Tutorial: How to Add Users to Your Access Server Using PAM
Add VPN users for Access Server using pluggable authentication modules (PAM) on your Linux OS.
Overview
You can configure user credential authentication for Access Server with the system that suits your needs. Access Server supports PAM, LDAP, RADIUS, SAML, and local authentication. For more details, refer to the authentication system topic.
This topic provides an overview of using pluggable authentication modules (PAM) to authenticate Access Server users.
An installed Access Server.
Console access and the ability to get root access.
You manage PAM authentication on the server, typically using the local user accounts in the operating system where you’ve installed Access Server. You can also use an authentication system on a separate server, as long as it’s reachable by Access Server.
Connect to your server.
This can be a direct connection, using a terminal or bash, or using an app like PuTTY.
Connect as a root user or gain root privileges with sudo.
Switch to the scripts directory:
cd /usr/local/openvpn_as/scripts/
Add a user:
adduser <USERNAME> ./sacli --user <USERNAME> --key "type" --value "user_connect" UserPropPut
Set the new user’s password or enter the user information as prompted (depending on your OS version):
passwd <USERNAME>
Repeat the commands to add more users.
For additional command-line tips for PAM, refer to Tutorial: Manage the PAM Authentication Method from the Command-line Interface.
You have two options for enabling PAM as the Access Server authentication: Using the Admin Web UI or the command-line interface. We describe each in the sections below.
Note
In older Access Server versions, you could enable PAM from Authentication > PAM, but this page no longer exists in the Admin Web UI. We always recommend using the most updated Access Server version.
Enable PAM in the Admin Web UI
You can enable PAM authentication using a web-based interface through the Admin Web UI for your Access Server. You can enable it as the default (global) authentication, for a group, or for individual users.
Enable PAM as the default authentication
Sign in to the Admin Web UI.
Click Authentication > Settings.
Under Default Authentication System, click PAM.
Select Save Settings and Update Running Server.
Access Server now uses PAM for authentication.
Enable PAM as the group authentication
Sign in to the Admin Web UI.
Click User Management > Group Permissions.
Enter a group name or find the desired group from the existing list.
Click More Settings.
Click PAM for Configure user authentication method.
Select Save Settings and Update Running Server.
Users assigned to that group (in the User Permissions page) now use PAM for authentication.
Enable PAM as a user's authentication
Sign in to the Admin Web UI.
Click User Management > User Permissions.
Find the user as entered in the server's user directory.
Click More Settings.
Click PAM for Configure user authentication method.
Select Save Settings and Update Running Server.
That user now uses PAM for authentication.
Enable PAM in the command-line interface
You can also manage PAM authentication with the commands referred to in this tutorial: Tutorial: Manage the PAM Authentication Method from the Command-line Interface.
After creating your users on your server, you can grant them specific permissions from the Admin Web UI.
You can grant administrative privileges, allow auto-login profiles, etc:
Sign in to the Admin Web UI.
Click User Management > User Permissions.
From the User Permissions page, grant or revoke permissions for each user.
- Tutorial: How to View the Current Server Configuration
- Tutorial: Manually Edit Access Server Configuration Using ConfigReplace
- Tutorial: Change the Web Service Forwarding Settings
- Tutorial: How to Change the Web Session Timeout
- Tutorial: Set the Interface and Ports for the Web Services
- Tutorial: Specify Custom HTTP Headers
- Tutorial: Manage User and Group Properties from the Command Line
- Tutorial: How to Change the Authentication Mode in the Command-Line Interface
- Tutorial: How to Manage TOTP MFA from the Command Line
- Tutorial: Manage the Local Authentication Method from the Command-Line Interface
- Tutorial: Manage the LDAP Authentication Method from the Command-Line Interface
- Tutorial: Manage the RADIUS Authentication Method from the Command-line Interface
- Tutorial: Manage the SAML Authentication Method from the Command-line Interface
- Tutorial: Manage the PAM Authentication Method from the Command-line Interface
- Tutorial: How to Replace the Legacy openvpn Administrative Account
- Tutorial: Install a Signed SSL Certificate from the Command-line Interface
- Tutorial: How to Manually Regenerate Self-signed Certificates
- Tutorial: Harden the Web Server Cipher Suite String
- Tutorial: Change the Data-Channel Encryption Cipher
- Tutorial: Turn Off Encryption in Access Server
- Tutorial: Manage Token URLs from the Command-line Interface
- Tutorial: How to Adjust Access Server's Session Tokens
- Tutorial: Set the Threshold to Disconnect Inactive Clients
- Tutorial: Turn on OpenVPN DCO in Access Server
- Tutorial: An Intro to the sacli Command-Line Utility
- Tutorial: Manage Access Server Services via Command Line