I'm out of my depth and not zeroing in on what I should be Googling. Has anyone encountered similar design/function or could provide input? I'd welcome someone knowledgeable about Python as well. I have an OpenVPN server using Radius to authenticate and utilize Server Group Mappings via (Windows) Network Policy Server. This is currently working. There is a specific python script that makes it function. I used this guide: [url=https://docs.openvpn.net/how-to-tutorialsguides/administration/integrating-active-directory-with-access-server-using-radius-and-post_auth/]https://docs.openvpn.net/how-to-tutorialsguides/administration/integrating-active-directory-with-access-server-using-radius-and-post_auth/[/url] However, our organization also has Duo Security and wants to use the MFA to add extra security to OpenVPN. The guide for this configuration is located on Duo's website. It also relies on a python script. I'm unsure how to (assuming it's possible) to create a hybrid script that will allow Duo MFA but still use Radius for NPS. The NPS allows users to be controlled by their groups and in turn enforce network access (on OpenVPN) and also control source IP ranges (vai firewall ACLs). If I use the python script for Duo, I lose the ability for NPS to set the group and in turn use the local groups for IP assignments. If I use the OpenVPN script, I lose Duo MFA. I have tried to parse the script and apply logic to the syntax/arrays and tinker to no avail. Thoughts?

Please see [url=https://forums.openvpn.net/viewtopic.php?f=30&t=22603]HOWTO: Request Help ![/url]

OpenVPN with RADIUS/NPS + Duo Security?

stjaru

I'm out of my depth and not zeroing in on what I should be Googling. Has anyone encountered similar design/function or could provide input? I'd welcome someone knowledgeable about Python as well.

I have an OpenVPN server using Radius to authenticate and utilize Server Group Mappings via (Windows) Network Policy Server. This is currently working. There is a specific python script that makes it function. I used this guide: https://docs.openvpn.net/how-to-tutorialsguides/administration/integrating-active-directory-with-access-server-using-radius-and-post_auth/

However, our organization also has Duo Security and wants to use the MFA to add extra security to OpenVPN.

The guide for this configuration is located on Duo's website. It also relies on a python script.

I'm unsure how to (assuming it's possible) to create a hybrid script that will allow Duo MFA but still use Radius for NPS. The NPS allows users to be controlled by their groups and in turn enforce network access (on OpenVPN) and also control source IP ranges (vai firewall ACLs).

If I use the python script for Duo, I lose the ability for NPS to set the group and in turn use the local groups for IP assignments. If I use the OpenVPN script, I lose Duo MFA. I have tried to parse the script and apply logic to the syntax/arrays and tinker to no avail.

Thoughts?

TinCanTech

Please see HOWTO: Request Help !

J00MZ

Hey,

I configured OpenVPN to connect via RADIUS to AD using this:https://docs.openvpn.net/how-to-tutorialsguides/administration/configuring-active-directory-windows-2008-server-r2-radius-server-for-openvpn-access-server/ tutorial.

For MFA configured Duo using their tutorial on the website. so the only Python script is the Duo script. works like a charm for me.

Cheers,
Joe

[deleted]

Unfortunately this doesn't cover one of his (and my) two requirements, that is to differentiate users by group and assign them different IPs. I have exactly this same problem 3 years later, and would love to know if anyone has come upon any way to make this work.