Improve security

xorinzor

Hi,

I installed a OpenVPN Access Server today and am absolutely thrilled that it supports Two-Factor authentication.
The only thing I found during testing is that it will, while connecting to the VPN, check the password first, and the authenticator code second.

It'd be much more secure if it would check the code first, and the password second. This way, people (crooks) who will try to guess your password, will need to get the correct code first. Which, because it continually changes, is much harder, and thus way more secure.

Is this something I can configure myself? Or is this something that the OpenVPN team has to hard-code into the server?

EDIT: It would be great if the same concept could be applied to the Client Web-UI login page.

Regards,
Jorin

xorinzor

Anyone? Does the OpenVPN team not monitor these forums?
I sent an email about it too, but didn't get a reply on that either.

TinCanTech

https://forums.openvpn.net/viewtopic.php?f=30&t=22603

xorinzor

TinCanTech wrote https://forums.openvpn.net/viewtopic.php?f=30&t=22603

I kind of fail to see the point to include a server version, server config, etc. When this is a feature that is non-existent / non-configurable (in the most recent version).

Perhaps instead of just linking to a post you should make your intention a little bit more clear.

TinCanTech

You are making a request about Access Server in the Community edition forum .....