Client isn't stopping to prompt for a username password pair

jeffsilverman

I want to require users to give a username password pair before connecting to the VPN server. That is two factor authentication: the user must have a certificate and must know the password.

I am following the instructions in https://openvpn.net/index.php/open-source/documentation/howto.html#auth and also a response in one of the forums to try
plugin /usr/lib/openvpn/openvpn-auth-pam.so "login login USERNAME password PASSWORD"
However, when I start the client, it doesn't prompt for a username or a password. I think the server is working because it stops the connection. I can see that in the routing table on the client.

What am I doing wrong, please?

Jeff Silverman

jeffsilverman

Debbie10t,

I assume that I have not configured my client correctly, however, I am not sure what I have done wrong.

The client connects properly if I do not require a username/password pair on the server, so I assume that the only thing I need is a parameter that tells the client that it has to stop and query for a username password. What would that be?

Thank you

Jeff Silverman

jeffsilverman

Server.conf:

local 67.105.198.191
port 1194
proto udp
dev tap0
ca /etc/openvpn/ca.crt
cert /etc/openvpn/kirovpn001.widevine.net.crt
key /etc/openvpn/kirovpn001.widevine.net.key	
dh /etc/openvpn/dh1024.pem
server-bridge 10.50.255.254 255.255.0.0 10.50.6.50 10.50.6.100
ifconfig-pool-persist /var/lib/ipp.txt
push "route 10.0.0.0  255.0.0.0"
push "route-gateway 10.50.255.254"
push "dhcp-option DNS 10.50.100.1"
push "dhcp-option DNS 10.21.100.1"
client-to-client
keepalive 10 120
plugin /usr/lib/openvpn/openvpn-auth-pam.so "login login USERNAME password PASSWORD"
cipher BF-CBC        # Blowfish (default)
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log
log-append  /var/log/openvpn.log
verb 6
mute 20

Client.conf

client
dev tap
proto udp
remote 67.105.198.191 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
mute-replay-warnings
ca openvpn/ca.crt
cert openvpn/jeffs-laptop.crt
key  openvpn/jeffs-laptop.key
ns-cert-type server
cipher BF-CBC
comp-lzo
verb 6
mute 20