Hello All! I am running Centos 7 with Openvpn: OpenVPN 2.4.6 x86_64-redhat-linux-gnu [Fedora EPEL patched] [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 26 2018 I have configured /etc/pam.d/openvpn: auth [success=1 default=ignore] pam_unix.so nullok_secure auth required /lib64/security/pam_google_authenticator.so authtok_prompt=pin Also server.conf: plugin /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so "openvpn login: USERNAME Password: PASSWORD pin OTP" I curious if this version of openvpn community supports google authenticator or do I need to compile it from source. Does anybody know or have better insight?

These are the errors I get in /var/log/secure: Dec 2 21:09:48 ip-172-10-2-190 openvpn(pam_google_authenticator)[10712]: debug: start of google_authenticator for "user" Dec 2 21:09:48 ip-172-10-2-190 openvpn(pam_google_authenticator)[10712]: debug: Secret file permissions are 0400. Allowed permissions are 0600 Dec 2 21:09:48 ip-172-10-2-190 openvpn(pam_google_authenticator)[10712]: debug: "/home/user/.google_authenticator" read Dec 2 21:09:48 ip-172-10-2-190 openvpn(pam_google_authenticator)[10712]: debug: shared secret in "/home/user/.google_authenticator" processed Dec 2 21:09:48 ip-172-10-2-190 openvpn(pam_google_authenticator)[10712]: Invalid verification code for user

On the client which is viscosity I have: static-challenge "Google Authenticator Code:" 1

Also to note I have OpenVPN working with viscosity fine with this config: [oconf=Server Config] port 1194 proto udp dev tun sndbuf 0 rcvbuf 0 ca ca.crt cert server.crt key server.key dh dh.pem plugin /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so openvpn auth SHA512 tls-auth ta.key 0 topology subnet server 10.x.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt reneg-sec 36000 #push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 172.x.x.x" # Some Pushed Routes Here push "route 172.x.0.0 255.255.0.0" keepalive 10 120 cipher AES-256-CBC user nobody group nobody persist-key persist-tun status openvpn-status.log verb 3 crl-verify crl.pem log-append /var/log/openvpn.log

The working PAM config /etc/pam.d/openvpn: [oconf=PAM Config] auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so auth required pam_google_authenticator.so forward_pass auth include system-auth account include system-auth password include system-auth

Then in Viscosity I am using this Client config for a working system: [oconf=Viscosity Config] remote x.x.x.x 1194 udp nobind dev tun persist-tun persist-key pull auth-user-pass tls-client ca ca.crt cert cert.crt key key.key remote-cert-tls server tls-auth ta.key 1 resolv-retry infinite setenv opt block-outside-dns rcvbuf 0 cipher AES-256-CBC auth SHA512 sndbuf 0

