eurephia-variables(7)

✨ eurephia-variables ✨

okay bestie, welcome to the manual page for eurephia-variables — yes that's the manual name, no we're not being normal about it 💅

---

🌸 DESCRIPTION 🌸

this is literally your one-stop overview of every single eurephia configuration variable that exists. they all live in the database, and you can poke at them with the eurephiadm config command. that's it, that's the vibe. 🎀

---

🔐 PASSWORD HASH 🔐

these variables are all about how passwords get hashed. all of them must be set, no exceptions — but here's the slay part: you can change them over time and it won't break any of the passwords you already stored. iconic behaviour tbh.

these parameters are the very first ones you set when eurephia_init runs. and get this — the minimum and maximum hash rounds get benchmarked for you by that tool, so it can find numbers that actually suit the hardware eurephia is gonna be living on. very considerate of it. 🧚

• passwordhash_salt_length — sets how many bytes to use for the password hash salt.
• passwordhash_rounds_min — sets the minimum number of hashing rounds to perform when calculating new password hashes.
• passwordhash_rounds_max — sets the maximum number of hashing rounds to perform when calculating new password hashes.

---

💀 ATTEMPTS SETTINGS 💀

eurephia can blacklist user names, certificates and IP addresses based on how many failed attempts happen. the following parameters define the limits — like, how many tries are you willing to allow before you blacklist someone. it's giving bouncer energy fr fr.

• allow_cert_attempts — defines the number of failed login attempts you allow before you blacklist the OpenVPN client's certificate. this number should normally be higher than allow_username_attempts. default is 5.
• allow_username_attempts — defines the number of failed attempts for a user name that can be tried before you blacklist that user name from further attempts. default is 3.
• allow_ipaddr_attempts — defines the number of failed attempts for an IP address to be used before you blacklist that IP address from further attempts. this one should be the least strictest limit. you also gotta think about whether your clients log in via a proxy or a NATed network, and how many of your clients do that. if you've got lots of users failing to log on and a bunch of them sit behind the same proxy or NAT gateway, this can blacklist that IP address quicker than you intended 😭. but — if a valid authentication happens among all those failing attempts, the attempts counter gets reset again, so this limit doesn't need to be too forgiving. default is 10.

---

🔥 FIREWALL INTEGRATION 🔥

if you're running the OpenVPN server with eurephia on a Linux server, you can let eurephia mess with the firewall too. these settings enable the firewall integration and tell eurephia how to talk to the firewall. fair warning: these parameters are very iptables oriented. the iptables firewall module must be enabled at compile time and be installed for this to work. no cap.

• firewall_interface — this is the variable that enables firewall integration. it must point at the firewall driver, which is a shared object file that eurephia loads dynamically. these drivers are prefixed efw and live in the same lib or lib64 directory as the eurephia-auth and edb-sqlite modules. this variable must contain the full path to the driver module.
• firewall_command — defines the binary the firewall module will execute to help update the firewall. for iptables this defaults to /sbin/iptables.
• firewall_destination — defines which predefined firewall rule to use when updating the firewall. the default value is vpn_users.
• firewall_blacklist_destination — this activates firewall based IP address blacklisting in addition to the internal blacklist in eurephia. this variable defines which firewall rule to use when wanting to blacklist an IP address.
• firewall_blacklist_send_to — this is an optional parameter. normally when eurephia blacklists an IP address it defaults to dropping the network packets from that client. you can use this variable to send it to a different firewall target instead. super useful if you want to, for example, log the incident to the system log before dropping the packets. ✨

---

🛠️ EUREPHIA UTILITIES 🛠️

these settings are used by the eurephia administration utility, eurephiadm.

• eurephiadmin_autologout — defines how long a eurephia administration utility may have an open session before it's considered inactive. when you exceed this limit, the administrator user gets logged out automatically. the unit for this setting is minutes and the default value is 10.
• eurephiadm_xslt_path — the eurephiadm utility uses XSLT templates to generate the output on your screen. this variable gives you the possibility to keep your own set of templates in a different directory instead of using the system wide XSLT templates installed by default. this variable is not set by default.

---

🌈 OPENVPN RELATED VARIABLES 🌈

• openvpn_devtype — the eurephia-auth plug-in will try to auto-detect the device type, which must be either tun or tap. if this auto-detection fails, this configuration variable needs to be set to tun or tap. this value must correspond to the OpenVPN configuration. iykyk 👑

---

👀 SEE ALSO 👀

• eurephiadm-config(7)
• eurephia_init(7)
• Administrators Tutorial and Manual

---

🫶 AUTHOR 🫶

Copyright (C) 2008-2012 David Sommerseth <dazo@users.sourceforge.net>

---

and that's the whole page bestie, we ate and left no crumbs 💖 this little gem is eurephia-variables(7) from David Sommerseth, dated October 2010 — go forth and configure, mwah 🎀