Using pam_exec.so for openvpn authentication

Question

I've set up a PAM authentication config for OpenVPN.

auth required pam_exec.so debug expose_authtok /opt/openvpn/bin/pamauth

The script pamauth returns 0 on success. I verify this is true by also echoing the value to a file from the pamauth script.

<user authentication process>
echo $EXIT_CODE >/tmp/result       #yields a '0' in /tmp/result
exit $EXIT_CODE

But authentication fails, and the auth.log shows the following, though I can clearly see from /tmp/result that my pamauth script ran and called exit 0

Jul  5 09:53:29 client openvpn: pam_exec(openvpn:auth): send password to child
Jul  5 09:53:29 client openvpn: pam_exec(openvpn:auth): Calling /opt/openvpn/bin/pamauth ...
Jul  5 09:53:29 client openvpn: pam_unix(openvpn:account): could not identify user (from getpwnam(test40))

Answer 1

The error message doesn't even mention pam_exec.

Jul  5 09:53:29 client openvpn: pam_unix(openvpn:account): could not identify user (from getpwnam(test40))

The problem is in the account management (account) stage. (If the config for pam.d/openvpn doesn't have any account modules, PAM will use the ones configured in pam.d/other.)

"Could not identify user" here means the pam_unix module could not find the user account test40 in the system. If you have recently edited nsswitch.conf, you might have to restart OpenVPN.