This works in the way that the client opens and it asks you for: USER PASSWORD+OTP example: User=dude Password=mypass123456 My problem is that I want to do this: USER PASSWORD OTP example: User=dude Password=mypass Otp=123456 When I try to do the separate OTP I can config viscosity fine to ask for the OTP separately but what I think the issue lies in my PAM config /etc/pam.d/openvpn. I need your help to get the OTP separate from the PASSWORD passing correctly. Here is what I see currently as an error when trying to do this verb4 in config FYI: [oconf=Client Errors] AUTH-PAM: BACKGROUND: received command code: 0 AUTH-PAM: BACKGROUND: USER: user AUTH-PAM: BACKGROUND: my_conv[0] query='login:' style=2 AUTH-PAM: BACKGROUND: name match found, query/match-string ['login:', 'login'] = 'USERNAME' AUTH-PAM: BACKGROUND: my_conv[0] query='pin' style=1 AUTH-PAM: BACKGROUND: name match found, query/match-string ['pin', 'pin'] = 'OTP' AUTH-PAM: BACKGROUND: my_conv[0] query='Password: ' style=1 AUTH-PAM: BACKGROUND: name match found, query/match-string ['Password: ', 'password'] = 'PASSWORD' AUTH-PAM: BACKGROUND: user 'user' failed to authenticate: Authentication failure Tue Dec 3 14:40:34 2019 us=757401 x.x.x.x:56947 PLUGIN_CALL: POST /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1 Tue Dec 3 14:40:34 2019 us=757440 x.x.x.x:56947 PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so Tue Dec 3 14:40:34 2019 us=757487 x.x.x.x:56947 TLS Auth Error: Auth Username/Password verification failed for peer Tue Dec 3 14:40:34 2019 us=780941 x.x.x.x:56947 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA Tue Dec 3 14:40:34 2019 us=780983 x.x.x.x:56947 [user] Peer Connection Initiated with [AF_INET]x.x.x.x:56947 Tue Dec 3 14:40:34 2019 us=784967 x.x.x.x:56947 PUSH: Received control message: 'PUSH_REQUEST' Tue Dec 3 14:40:34 2019 us=784987 x.x.x.x:56947 Delayed exit in 5 seconds Tue Dec 3 14:40:34 2019 us=784999 x.x.x.x:56947 SENT CONTROL [user]: 'AUTH_FAILED' (status=1) Tue Dec 3 14:40:40 2019 us=36751 x.x.x.x:56947 SIGTERM[soft,delayed-exit] received, client-instance exiting [/oconf] Here is what I am trying in configs ( I have tried quotes and no quotes around plugin group same result ): Server config (/etc/openvpn/server.conf): [oconf=Server Config] port 1194 proto udp dev tun sndbuf 0 rcvbuf 0 ca ca.crt cert server.crt key server.key dh dh.pem plugin /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so "openvpn login USERNAME password PASSWORD pin OTP" #plugin /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so openvpn auth SHA512 tls-auth ta.key 0 topology subnet server 10.x.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt reneg-sec 36000 #push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 172.x.x.x" # Some Pushed Routes Here push "route 172.x.0.0 255.255.0.0" keepalive 10 120 cipher AES-256-CBC user nobody group nobody persist-key persist-tun status openvpn-status.log verb 4 crl-verify crl.pem log-append /var/log/openvpn.log [/oconf] PAM config I am trying to use ( /etc/pam.d/openvpn ): [oconf=PAM Config] auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so #auth required pam_google_authenticator.so forward_pass auth required pam_google_authenticator.so authtok_prompt=pin debug auth include system-auth account include system-auth password include system-auth [/oconf] Viscosity client config I am using: [oconf=Viscosity Config] remote x.x.x.x 1194 udp nobind dev tun persist-tun persist-key pull auth-user-pass tls-client ca ca.crt cert cert.crt key key.key remote-cert-tls server tls-auth ta.key 1 resolv-retry infinite setenv opt block-outside-dns rcvbuf 0 cipher AES-256-CBC auth SHA512 static-challenge "Google Authenticator Code:" 1 sndbuf 0 [/oconf]

New Update in secure.log: [oconf=Error in Secure Log] Dec 4 14:44:23 ip-172-10-2-190 openvpn(pam_google_authenticator)[13164]: Invalid verification code for user Dec 4 14:44:23 ip-172-10-2-190 openvpn[13164]: pam_unix(openvpn:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= user=user [/oconf] This seems to be the problem. Centos 7 and taking a static-challenge in config is an issue. Again I can config openvpn to do password+otp out of the box and that is fine. But users want to use the viscosity client and save username and pass. Then only enter OTP.

We do [b]not[/b] support viscosity here.

[quote=TinCanTech post_id=88249 time=1575472127 user_id=37053] We do [b]not[/b] support viscosity here. [/quote] Thanks I understand that. I was trying the same config on openvpn client on my android phone with same result. If that makes it easier? I wanted to know if what I was asking was ok on the server side. Or has anyone done this on a Centos 7 box successfully?

I found the problem: Centos 7 and other distros most likely have not built from source/master of openvpn. The auth-pam module does not even allow this functionality even in 2.4.8 as noted in README: [oconf=auth-pam] https://github.com/OpenVPN/openvpn/tree/master/src/plugins/auth-pam [/oconf] I will build openvpn from source/master then install google auth and try again then note here with progress.

google_auth_pam with static-challenge not working

TinCanTech

Federicogpp wrote Did you find any solution to make password+otp work?

Yours is working ..

https://forums.openvpn.net/viewtopic.php?f=6&t=31180

« Previous Page