GUIDE: OpenVPN ACCESS SERVER with LDAP and Google Auth

[deleted]

Take Note:

novaflash wrote I am going to lock this topic. It is terribly outdated and pointless.

Because every single tutorial in the universe is based off the Community Edition I decided I would post a guide on how to setup your OpenVPN ACCESS SERVER securely to your LDAP server, and as an extra bit of security, also hook it up to Google Authenticator and login with a one time password.

Just a note, the docs for Access Server are terribly scarce..Like they do not even exist. You cannot even find documentation on the "plugin" line that is below..I had to find all this stuff through other people who were also banging their heads.

I am going to assume that most of you already know how G.Authenticator works, and I won't overexplain the little details.

Requirements:
This is for CentOS, and Ubuntu. Did not test on other distros.
The system itself must be connected to and using an LDAP. (You must be able to SSH and login as an LDAP user who does not exist locally)..That part you must figure out on your own. Hint: SSSD
Note: If you don't want to go with LDAP and you wish to simply have local passwords, just continue anyway, everything should be the same, minus the LDAP.

- Your date/time must be correct (If not, your codes will be invalid, and logins will fail)

ntpdate <server>

- Install OpenVPN Access Server:

rpm -Uvh http://swupdate.openvpn.org/as/openvpn-as-1.8.5-CentOS6.x86_64.rpm

Install some compiling tools to compile google authenticator:

Centos:

yum -y install pam-devel

Ubuntu:

apt-get install libpam0g-dev

wget https://google-authenticator.googlecode.com/files/libpam-google-authenticator-1.0-source.tar.bz2
bunzip2 libpam-google-authenticator-1.0-source.tar.bz2
tar xvf libpam-google-authenticator-1.0-source.tar
cd libpam-google-authenticator-1.0/
make && make install

google-authenticator

Press yes for all the prompts. You will be given some scratch codes and a link to scan with your phone.
Note: The scratch codes will work ONE TIME. So if you lose your phone or something, you will be able to login with the scratch codes once and they are no longer valid. So don't make the mistake of assuming they aren't working if you've already used it.

Now GoogleAuthenticator is working, and OpenVPN is running..Let's make OpenVPN use google auth now..

- Download the missing openvpn pam file:

wget http://safesrv.net/public/openvpn-auth-pam.zip

- Unzip the file to

/usr/lib/openvpn/

- you should have a file in there called openvpn-auth-pam.so

- Add the plugin to the AS.CONF file:

vi /usr/local/openvpn_as/etc/as.conf

Add this to the very bottom:

plugin /usr/lib/openvpn/openvpn-auth-pam.so /etc/pam.d/openvpnas

# Where is the documentation for this for Access Server edition? Your documentation has no trace of the word plugin with access server. You really need to document this in the access server docs, not only community edition.

Tell OpenVPN's PAM file to use Google Authenticator:

vi /etc/pam.d/openvpnas

Find & comment out these lines:

#auth       include      system-auth
#account    include      system-auth
#password   include      system-auth
#session    include      system-auth

FOR UBUNTU:

It's very similar, comment all the lines starting with an '@' (They should all have a similar last field, such as common-auth, if I remember correctly)

Then add these lines:

auth    requisite        pam_google_authenticator.so forward_pass
account required         pam_permit.so

Restart OpenVPN to reload configs:

service openvpnas restart

Test by logging into the VPN through the Admin console or as you would normally with the client:

Example:
LDAP username: joebob55
LDAP password: pazzwurdlol
Google Authenticator code: 444999

You would login with these credentials:
Username: joebob55
Password: pazzwurdlol444999

Every 30 seconds the google code changes, giving you a one time password.

hope it helps, enjoy your secure access servers

alexxtasi

hi there
nice guide!
I would like to have the same functionality but using the openvpn community server.
I suppose that the steps should be the same, except from the installation and the .conf file paths (no openvpn_as path).

my questions :

1- has anyone such a setup ? (openvpn asks ldap for authentication and on success, tells google authenticator to ask for a code - second step of authentication)
2- can it work for many users (ldap) ?
3- does each user need to run google-authenticator to create the scratch codes at first ?
4- there is no openvpn file in /etc/pam.d/ directory . Am I missing something or it's not provided with the openvpn (no -as) version and I should create it myself ?

forgive my newbie..ness ;-) and please advice me...
thank you

Forkbeard

Nice job! I have a similar setup, without LDAP but with Google Authenticator and I'm running into a problem.

SSL/TLS handshake renegotiation takes place hourly for each user session. That's no problem if the user's credentials are cached but with this random number added to the user's password the cached credentials are automatically out of date after a couple of minutes so every hour the connection stops passing data. It isn't dropped but no data gets transported anymore. It's effectively the same as using auth-nocache.

Have you managed to work around this problem and if so: how?

invertigo

THIS GUIDE PROVIDES DANGEROUSLY BAD ADVICE!

Specifically this part:

#auth       include      system-auth
#account    include      system-auth
#password   include      system-auth
#session    include      system-auth

And this part:

auth    requisite        pam_google_authenticator.so forward_pass
account required         pam_permit.so

What this does is turn off ALL checking by PAM of the password portion of the authentication string. I was able to log in with my password and Google Auth code, but I was also able to log in with "Happypuppies123" + my Google Auth code. From the manual:

DESCRIPTION
pam_permit is a PAM module that always permit access. It does nothing
else.

In the case of authentication, the user´s name will be set to nobody if
the application didn´t set one. Many applications and PAM modules become
confused if this name is unknown.

This module is very dangerous. It should be used with extreme caution.

Here is a good configuration:

# OpenVPN AS PAM config
#%PAM-1.0
#auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so
auth       required     pam_google_authenticator.so forward_pass
auth       include      system-auth
account    required     pam_nologin.so
account    include      system-auth
password   include      system-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
session    optional     pam_console.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open
session    required     pam_namespace.so
session    optional     pam_keyinit.so force revoke
session    include      system-auth
-session   optional     pam_ck_connector.so

This config does google authenticator as the first step, then properly passes the password portion of the auth string on to the rest of the system.

abcd

invertigo,

Would you be able to post your entire /etc/pam.d/openvpnas file? I couldnt get my openvpn AS to work with Google Authenticator. Having said that it works fine against LDAP without the Google Authenticator. Thanks in advance.

Must be something I did...If I included all these as you mentioned in my openvpnas file, I cant login to the admin page after restarted the openvpn service, but cant login with ldap account without Google Authenticator.

#auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so
auth required pam_google_authenticator.so forward_pass
auth include system-auth
account required pam_nologin.so
account include system-auth
password include system-auth
# pam_selinux.so close should be the first session rule
session required pam_selinux.so close
session required pam_loginuid.so
session optional pam_console.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session required pam_selinux.so open
session required pam_namespace.so
session optional pam_keyinit.so force revoke
session include system-auth
-session optional pam_ck_connector.so

vishnuom

Was anyone able to setup openvpn + openldap + google authenticator.

Can someone please post a working pam.d configuration files???

The Johan

I am going to lock this topic. It is terribly outdated and pointless.

OpenVPN Access Server has LDAP authentication and Google Authenticator built-in! You can just enable it from the Admin UI and set things up from there! If anyone has trouble setting this up then kindly just look at https://docs.openvpn.net/ for all the documentation on the OpenVPN Access Server. Please do not follow the guide posted in this topic as it is terribly outdated and goes outside of the built-in functionality of the Access Server. Basically, it's reinventing the wheel.