I figured this one out myself.....
I found out that my programs got executed, however the returnvalue never got back due to a bug in the programming language used.
The following programming snippet has been written in XBasic (The open source variant) that you can download from xbasic.org. It supports Windows and Linux, however the official build doesn't work on the current Linux distributions anylonger, you can get an unofficial build that does support the newer versions in the file-section on the Xbasic mailinglist on the Yahoogroups (you have to register as member of the group in order to get this build).
Anyway, here is a code-snippet that allows you to use OpenVPN in two ways without having to open up two adapters or two tunnels.
You have person A, machine B and hacker C. The code-snippet works in two ways, it reads a list of trusted ip-addresses (i know that's a bit too simple, but i have no idea how to submit machine specific data yet) and in a further scenario, a username and password have to be submitted.
Machine B, does not authenticate itself using user-name and password. I can make it do that, but it is pointless if hacker C is able to fetch all this data from the harddrive in a sneak moment and then goes experimenting at home with the stuff.
I know Machine B's IP address which i register in a table of trusted ip's.
Person A is working on a laptop and working from various sources, so his IP address will be different all the time. I can't anticipate on the ip-addresses, so this person has to log on using username and password. That ain't any more than logical as well.
If hacker C does steal the keys and the configuration file and decides to try logging on at home, he has a problem since his ip address is unknown and therefore OpenVPN responds with the fact that his user-authentication went wrong.
That is what the below code simply does. You need to create a simple text-file containing trusted ip-addresses and perhaps a list with untrusted ip-addresses, just to test it out. The user-database is a very simple array stored database having a 16-byte username container and a 16-byte password container in the same type. The amount of records is being calculated by dividing the database size by 32. Very simple and very fragile, there is no integrity-check whatsover and everything is read plain-text but this is just a simple example.
I don't think the XBasic language is too hard to interpret and convert into your own scripting language :)
You can quickly compile it in Windows, you do need to import kernel32 API lib as the Xbasic runtime does submit the return value wrong. (it always quits with value 0 regardless what you fill into the QUIT() parentheses)
'
'
' ####################
' ##### PROLOG #####
' ####################
'
PROGRAM "progname" ' 1-8 char program/file name without .x or any .extent
VERSION "0.0000" ' version number - increment before saving altered program
IMPORT "xst" ' Standard library : required by most programs
IMPORT "kernel32"
TYPE USER
STRING *16 .NAME
STRING * 16 .PASSWORD
END TYPE
DECLARE FUNCTION Entry ()
USER #Users[]
'
'
' ######################
' ##### Entry () #####
' ######################
'
' This script is used to check user authentication of a person logging on.
' However some locations you might want to use unattended login on.
' That is a bit a problem if you want to require interactive login for person A
' and unattended login for machine B. So here's the deal:
' You can register trusted ip addresses in a list.
' This list will be read, if the ip is listed, no interactive logon is required.
' However if the ip is not listed, then the user needs to verify his login interactively.
' You need the auth-user-pass-optional on the server-side for this to work on
' the machines that do unattended login. You need auth-user-pass directive for
' other users that want to log in as well.
'
FUNCTION Entry ()
XstGetEnvironmentVariable ("untrusted_ip", @value$)
XstGetEnvironmentVariable ("ERRLOG", @dvalue$)
XstLoadStringArray("trusted_ip_clients.txt", @trustedlist$[])
XstLoadStringArray("untrusted_ip_clients.txt", @untrustedlist$[])
XstGetCommandLineArguments (@argc, @argv$[])
'Process contents of loaded files and read environment variables.
PRINT "All arguments collected"
FOR X = 0 TO UBOUND(trustedlist$[])
IF value$ == trustedlist$[X] THEN
PRINT "Found trusted ip is logging on..."
ExitProcess(0)
END IF
NEXT X
found = 0
FOR X = 0 TO UBOUND(untrustedlist$[])
IF value$ == untrustedlist$[X] THEN
PRINT "Untrusted ip found"
found = 1
END IF
NEXT X
IFZ found THEN
PRINT "Log unmatched trusted ip as Untrusted"
REDIM untrustedlist$[UBOUND(untrustedlist$[])+1]
untrustedlist$[UBOUND(untrustedlist$[])] = value$
XstSaveStringArray("untrusted_ip_clients.txt",@untrustedlist$[])
END IF
PRINT "Initializing password check"
GOSUB CHECKPASS
SUB CHECKPASS
REDIM log$[argc]
FOR X = 0 TO argc
log$[X] = "Argument ("+STRING(X)+"):"+ argv$[X]
PRINT log$[X]
NEXT X
pass_file$ = argv$[1]
PRINT "Read user credentials:"; pass_file$
XstLoadStringArray(pass_file$, @pass$[])
REDIM log$[UBOUND(log$[])+1]
log$[UBOUND(log$[])] = "ERRLOG variable:" + dvalue$
PRINT "Credentials read."
offset = UBOUND(log$[])+1
REDIM log$[UBOUND(log$[])+UBOUND(pass$[])]
FOR X = 0 TO UBOUND(pass$[])
log$[offset+X] = "Remote User/pass ("+STRING(X)+"):"+pass$[X]
PRINT log$[offset+X]
NEXT X
PRINT "Read user-database..."
FileHandle = OPEN ("userdb.db", $$RD OR $$RWSHARE)
IF FileHandle <> -1 THEN
records = (LOF(FileHandle)/32)
REDIM log$[UBOUND(log$[])+1]
log$[UBOUND(log$[])] = "User records:" + STRING(records)
REDIM #Users[records-1]
READ [FileHandle], #Users[]
CLOSE (FileHandle)
ELSE
REDIM log$[UBOUND(log$[])+1]
log$[UBOUND(log$[])] = "User database could not be loaded. Terminating authentication process."
ExitProcess(1)
END IF
PRINT "Userdatabase read completed."
offset = UBOUND(log$[])+1
REDIM log$[UBOUND(log$[])+UBOUND(dbval$[])]
FOR X = 0 TO UBOUND(dbval$[])
log$[offset+X] = "Local User/pass ("+STRING(X)+"):"+argv$[X]
NEXT X
PRINT "Checking authentication."
subname$ = pass$[0]
subpass$ = pass$[1]
subname$ = TRIM$(subname$)
subpass$ = TRIM$(subpass$)
FOR X = 0 TO UBOUND(#Users[])
dbname$ = #Users[X].NAME
dbpass$ = #Users[X].PASSWORD
dbname$ = TRIM$(dbname$)
dbpass$ = TRIM$(dbpass$)
IF (dbname$ == subname$) && (dbpass$ == subpass$) THEN
REDIM log$[UBOUND(log$[])+1]
log$[UBOUND(log$[])] = "User/Pass both match, login succeeded"
XstSaveStringArray("user_auth.log",@log$[])
ExitProcess(0)
END IF
NEXT X
REDIM log$[UBOUND(log$[])+1]
log$[UBOUND(log$[])] = "User/Pass mismatch, login failed"
XstSaveStringArray("user_auth.log",@log$[])
ExitProcess(1) 'QUIT(1) ' Unsuccessful, no logging on allowed.
END SUB
END FUNCTION
END PROGRAM
What i consider to do next, is to make the machine execute a client-side script and let it submit some machine specific key as username / password combination and decrypt it based on the CA.key or the secret.key. (they both exist on server and client). This will require a one-time generation on the machine side to set it up and to be able to register the machine key in the database as well.
Now the hacker has an extra problem, he not only has to guess a user/password combination, he has to encrypt it first as well....
So i was wondering if someone else has some nice idea to add or alter this one with....
