Tutorial: Manage the PAM Authentication Method from the Command-line Interface
Use this tutorial to manage PAM as an Access Server authentication method from the command-line interface.
Overview
Use this tutorial to find the necessary commands to manage PAM authentication for Access Server.
In PAM authentication mode, user and password authentications are stored in the operating system. User-specific properties are stored in the user_prop.db database file. After creating a user in the operating system and setting a password, you must add the user to Access Server. You can add users in the Admin Web UI under User Management. Or you can add users from the command-line interface. You must add each user to the "User Permissions" table and set user-specific properties such as auto-login, group assignment, and static IP.
The user can sign in once the same username exists in Access Server and the operating system. Access Server looks up this user in User Permissions and automatically applies the user-specific properties specified. If you notice that properties aren't applied, ensure the name is correct. The username in PAM is leading here.
Important
The username lookup is case-sensitive. For a username in the operating system, "justin", you must use "justin" in User Permissions or the command line to set user-specific properties. By default, most Linux operating systems prefer that you use lowercase usernames. It is best to adhere to this in PAM authentication mode. Below are some basic commands to manage PAM user accounts and credentials.
The following commands require that you connect directly to your server with root privileges and run them from /usr/local/openvpn_as/scripts/.
Set authentication mode to PAM:
./sacli --key "auth.module.type" --value "pam" ConfigPut ./sacli start
Add a new user from scratch:
adduser <USER_NAME> ./sacli --user <USER_NAME> --key "type" --value "user_connect" UserPropPut
Set password for an existing user in PAM authentication mode:
passwd <USER_NAME>
Remove a user from both PAM and Access Server:
deluser <USER_NAME> ./sacli --user <USER_OR_GROUP> UserPropDelAll
For more information, refer to Tutorial: Manage User and Group Properties from the Command Line.
- Tutorial: How to View the Current Server Configuration
- Tutorial: Manually Edit Access Server Configuration Using ConfigReplace
- Tutorial: Change the Web Service Forwarding Settings
- Tutorial: How to Change the Web Session Timeout
- Tutorial: Set the Interface and Ports for the Web Services
- Tutorial: Specify Custom HTTP Headers
- Tutorial: Manage User and Group Properties from the Command Line
- Tutorial: How to Change the Authentication Mode in the Command-Line Interface
- Tutorial: How to Manage TOTP MFA from the Command Line
- Tutorial: Manage the Local Authentication Method from the Command-Line Interface
- Tutorial: Manage the LDAP Authentication Method from the Command-Line Interface
- Tutorial: Manage the RADIUS Authentication Method from the Command-line Interface
- Tutorial: Manage the SAML Authentication Method from the Command-line Interface
- Tutorial: How to Add Users to Your Access Server Using PAM
- Tutorial: How to Replace the Legacy openvpn Administrative Account
- Tutorial: Install a Signed SSL Certificate from the Command-line Interface
- Tutorial: How to Manually Regenerate Self-signed Certificates
- Tutorial: Harden the Web Server Cipher Suite String
- Tutorial: Change the Data-Channel Encryption Cipher
- Tutorial: Turn Off Encryption in Access Server
- Tutorial: Manage Token URLs from the Command-line Interface
- Tutorial: How to Adjust Access Server's Session Tokens
- Tutorial: Set the Threshold to Disconnect Inactive Clients
- Tutorial: Turn on OpenVPN DCO in Access Server
- Tutorial: An Intro to the sacli Command-Line Utility
- Tutorial: Manage Access Server Services via Command Line