OpenVPN Client-Side Scripting of mapped drives

openvpnvpn-client

I've done quite a bit of searching but need help running scripts on clients when they connect. The end goal is for windows clients to map some drives when they connect, and disconnect the drives when disconnecting. The OpenVPN server is an Amazon Marketplace instance, and I do have access to the console via putty/sftp. Clients are able to connect using 2 Factor Auth successfully and get their correct IP's/Routing.

I've tried to place some scripts into the Group Permissions > Client Scripting as follows:

OpenVPN Windows User Connect Script

And the script up.sh is simply the following.

net use Z: "\\server.domain.com\Share" /user:domain\username P@ssw0rd

The file up.sh has:

 -rwxrwxrwx  1 root root    70 Jan 23 15:45 up.sh

The directory permissions on /etc/openvpn are:

 drwxr-xr-x  2 root root    4096 Jan 23 15:45 openvpn

So as a test I am expecting to see something in the client logs found here on the client:

c:\program files (x86)\OpenVPN Technologies\OpenVPN Client\etc\log\capi.log

When the client connects the following pop up message occurs:

OpenVPN Warning

After clicking Yes, nothing happens and the client log has the following:

    2018-01-23 15:58:14-0800 [-] user_connect-PP ERR: "'--script-security' is not recognized as an internal or external command,\r"
2018-01-23 15:58:14-0800 [-] user_connect-PP ERR: 'operable program or batch file.\r'
2018-01-23 15:58:14-0800 [-] user_connect-PP ERR: "'--client-connect' is not recognized as an internal or external command,\r"
2018-01-23 15:58:14-0800 [-] user_connect-PP ERR: 'operable program or batch file.\r'

If I remove the two dashes (–) in front of each script line there is no difference in the client errors in the log.

Thanks for any and all input!

Best Answer

The default script interpreter for OpenVPN on Windows is cmd.exe. Modify your client-side script to only include net use Z: "\\server.domain.com\Share" /user:domain\username "P@ssw0rd" or other cmd appropriate commands and you should be good to go.

@JasonC also found that the password needed to be quoted.

Edit: If you want the end user to type in a password, use something like this instead:
powershell New-PSDrive -Name "Z" -PSProvider "FileSystem" -Root "\\Server\Share" -Persist -Credential (Get-Credential)