Blame
| d13735 | Samuli Seppänen | 2025-03-18 12:52:14 | 1 | # PluginOverview |
| 2 | ||||
| 3 | # OpenVPN Plugins |
|||
| 4 | ||||
| 5 | OpenVPN functionality can be extended by plugins to bring in extra functionality. |
|||
| 6 | ||||
| 7 | Most frequently used are authentication plugins to bring in authentication against LDAP or Radius or other PAM backends, but there's also hooks to add per-client configuration etc. |
|||
| 8 | ||||
| 9 | This page is intended to collect information about existing plugins and pointers to documentation. |
|||
| 10 | ||||
| 11 | ## Existing Plugins |
|||
| 12 | ||||
| 13 | ### Fully maintained by OpenVPN maintainers |
|||
| 14 | ||||
| 15 | |**plugin name** |**hook(s)** |**async** |**source** |**remark** | |
|||
| 16 | |-|-|-|-|-| |
|||
| 17 | | auth-pam | up, auth | yes(opt) | openvpn repo (src/plugins/) | use operating system PAM stack for username+password (or 2FA...) authentication | |
|||
| 18 | | down-root | up, down | no | openvpn repo (src/plugins/) | permit running a "cleanup" script at openvpn exit time if openvpn is running with reduced privileges and cannot cleanup itself | |
|||
| 19 | ||||
| 20 | ### Sample plugins in the OpenVPN source tree (not considered "ready for production") |
|||
| 21 | ||||
| 22 | |**plugin name** |**hook(s)** |**async** |**source** |**remark** | |
|||
| 23 | |-|-|-|-|-| |
|||
| 24 | | defer | up, auth (*) | yes | sample/sample-plugins/ | sample plugin to show how a "deferred authentication" plugin operates | |
|||
| 25 | | keying-material-exporter-demo | TLS_FINAL, TLS_VERIFY | no | sample/sample-plugins/ | shows how one could do a HTTP/SSO via OpenVPN | |
|||
| 26 | | log | many | no | sample/sample-plugins/ | shows how to do logging from a plugin using the OpenVPN APIs | |
|||
| 27 | | simple | many | no | sample/sample-plugins/ | hooks everything and logs when called | |
|||
| 28 | ||||
| 29 | ### Plugins maintained elsewhere |
|||
| 30 | ||||
| 31 | |**plugin name** |**hook(s)** |**async** |**source** |**remark** | |
|||
| 32 | |-|-|-|-|-| |
|||
| 33 | | radiusplugin | auth, client-connect | yes | https://github.com/FreeRADIUS/ https://www.nongnu.org/radiusplugin/ https://github.com/ValdikSS/openvpn-radiusplugin.git https://github.com/comicchang/radiusplugin.git https://github.com/cuckoohello/radiusplugin.git https://github.com/OpenVPN-Community/openvpn-radiusplugin.git https://github.com/zelenkovsky/radiusplugin.git https://github.com/ArtemZ/radiusplugin-2x4.git https://github.com/PrivateCommunicationsCorp/radius-plugin.git | adds authentication and client configuration from RADIUS data | |
|||
| 34 | | eurephia | auth | no (?) | http://www.eurephia.net/ | flexible authentication from database/rules | |
|||
| 35 | | mozilla/openvpn-defer-auth | auth | yes | https://github.com/mozilla-it/openvpn_defer_auth | use the async/deferred auth plugin interface to run --auth-user-pass *scripts* in the background without blocking | |
|||
| 36 | | openvpn-auth-ldap | auth, OpenBSD pf | //no// (PR exists) | https://github.com/threerings/openvpn-auth-ldap | Username/Password auth via LDAP, Integration with OpenBSD pf. Supports Challenge/Response. | |
|||
| 37 | | auth-script-openvpn | auth | yes | https://github.com/pdemonaco/auth-script-openvpn | another plugin to run a script in deferred/async mode | |
|||
| 38 | ||||
| 39 | ## Documentation |
|||
| 40 | ||||
| 41 | (This section needs work). |
|||
| 42 | ||||
| 43 | Some information on the available hooks and calling convention can be found in the OpenVPN source tree in ``` include/openvpn-plugin.h ```, and in the ``` sample/sample-plugins/... ``` source files. |