Tutorial: Manage the Local Authentication Method from the Command-Line Interface⁠

Overview⁠

Use this tutorial to find the commands necessary to manage the local authentication method for Access Server.

Access Server stores user and group properties in the /usr/local/openvpn_as/etc/db/userprop.db file for local authentication mode.

Access Server 2.10.1 and newer supports hashed passwords in the user properties database in SHA256, PBKDF2, or SCrypt format. New password hashes are stored as PBKDF2 by default. PBKDF2 is implemented with a 16-byte random salt, SHA-256 hashing, a 32-byte output length, and 100,000 iterations. During Access Server upgrades, stored local user password hashes remain the same. To maintain backward compatibility, the older hash formats still work, but when local user passwords are updated, they are replaced with PBKDF2 hashes.

Access Server 2.11.0 and newer introduces optional support for using the OpenSSL SCrypt function to hash local user passwords. It’s slightly more secure and efficient than PBKDF2, but it's not compatible with FIPS mode or available on all platforms. Therefore, we didn’t enable it by default. You can enable it on the command line with the auth.local.0.prefer_scrypt parameter.

Prerequisites⁠

Root access to your Access Server's console.
Connect directly to your server and run the commands from /usr/local/openvpn_as/scripts/.

Set the default authentication mode to local:

./sacli --key "auth.module.type" --value "local" ConfigPut
./sacli start

Prefer the SCrypt password hashing method (on Access Server 2.11 and newer):

./sacli --key "auth.local.0.prefer_scrypt" --value "true" ConfigPut
./sacli start

Add a new user from scratch:

./sacli --user <USER_NAME> --key "type" --value "user_connect" UserPropPut
./sacli start

Set password for a user in local authentication mode:

sacli --user '<USER_NAME>' --new_pass '<PASSWORD>' SetLocalPassword
sacli start

Set the authentication mode for the user (on Access Server 2.10 and newer):

./sacli --user <USER> --key "user_auth_type" --value "local" UserPropPut
./sacli start

Remove password for a user in local authentication mode:

./sacli --user <USER_NAME> RemoveLocalPassword
./sacli start

Remove all user properties to delete the user:

./sacli --user <USER_OR_GROUP> UserPropDelAll
./sacli start

For more information, refer to Tutorial: Manage User and Group Properties from the Command Line.

Can't find what you're looking for?

Our support team will be happy to assist you.

Contact Support Schedule a Demo

Tutorial: Manage the Local Authentication Method from the Command-Line Interface⁠

Overview⁠

Prerequisites⁠

Was this information helpful?