KENSEI IT BLOG

https://serverfault.com/questions/358855/how-to-prevent-users-from-sharing-certificates-in-openvpn 

mkdir /etc/openvpn/script

#!/bin/bash

# username and common_name must be the same to allow access.

# users are not allowed to share their cert

if [ $username != $common_name ]; then

   echo "$(date +%Y%m%d-%H%M%S) DENIED  username=$username cert=$common_name" >> /var/log/openvpn-access.log

   exit 1

fi

echo "$(date +%Y%m%d-%H%M%S) GRANTED username=$username cert=$common_name" >> /var/log/openvpn-access.log

exit 0

# 인증서 검증 (사용자 인증서 = 사용자 계정)

script-security 2

# untrusted state

auth-user-pass-verify /etc/openvpn/scripts/check_cn_on_connect.sh via-env

chmod +x /etc/openvpn/scripts/check_cn_on_connect.sh

chown nobody.nobody check_cn_on_connect.sh

touch /var/log/openvpn-access.log

chown nobody.nobody /var/log/openvpn-access.log