I'm currently trying to get the OpenVPN client to prompt for the google authenticator token via. the static-challenge setting in the client's ovpn config.
It currently works if i type the password and the token in the password field when connecting to my server, but it fails with this message when i enable static-challenge:
Client:
Thu Jan 12 19:50:55 2017 OpenVPN 2.4.0 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Dec 27 2016
Thu Jan 12 19:50:55 2017 Windows version 6.2 (Windows 8 or greater) 64bit
Thu Jan 12 19:50:55 2017 library versions: OpenSSL 1.0.2i 22 Sep 2016, LZO 2.09
Thu Jan 12 19:50:55 2017 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Thu Jan 12 19:50:55 2017 Need hold release from management interface, waiting...
Thu Jan 12 19:50:55 2017 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Thu Jan 12 19:50:55 2017 MANAGEMENT: CMD 'state on'
Thu Jan 12 19:50:55 2017 MANAGEMENT: CMD 'log all on'
Thu Jan 12 19:50:55 2017 MANAGEMENT: CMD 'hold off'
Thu Jan 12 19:50:55 2017 MANAGEMENT: CMD 'hold release'
Thu Jan 12 19:51:14 2017 MANAGEMENT: CMD 'username "Auth" "testuser"'
Thu Jan 12 19:51:14 2017 MANAGEMENT: CMD 'password [...]'
Thu Jan 12 19:51:14 2017 Control Channel MTU parms [ L:1621 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Thu Jan 12 19:51:14 2017 Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
Thu Jan 12 19:51:14 2017 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1557,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Thu Jan 12 19:51:14 2017 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1557,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Thu Jan 12 19:51:14 2017 TCP/UDP: Preserving recently used remote address: [AF_INET]172.16.3.104:1194
Thu Jan 12 19:51:14 2017 Socket Buffers: R=[65536->65536] S=[65536->65536]
Thu Jan 12 19:51:14 2017 UDP link local: (not bound)
Thu Jan 12 19:51:14 2017 UDP link remote: [AF_INET]172.16.3.104:1194
Thu Jan 12 19:51:14 2017 MANAGEMENT: >STATE:1484247074,WAIT,,,,,,
Thu Jan 12 19:51:14 2017 MANAGEMENT: >STATE:1484247074,AUTH,,,,,,
Thu Jan 12 19:51:14 2017 TLS: Initial packet from [AF_INET]172.16.3.104:1194, sid=ab7a9b7a d94488c2
Thu Jan 12 19:51:14 2017 VERIFY OK: depth=1, C=DK, L=Copenhagen, O=Private ltd., OU=IT, CN=Private ltd. CA, name=vpn01, emailAddress=y@x.yy
Thu Jan 12 19:51:14 2017 Validating certificate key usage
Thu Jan 12 19:51:14 2017 ++ Certificate has key usage 00a0, expects 00a0
Thu Jan 12 19:51:14 2017 VERIFY KU OK
Thu Jan 12 19:51:14 2017 Validating certificate extended key usage
Thu Jan 12 19:51:14 2017 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Thu Jan 12 19:51:14 2017 VERIFY EKU OK
Thu Jan 12 19:51:14 2017 VERIFY OK: depth=0, C=DK, L=Copenhagen, O=Private ltd., OU=IT, CN=172.16.3.104, name=vpn01, emailAddress=y@x.yy
Thu Jan 12 19:51:14 2017 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Thu Jan 12 19:51:14 2017 [172.16.3.104] Peer Connection Initiated with [AF_INET]172.16.3.104:1194
Thu Jan 12 19:51:15 2017 MANAGEMENT: >STATE:1484247075,GET_CONFIG,,,,,,
Thu Jan 12 19:51:15 2017 SENT CONTROL [172.16.3.104]: 'PUSH_REQUEST' (status=1)
Thu Jan 12 19:51:15 2017 AUTH: Received control message: AUTH_FAILED
Thu Jan 12 19:51:15 2017 TCP/UDP: Closing socket
Thu Jan 12 19:51:15 2017 SIGUSR1[soft,auth-failure] received, process restarting
Thu Jan 12 19:51:15 2017 MANAGEMENT: >STATE:1484247075,RECONNECTING,auth-failure,,,,,
Thu Jan 12 19:51:15 2017 Restart pause, 5 second(s)
openvpn.log:
Thu Jan 12 19:51:09 2017 OpenVPN 2.4.0 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Dec 27 2016
Thu Jan 12 19:51:09 2017 library versions: OpenSSL 1.0.2g 1 Mar 2016, LZO 2.08
Thu Jan 12 19:51:09 2017 PLUGIN_INIT: POST /usr/lib/openvpn/openvpn-plugin-auth-pam.so '[/usr/lib/openvpn/openvpn-plugin-auth-pam.so] [openvpn]' intercepted=PLUGIN_AUTH_USER_PASS_VERIFY
Thu Jan 12 19:51:09 2017 Diffie-Hellman initialized with 2048 bit key
