PAM 2nd Auth Setup

MisterSurface

Hello,

There are a lot of awesome tutorials, FAQs, wikis, etc. on how to harden openvpn but I can't find anything on how to properly setup PAM as a second method of authentication in addition to certificate for openvpn. My server is debian, my clients will be android based phones, android tablets, windows laptops, mac os, iphones, etc.

Any help would be greatly appreciated - want this to be as secure as possible. Meaning the proper configuration of pam for users only made for openvpn on the server, how to set it up properly on the client like auth-nocache, and setting up the users so they cant login to the server via SSH etc.

thanks!

TinCanTech

MisterSurface wrote I can't find anything on how to properly setup PAM as a second method of authentication

You mean you did not read the Howto ?

https://openvpn.net/index.php/open-source/documentation/howto.html#auth

MisterSurface wrote how to set it up properly on the client like auth-nocache

Varies from client to client ..and your security policy ..

MisterSurface wrote and setting up the users so they cant login to the server via SSH etc

Firewall or other means .. not openvpn.

MisterSurface

That doesn't say how to configure the /etc/pam.d/config file - which I don't even know if it needs to be configured (just saw some other references to it in Googling). I did read that how-to.

I'm looking for something step-by-step if it exists as I am trying to learn as I go.

For example - this is confusing http://www.rjsystems.nl/en/2100-pam-debian.php and I would like to see if there is any direction specifically w/r/t openvpn and ensuring we have least privileges applied. I've followed all of the other hardening advice in the FAQ on this site.