SMS and openvpn challenge/response

zhenb

Hello.
I'm reconfiguring our openvpn server. It uses certificates-based authentification. I'd like to add two-factor authentification based on otp (sms). The problem is I can't configure challenge/response queries between the server and a vpn-client. That is server sends "login", client answers "user", server sends "your otp:", client answers "password".
I've unsuccessfully searched google looking for the solution or documentation. Does anybody know how to do that?

brendan

my distro (fedora) has a package called openvpn-auth-ldap that allows me to require a username / password that is configured in ldap to be entered before the tunnel is allowed to complete. you can also do authorization, requiring that the authenticated ID belong to a specific group in ldap.

while this does not work with One Time Passwords, it might suffice for your needs.

zhenb

I see. What I found out to date is though openvpn seems to work with otp (for example motp) it works only in static mode when the client sends both login and password to the server. When it comes to working with sending sms nothing can be done - server has to get loginname from the client to be able to send sms and then ask for a otp read from that sms. It is a dynamic mode supported by Openvpn Access Server but not by Openvpn yet.
I'm going now to convince my boss of using motp instead of sms because the latter is impossible without a workaround.

alexxtasi

Hello
I am also interested in implementing such a dynamic challenge/response feature using sms.
I searched and although every info I find shows that this feature isn't available on community edition, I haven't found anything explicit.
How are sure for this isn't in community edition?
Can you please make it clear? (anything I searched, confused me...)

thanks

zhenb

Hello.
Finally I found a decision using security token, openvpn, openvpnmanager as a client GUI: http://openvpn.jowisoftware.de/downloads/ This client is able to show a pop-up window where you can enter your pin-code to the token.
It's not what I initially wanted but it is also a kind of two-factor authentification, it really works and my office network is safe now.

alexxtasi

zhenb thank you for the quick reply
some more questions from your experience with this solution...

1- does this mean that you still use openvpn-server community edition, and not openvpn-as ?
2- I suppose that instead of the "official" openvpn client, you use openvpnmanager-gui for this purpose. And you enable the "OpenVPN has a SmartCart support" checkbox ? This mean that no sms challenge-response can be setup, only a hardware token challenge-response... Is this true ? :-(
3- so finally the dynamic challenge-response is an openvpn-as feature only?

thanks again

zhenb

1. yes
I even tried a trial version of openvpn-as but I wanted to prefer a community edition. As I understood openvpn-as uses browser for challenge-response. I don't remember now why I couldn't make it work with sms, I just returned to opevpn + token decision.
2. yes, I use openvpnmanager-gui for this purpose but with "OpenVPN has a SmartCart support" unchecked. And yes, no sms challenge-response here.
3. Actually I'm still not sure 🙂

alexxtasi

thank you very much zhenb for your answers...

as for the 3rd.... I 'll keep asking ;-)

thanks