Thu Jan 12 19:51:09 2017 ROUTE_GATEWAY 172.16.3.254/255.255.255.0 IFACE=ens18 HWADDR=2e:bf:ae:e7:71:31
Thu Jan 12 19:51:09 2017 TUN/TAP device tun0 opened
Thu Jan 12 19:51:09 2017 TUN/TAP TX queue length set to 100
Thu Jan 12 19:51:09 2017 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Thu Jan 12 19:51:09 2017 /sbin/ip link set dev tun0 up mtu 1500
Thu Jan 12 19:51:09 2017 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Thu Jan 12 19:51:09 2017 /sbin/ip route add 10.8.0.0/24 via 10.8.0.2
Thu Jan 12 19:51:09 2017 Could not determine IPv4/IPv6 protocol. Using AF_INET
Thu Jan 12 19:51:09 2017 Socket Buffers: R=[212992->212992] S=[212992->212992]
Thu Jan 12 19:51:09 2017 UDPv4 link local (bound): [AF_INET][undef]:1194
Thu Jan 12 19:51:09 2017 UDPv4 link remote: [AF_UNSPEC]
Thu Jan 12 19:51:09 2017 GID set to root
Thu Jan 12 19:51:09 2017 UID set to root
Thu Jan 12 19:51:09 2017 MULTI: multi_init called, r=256 v=256
Thu Jan 12 19:51:09 2017 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Thu Jan 12 19:51:09 2017 ifconfig_pool_read(), in='x,10.8.0.4', TODO: IPv6
Thu Jan 12 19:51:09 2017 succeeded -> ifconfig_pool_set()
Thu Jan 12 19:51:09 2017 ifconfig_pool_read(), in='testuser,10.8.0.8', TODO: IPv6
Thu Jan 12 19:51:09 2017 succeeded -> ifconfig_pool_set()
Thu Jan 12 19:51:09 2017 IFCONFIG POOL LIST
Thu Jan 12 19:51:09 2017 x,10.8.0.4
Thu Jan 12 19:51:09 2017 testuser,10.8.0.8
Thu Jan 12 19:51:09 2017 Initialization Sequence Completed
Thu Jan 12 19:51:15 2017 172.16.2.4:59300 TLS: Initial packet from [AF_INET]172.16.2.4:59300, sid=941ab363 af051a6a
Thu Jan 12 19:51:15 2017 172.16.2.4:59300 VERIFY OK: depth=1, C=DK, L=Copenhagen, O=Private ltd., OU=IT, CN=Private ltd. CA, name=vpn01, emailAddress=y@x.dk
Thu Jan 12 19:51:15 2017 172.16.2.4:59300 VERIFY OK: depth=0, C=DK, L=Copenhagen, O=Private ltd., OU=IT, CN=testuser, name=vpn01, emailAddress=y@x.dk
Thu Jan 12 19:51:15 2017 172.16.2.4:59300 peer info: IV_VER=2.4.0
Thu Jan 12 19:51:15 2017 172.16.2.4:59300 peer info: IV_PLAT=win
Thu Jan 12 19:51:15 2017 172.16.2.4:59300 peer info: IV_PROTO=2
Thu Jan 12 19:51:15 2017 172.16.2.4:59300 peer info: IV_NCP=2
Thu Jan 12 19:51:15 2017 172.16.2.4:59300 peer info: IV_LZ4=1
Thu Jan 12 19:51:15 2017 172.16.2.4:59300 peer info: IV_LZ4v2=1
Thu Jan 12 19:51:15 2017 172.16.2.4:59300 peer info: IV_LZO=1
Thu Jan 12 19:51:15 2017 172.16.2.4:59300 peer info: IV_COMP_STUB=1
Thu Jan 12 19:51:15 2017 172.16.2.4:59300 peer info: IV_COMP_STUBv2=1
Thu Jan 12 19:51:15 2017 172.16.2.4:59300 peer info: IV_TCPNL=1
Thu Jan 12 19:51:15 2017 172.16.2.4:59300 peer info: IV_GUI_VER=OpenVPN_GUI_11
AUTH-PAM: BACKGROUND: user 'testuser' failed to authenticate: Cannot make/remove an entry for the specified session
Thu Jan 12 19:51:15 2017 172.16.2.4:59300 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-plugin-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
Thu Jan 12 19:51:15 2017 172.16.2.4:59300 PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/lib/openvpn/openvpn-plugin-auth-pam.so
Thu Jan 12 19:51:15 2017 172.16.2.4:59300 TLS Auth Error: Auth Username/Password verification failed for peer
Thu Jan 12 19:51:15 2017 172.16.2.4:59300 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Thu Jan 12 19:51:15 2017 172.16.2.4:59300 [testuser] Peer Connection Initiated with [AF_INET]172.16.2.4:59300
Thu Jan 12 19:51:16 2017 172.16.2.4:59300 PUSH: Received control message: 'PUSH_REQUEST'
Thu Jan 12 19:51:16 2017 172.16.2.4:59300 Delayed exit in 5 seconds
Thu Jan 12 19:51:16 2017 172.16.2.4:59300 SENT CONTROL [testuser]: 'AUTH_FAILED' (status=1)
Thu Jan 12 19:51:21 2017 172.16.2.4:59300 SIGTERM[soft,delayed-exit] received, client-instance exiting
My /etc/pam.d/openvpn config:
auth requisite pam_google_authenticator.so forward_pass
auth required pam_unix.so use_first_pass
This is on Ubuntu 16.04 with openvpn 2.4
