Two-factor authentication with email (or sms)

alex030

Hi,

I spent all of last night reading about this and I kinda understand that Google Authenticator is really a fob that generates random numbers in sync with their authentication server and determined that this is not really what I have in mind. Mainly because it requires my users to install an app in their phones and take a picture of a QR code somewhere or enter a one-time key.

I understand that sending the OTP (one thing you get about a whole night spent reading is the jargon, at least) via email really defeats TPA by definition (anyone who's able to "guess" the vpn password + the email password can compromise things), and in reality it becomes two 1-factor authentications in succession.

However, since all cellular carriers in the US have email-to-sms gateways, emailing the OTP can still, at least from a functional perspective, be considered a TPA approach, and this is the one I'm interesting in taking, as authenticating involves nothing more than receiving an sms message, which is someone ALL my users should be able to do without having to spend 10 minutes on the phone with me and be even more confused by the new protocol.

Can anyone give me a clue on how to implement such a solution as natively as possible with OpenVPN?

Thanks!

Alex

alex030

### Last night I posted this query in the wrong forum (off-topic). I apologize for re-posting, but it really belongs here.

### Moderators, if you could please delete the message in the off-topic forum, I would be much obliged. Also, if you feel this post belongs elsewhere, feel free to put it in the right place. Thank you!

Hi,

I spent all of last night reading about this and I kinda understand that Google Authenticator is really a fob that generates random numbers in sync with their authentication server and determined that this is not really what I have in mind. Mainly because it requires my users to install an app in their phones and take a picture of a QR code somewhere or enter a one-time key.

I understand that sending the OTP (one thing you get about a whole night spent reading is the jargon, at least) via email really defeats Two-Factor Authentication by definition (anyone who's able to "guess" the vpn password + the email password can compromise things), and in reality it becomes two 1-factor authentications in succession.

However, since all cellular carriers in the US have email-to-sms gateways, emailing the OTP can still, at least from a functional perspective, be considered a Two-Factor Authentication approach, and this is the one I'm interesting in taking, as authenticating involves nothing more than receiving an sms message, which is something ALL my users should be able to do without having to spend 10 minutes on the phone with me and be even more confused by the new protocol.

Can anyone give me a clue on how to implement such a solution as natively as possible with OpenVPN?

Thanks!

Alex

debbie10t

The reason this post is here:

google authenticator - Has nothing to do with OpenVPN
Email/SMS OTP - Has nothing to do with OpenVPN

I have been moderating this forum for over a year and have not seen any similar posts.

alex030

Hi,

You are right. There aren't posts similar to mine here, but I figured that since this is THE openvpn forum, the chances of finding help with this would be greater here than anywhere else.

Interestingly, there's very little on this elsewhere. Authy does tfa via sms and I *think* DUO does this too.

Do you have any suggestions or ideas on where to post my question since this formum doesn't seem to be the right place?

Thanks!

Alex

Traffic

alex030 wroteI figured that since this is THE openvpn forum, the chances of finding help with this would be greater here than anywhere else.

debbie10t wroteThe reason this post is here:

google authenticator - Has nothing to do with OpenVPN
Email/SMS OTP - Has nothing to do with OpenVPN
I have been moderating this forum for over a year and have not seen any similar posts

alex030 wroteYou are right. There aren't posts similar to mine here

Perhaps you are trying to use OpenVPN Access Server ?