Hello, this is my first post here, so sorry for my bad English. Is there any possibility to change the order of password and OTP (static-challenge config option) in the OpenVPN client? The client seems to transmit the credentials in the order +. In OPNsense I can switch the order on the OpenVPN server, but in some other commerical devices (ex. Sophos UTM) the order is fixed to +, so the authentification doesn't work here with the client GUI. When I enter + in the password field of the GUI, it works. Any ideas?

So many holes in this question: [list][*]Which GUI [*]Which OTP[/list] Please see: https://forums.openvpn.net/viewtopic.php?f=30&t=22603

Change password & static challenge transmission order

getle

Hello,

this is my first post here, so sorry for my bad English. Is there any possibility to change the order of password and OTP (static-challenge config option) in the OpenVPN client? The client seems to transmit the credentials in the order <otp>+<password>. In OPNsense I can switch the order on the OpenVPN server, but in some other commerical devices (ex. Sophos UTM) the order is fixed to <password>+<otp>, so the authentification doesn't work here with the client GUI. When I enter <password>+<otp> in the password field of the GUI, it works.

Any ideas?

TinCanTech

So many holes in this question:

Which GUI
Which OTP

Please see:
https://forums.openvpn.net/viewtopic.php?f=30&t=22603

getle

Sorry for the missing information. I use the following programs:

GUI: OpenVPN GUI V11.00.0.0 (Windows 10 x64) bundled with OpenVPN CE 2.4.8 (openvpn-install-2.4.8-I602-Win10.exe)
Client: OpenVPN 2.4.8 CE (Windows 10 x64) bundled with OpenVPN CE 2.4.8 (openvpn-install-2.4.8-I602-Win10.exe)
Servers: Various, OpenVPN 2.4.8 CE (embedded in OPNSense), Sophos UTM 9.6 (I know you don't support them, but it works if the otp is transmitted after the password)

The OTP is simple standard TOTP (SHA1, 6 digits), which is added before or after the password. When I use the static-challenge option in the config, the GUI displays an extra field for the OTP, then the otp is added before the password. I only want to know if there is a way to force the GUI to add the otp after the password. If not I want to open a feature request for this.

Do you need any additional information?

TinCanTech

Now it is clear and a good job I asked ...

You will probably have a little more luck reporting this to the GUI developers on github
https://github.com/OpenVPN/openvpn-gui/blob/master/README.rst