I'd like to announce the first release candidate of version 2.0 of my LDAP authentication plugin for OpenVPN
This release is a vast improvement on the rudimentary 1.0 plugin -- new features include:
Nick Barkas and I released Splat 1.0 today, on behalf of the Three Rings Department of Public Works. If you need to synchronise information with an LDAP directory, Splat provides a great plugin interface. Included with the distribution are plugins to create home directories, write out SSH keys with command restrictions, and write out .forward files.
We use Splat here at Three Rings to distribute SSH keys to all of our servers, allowing us to further erradicate password authentication. Splat can apply filters based on LDAP groups, so we can, for instance, apply a subversion command= restriction only on the subversion server.
Next splat plugins I want to write:
- User deletion
- Interface to our RFID card access system
Splat is a daemon designed to help keep information in an LDAP directory in sync with information outside of an LDAP directory. This information can be any set of attributes on any object in the LDAP directory.
Splat was originally written for the purpose of distributing SSH keys from LDAP in a way that did not require modifying the SSH daemon.
In the process, we designed a generic daemon capable of pulling nearly any information from LDAP and using it in any way you see fit. Synchronize your LDAP directory with a relational database, update an organizational chart, or build a x509 certificate revocation list.
Changes include the addition of an autoconf-based build system and support for Linux.
More information is available from the OpenVPN Auth-LDAP Plugin page
Yesterday I implemented a LDAP authentication plugin for OpenVPN 2.x. OpenVPN's new plugin architecture makes it surprisingly easy to extend the software in very useful ways.
More information and the source code are available on this page