OpenVPN Yubikey authentication

check-key.sh

#! /bin/bash
#                         _______
#   ____________ _______ _\__   /_________       ___  _____
#  |    _   _   \   _   |   ____\   _    /      |   |/  _  \
#  |    /   /   /   /   |  |     |  /___/   _   |   |   /  /
#  |___/___/   /___/____|________|___   |  |_|  |___|_____/
#          \__/                     |___|
#
# (c) 2011 Wijnand Modderman-Lenstra <[email protected]>
# MIT License
#
# Authentication adapter that allows OpenVPN clients to be
# authenticated using a Yubikey
#
# Example configuration:
#
# script-security 2
# auth-user-pass-verify check-key.sh via-file
#

# Debugging:
#exec 2>>/tmp/check-key.log
#set -x

if [ -z "$1" ]; then
        echo "$0 <file>" >&2
        exit 1
fi

CHALLENGE=$(cat $1)
set -- $(cat $1 | tr \\n ' ')

# Check if user exists
USERID=$(getent passwd | grep "^$1:" | awk -F: '{print $3}')
if [ -z "${USERID}" ]; then
        echo "$1: user not found"
        exit 1
fi

# Check if user exsits in map file
KEYID=$(grep "^$1:" /etc/yubikeyid | awk -F: '{print $2}')
if [ -z "${KEYID}" ]; then
        echo "$1: user not found in /etc/yubikeyid"
        exit 1
fi

# Check if key id matches
echo "$2" | grep -q "^${KEYID}"
if [ $? -gt 0 ]; then
        echo "$1: keyid mismatch"
        exit 1
fi

# Ask validation server if the key is correct
/usr/local/bin/ykclient ${USERID} $2
RETVAL=$?

if [ $RETVAL -gt 0 ]; then
        echo "$1: validation failed"
fi

exit ${RETVAL}

good