-pam, you will need to have the pam-develpackage installed.Build with the "make" command.  The module will be namedopenvpn-auth-pam.soUSAGETo use this plugin module, add to your OpenVPN config file:  plugin openvpn-auth-pam.so service-typeThe required service-type parameter corresponds tothe PAM service definition file usually foundin /etc/pam.d.This plugin also supports the usage of a list of name/valuepairs to answer PAM module queries.For example:  plugin openvpn-auth-pam.so "login login USERNAME password PASSWORD"tells auth-pam to (a) use the "login" PAM module, (b) answer a"login" query with the username given by the OpenVPN client, and(c) answer a "password" query with the password given by theOpenVPN client.  This provides flexibility in dealing with the differenttypes of query strings which different PAM modules might generate.For example, suppose you were using a PAM module called"test" which queried for "name" rather than "login":  plugin openvpn-auth-pam.so "test name USERNAME password PASSWORD"While "USERNAME" and "PASSWORD" are special strings which substituteto client-supplied values, it is also possible to name literal valuesto use as PAM module query responses.  For example, suppose that thelogin module queried for a third parameter, "domain" whichis to be answered with the constant value "mydomain.com":  plugin openvpn-auth-pam.so "login login USERNAME password PASSWORD domain mydomain.com"The following OpenVPN directives can also influencethe operation of this plugin:  client-cert-not-required  username-as-common-nameRun OpenVPN with --verb 7 or higher to get debugging output fromthis plugin, including the list of queries presented by theunderlying PAM module.  This is a useful debugging tool to figureout which queries a given PAM module is making, so that you cancraft the appropriate plugin directive to answer it.CAVEATSThis module will only work on *nix systems which support PAM,not Windows.