这几天配置OpenVPN，使用了用户名密码的身份认证方式，借助已有的postfix邮箱帐号，省去了再为每个人设置用户名密码的麻烦。
原理很简单，OpenVPN服务器配置里有这样一句：
auth-user-pass-verify /etc/openvpn/auth-postfix-mailbox.py via-env
就是说要用/etc/openvpn/auth-postfix-mailbox.py这个脚本来验证用户名和密码。用户名和密码如何传递给它呢？via-env，环境变量。
脚本如下：
- #!/usr/bin/env python
- import os
- import sys
- from MySQLdb import *
- import md5crypt
- def auth(username, password):
- conn = connect (host = 'localhost',
- user = 'dbuser',
- passwd = 'dbpasswd',
- db = 'postfix')
- cursor = conn.cursor()
- cursor.execute("""
- select password from mailbox
- where username=%s
- and active=1
- """, (username))
- row = cursor.fetchone()
- if row == None:
- return 1
- crypt = md5crypt.md5crypt(password, row[0])
- cursor.execute("""
- select * from mailbox
- where username=%s
- and password=%s
- and active=1
- """, (username,crypt))
- row = cursor.fetchone()
- cursor.close()
- conn.close()
- if row == None:
- return 1
- return 0
- def main():
- status = 0
- try:
- username = os.environ['username']
- password = os.environ['password']
- status = auth(username, password)
- except:
- sys.exit(1)
- sys.exit(status)
- if __name__ == "__main__":
- main()
由于postfix使用md5认证，所以需要用md5crypt这个模块，从这里可以下载到。