Hi guys,
I'm having an issue with my Openvpn Access Server with Google Authenticator. I've followed the proper instructions for the installation of OpenvpnAS, and google authenticator. I can login from my Macbook with the OpenVPN Connect app. I enter in my username and password, then my google authenticator code in a separate box when prompted.
My issue is that I am unable to connect from a Linux client via NetworkManager with the same configuration. NetworkManager only gives you a single password prompt, which means I would need to stack the PAM entering in the password+code.
According to the official docs, here:
http://google-authenticator.googlecode.com/git/libpam/README
"Some PAM clients cannot prompt the user for more than just the password. To
work around this problem, this PAM module supports stacking. If you pass the
"forward_pass" option, the "pam_google_authenticator" module queries the user
for both the system password and the verification code in a single prompt.
It then forwards the system password to the next PAM module, which will have
to be configured with the
"use_first_pass" option."
When I enable this in the /etc/pam.d/openvpnas file, this breaks the ability for my Macbook user to login with the app. Even entering the password+code in the same prompt. And the linux user is unable to login as well.
Here is my /etc/pam.d/openvpnas, it is the default I copied over when setting up per documentation (I removed the comments to make this shorter):
auth optional pam_faildelay.so delay=3000000
auth requisite pam_nologin.so
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
session required pam_env.so readenv=1
session required pam_env.so readenv=1 envfile=/etc/default/locale
@include common-auth
auth optional pam_group.so
session required pam_limits.so
session optional pam_lastlog.so
session optional pam_motd.so
session optional pam_mail.so standard
@include common-account
@include common-session
@include common-password
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
Any time I try to make a change to this file, as suggested in other threads to comment out lines with @ and/or to add lines nothing works and it breaks the client that does work:
https://forums.openvpn.net/topic11522.html
https://forums.openvpn.net/topic13701.html
"auth requisite pam_google_authenticator.so forward_pass
account required pam_permit.so"
My question is, does anyone have an idea how I can configure this so this will work from clients that have both a single prompt (NetworkManager Linux KDE) and OpenVPN Connect clients, where it prompts for password, then authenticator.
I would even be fine with just the stacked single password+authcode on all clients if I could get this to work.
System:
Ubuntu Server 12.04
OpenVPN Access Server 2.0.2
Here is what the failed log looks like when trying to login from Linux guest in NetworkManager:
2014-02-27 00:25:02-0500 [OMIClientAuth,0,] Server Agent started
2014-02-27 00:25:07-0500 [-] License Info {'concurrent_connections': 2}
2014-02-27 00:25:49-0500 [-] OVPN 2 OUT: 'Thu Feb 27 05:25:49 2014 *IP_EDITED*:39721 TLS: Initial packet from [AF_INET]*IP_EDITED*:39721, sid=abc123SidEdit'
2014-02-27 00:25:49-0500 [-] OVPN 2 OUT: 'Thu Feb 27 05:25:49 2014 *IP_EDITED*:39721 VERIFY OK: depth=1, /CN=OpenVPN CA'
2014-02-27 00:25:49-0500 [-] OVPN 2 OUT: 'Thu Feb 27 05:25:49 2014 *IP_EDITED*:39721 VERIFY OK: nsCertType=CLIENT'
2014-02-27 00:25:49-0500 [-] OVPN 2 OUT: 'Thu Feb 27 05:25:49 2014 *IP_EDITED*:39721 VERIFY OK: depth=0, /CN=user'
2014-02-27 00:25:49-0500 [-] OVPN 2 OUT: 'Thu Feb 27 05:25:49 2014 *IP_EDITED*:39721 peer info: IV_VER=2.3.2'
2014-02-27 00:25:49-0500 [-] OVPN 2 OUT: 'Thu Feb 27 05:25:49 2014 *IP_EDITED*:39721 peer info: IV_PLAT=linux'
2014-02-27 00:25:49-0500 [-]
VPN Auth Failed: 'PAM auth failed: Cannot make/remove an entry for the specified session' [None]
2014-02-27 00:25:49-0500 [-] OVPN 2 OUT: 'Thu Feb 27 05:25:49 2014
MANAGEMENT: CMD \'client-deny 0 0 "AS auth failed"\''
2014-02-27 00:25:49-0500 [-] OVPN 2 OUT: 'Thu Feb 27 05:25:49 2014
MULTI: connection rejected: AS auth failed, CLI:[NULL]'
2014-02-27 00:25:49-0500 [-] OVPN 2 OUT: 'Thu Feb 27 05:25:49 2014 *IP_EDITED*:39721 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA'
2014-02-27 00:25:49-0500 [-] OVPN 2 OUT: 'Thu Feb 27 05:25:49 2014 *IP_EDITED*:39721 [user] Peer Connection Initiated with [AF_INET]*IP_EDITED*:39721'
2014-02-27 00:25:51-0500 [-] OVPN 2 OUT: 'Thu Feb 27 05:25:51 2014 *IP_EDITED*:39721 Delayed exit in 5 seconds'
2014-02-27 00:25:51-0500 [-] OVPN 2 OUT: "Thu Feb 27 05:25:51 2014 *IP_EDITED*:39721 SENT CONTROL [user]: 'AUTH_FAILED' (status=1)"
2014-02-27 00:25:57-0500 [-] OVPN 2 OUT: 'Thu Feb 27 05:25:57 2014 *IP_EDITED*:39721 SIGTERM[soft,delayed-exit] received, client-instance exiting'
Please let me know if I can provide any further information on this that will lead to a resolution. Appreciate any help at all I can get on this.
