Hi, I'm trying to get google authenticator to work with my centos 6.x openvpn server. I can connect without a problem when I don't use google authenticator, but when I use it I can't connect.
Any help appreciated. Thanks!
#client error
Mon Mar 23 15:40:01 2015 AUTH: Received control message: AUTH_FAILED
Mon Mar 23 15:40:01 2015 SIGTERM[soft,auth-failure] received, process exiting
#server openvpn log
Mon Mar 23 15:39:58 2015 us=617629 66.171.xxx.xxx.xxx:59153 VERIFY OK: depth=1, C=US, ST=WA, L=Seattle, O=Example.com, OU=MyOu, CN=OpenVPN Root CA, name=OpenVPN Root CA, emailAddress=
example@home.com
Mon Mar 23 15:39:58 2015 us=617899 66.171.xxx.xxx:59153 VERIFY OK: depth=0, C=US, ST=WA, L=Seattle, O=Example.com, OU=MyOu, CN=employee.example.com, name=employee.example.com, emailAddress=
employee@example.com
AUTH-PAM: BACKGROUND: received command code: 0
AUTH-PAM: BACKGROUND: USER: employee
AUTH-PAM: BACKGROUND: user 'employee' failed to authenticate: Module is unknown
Mon Mar 23 15:39:58 2015 us=690206 66.171.xxx.xxx:59153 PLUGIN_CALL: POST /usr/lib64/openvpn/plugin/lib/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
Mon Mar 23 15:39:58 2015 us=690221 66.171.xxx.xxx:59153 PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/lib64/openvpn/plugin/lib/openvpn-auth-pam.so
Mon Mar 23 15:39:58 2015 us=690241 66.171.xxx.xxx:59153 TLS Auth Error: Auth Username/Password verification failed for peer
Mon Mar 23 15:39:58 2015 us=700684 66.171.xxx.xxx:59153 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA
Mon Mar 23 15:39:58 2015 us=700708 66.171.xxx.xxx:59153 [employee.example.com] Peer Connection Initiated with [AF_INET]66.171.xxx.xxx:59153
Mon Mar 23 15:40:01 2015 us=83442 66.171.xxx.xxx:59153 PUSH: Received control message: 'PUSH_REQUEST'
Mon Mar 23 15:40:01 2015 us=83494 66.171.xxx.xxx:59153 Delayed exit in 5 seconds
Mon Mar 23 15:40:01 2015 us=83509 66.171.xxx.xxx:59153 SENT CONTROL [aaron.dixon.employee.flowplay.com]: 'AUTH_FAILED' (status=1)
Mon Mar 23 15:40:06 2015 us=315239 66.171.xxx.xxx:59153 SIGTERM[soft,delayed-exit] received, client-instance exiting
I've configured it to basically the specifications here.
https://vorkbaard.nl/setup-openvpn-with-google-authenticator-on-ubuntu-12-04-lts-server/
###server.conf file###
reneg-sec 0
#google authenticator pam module
plugin /usr/lib64/openvpn/plugin/lib/openvpn-auth-pam.so openvpn
port 1194
proto udp
dev tun
ca /etc/openvpn/tools/keys/ca.crt
cert /etc/openvpn/tools/keys/ovpn_server.crt
key /etc/openvpn/tools/keys/ovpn_server.key
dh /etc/openvpn/tools/keys/ovpn_server_dh4096.pem
server 10.101.65.0 255.255.255.0
ifconfig-pool-persist ipp_ovpn01_1194.txt
push "route 10.100.0.0 255.255.0.0"
push "dhcp-option DNS 8.8.8.8"
keepalive 10 30
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status ovpn01_1194_status.log
log-append ovpn01_1194.log
verb 4
duplicate-cn
daemon
###client.conf###
client
pull
dev tun
proto udp
remote server1.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo adaptive
verb 3
auth-user-pass
auth-nocache
ca ca.crt
cert my.crt
key my.key
###pam openvpn file###
#%PAM-1.0M-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth requisite pam_google_authenticator.so forward_pass
auth required pam_unix.so use_first_pass
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth required pam_deny.so
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account required pam_permit.so
password requisite pam_cracklib.so try_first_pass retry=3 type=
password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
