Open VPN multiple authentication method

salman.isha

Hello,

I need a help very urgently.

I use google authenticator along with user password to login in my vpn connection. Now i have thing in my mind is it possible to change the authentication method for a specific user ? Like rest of the user will authenticate in open vpn through mfa but one user can access open vpn only with user password ? And both authentication method should run simultaneously .

Please help !!!!

Traffic

Please post your current configs as per the Forum rules (top of page)

salman.isha

Hello,

Sorry for not posting my config file. So here is it. the thing is this config using pam.so for google authenticator. But i want to use another pam config for a specific user who can login only with username and password. but should be run simultaneously.

port 1194
proto udp
dev tun
ca /etc/openvpn/easy-rsa/2.0/keys/xxxx.crt
cert /etc/openvpn/easy-rsa/2.0/keys/xxxx.crt
key /etc/openvpn/easy-rsa/2.0/keys/xxxx.key  # This file should be kept secret
dh /etc/openvpn/easy-rsa/2.0/keys/xxxx.pem
server xx.xx.xx.xx 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.16.5.0 255.255.255.0"
push "route 192.16.6.0 255.255.255.0"
push "route 192.16.7.0 255.255.255.0"
push "route 192.16.8.0 255.255.255.0"
push "dhcp-option DNS 132.196.243.9"
push "dhcp-option DNS 8.8.8.8"
keepalive 5 300
reneg-sec 36000
tls-auth /etc/openvpn/easy-rsa/2.0/keys/xxxx.key 0 # This file is secret
cipher AES-256-CBC   # AES
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log-append  /var/log/openvpn.log
verb 5
plugin /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so openvpn #this is my authentication plugin. but i want to use another one along with it.

Traffic

salman.isha wrotebut should be run simultaneously.

I presume you mean under the same server instance ?

I am not 100% sure but I expect you can run multiple plugins for auth ..
Perhaps somebody else could offer some help here ?

But I think it will become very complicated for the server admin to ensure all users can login via different methods.

My suggestion would be to run more than one openvpn server .. it is probably the easiest solution.

salman.isha

Hello,

Thanks for your reply. I hope someone will help me out.

However, can you tell me how to stop the connection timeout ? I want to say that, I will connect to my openvpn connection and it won't disconnected atleast for 2/3 days it will remain connected. Any solution for this ?

Traffic

This is a different problem .. please post full details as per the Forum rules.