Using openvpn 2.3.x and 2.4.x. Client is macOS 10.13 (either Tunnelblick or Viscosity). Server is Ubuntu 16.04.
Server config:
plugin /usr/lib/openvpn/plugins/openvpn-plugin-auth-pam.so openvpn
/etc/pam.d/openvpn:
auth required /usr/local/lib/security/pam_google_authenticator.so secret=/etc/openvpn/google-auth-users/${USER} user=nobody echo_verification_code debug forward_pass
auth required pam_radius_auth.so debug use_first_pass
account required pam_permit.so debug
Client:
auth-user-pass
auth-retry interact
pamtester works just fine. I enter the Radius password at first ("1234"), and append to it the 6-digit Google Auth code.
# pamtester openvpn florin authenticate
Password & verification code: 1234017296
pamtester: successfully authenticated
Apr 11 14:52:48 vpn openvpn(pam_google_authenticator)[27348]: debug: start of google_authenticator for "florin"
Apr 11 14:52:48 vpn openvpn(pam_google_authenticator)[27348]: debug: Secret file permissions are 0400. Allowed permissions are 0600
Apr 11 14:52:48 vpn openvpn(pam_google_authenticator)[27348]: debug: "/etc/openvpn/google-auth-users/florin" read
Apr 11 14:52:48 vpn openvpn(pam_google_authenticator)[27348]: debug: shared secret in "/etc/openvpn/google-auth-users/florin" processed
Apr 11 14:53:05 vpn openvpn(pam_google_authenticator)[27348]: debug: no scratch code used from "/etc/openvpn/google-auth-users/florin"
Apr 11 14:53:05 vpn openvpn(pam_google_authenticator)[27348]: Accepted google_authenticator for florin
Apr 11 14:53:05 vpn openvpn(pam_google_authenticator)[27348]: debug: "/etc/openvpn/google-auth-users/florin" written
Apr 11 14:53:05 vpn pamtester[27348]: pam_radius_auth: Got user name florin
Apr 11 14:53:05 vpn pamtester[27348]: pam_radius_auth: Got password 1234
Apr 11 14:53:05 vpn pamtester[27348]: pam_radius_auth: Sending RADIUS request code 1
Apr 11 14:53:05 vpn pamtester[27348]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned -1088232320.
Apr 11 14:53:05 vpn pamtester[27348]: pam_radius_auth: Got RADIUS response code 2
Apr 11 14:53:05 vpn pamtester[27348]: pam_radius_auth: authentication succeeded
But with OpenVPN / Tunnelblick (or Viscosity) it never works. I get the user / pass prompt. I enter the username. For the password I do the same: Radius password appended with the Google Auth code. It fails every time.
I've even tried to launch openvpn in the CLI on the client. I get the same user / pass prompts. It fails the same way. So the problem is not with Tunnelblick or Viscosity.
Apr 11 13:00:41 vpn openvpn(pam_google_authenticator)[22925]: debug: start of google_authenticator for "florin"
Apr 11 13:00:41 vpn openvpn(pam_google_authenticator)[22925]: debug: Secret file permissions are 0400. Allowed permissions are 0600
Apr 11 13:00:41 vpn openvpn(pam_google_authenticator)[22925]: debug: "/etc/openvpn/google-auth-users/florin" read
Apr 11 13:00:41 vpn openvpn(pam_google_authenticator)[22925]: debug: shared secret in "/etc/openvpn/google-auth-users/florin" processed
Apr 11 13:00:41 vpn openvpn(pam_google_authenticator)[22925]: Invalid verification code for florin
Apr 11 13:00:41 vpn openvpn(pam_google_authenticator)[22925]: debug: "/etc/openvpn/google-auth-users/florin" written
Apr 11 13:00:41 vpn openvpn[22925]: pam_radius_auth: Got user name florin
Apr 11 13:00:41 vpn openvpn[22925]: pam_radius_auth: authentication failed
OpenVPN only works if I disable Google Auth and I only leave Radius enabled.
I thought it's a problem with pam_google_authenticator, but OTOH this module works fine with pamtester on the command line.
There's something different with the way passwords are handled in OpenVPN that interacts badly with PAM.
Related discussion:
https://github.com/google/google-authenticator-libpam/issues/95
I'm out of ideas. Any suggestion is greatly appreciated.
