Use PAM multi factor auth only for selected users (Google Authenticator)

tuxmartin

Hi,
I have OpenVPN server with multi factor authentication using Google Authenticator.

It works, but all users must use multi factor authentication.
I would like to have some users without multi factor authentication.
I need to configure multi factor authentication per user, not per server.
Is it possible (client-config-dir or someting similar)?

My OpenVPN server config:

# ----- Google Authenticator multi factor authentication
plugin /usr/lib/x86_64-linux-gnu/openvpn/plugins/openvpn-plugin-auth-pam.so openvpn
# ----- Google Authenticator multi factor authentication

tls-server
port 12345
proto tcp
dev tun
server 10.16.11.0 255.255.255.0
duplicate-cn
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh.pem
tls-version-min 1.0
cipher AES-128-CBC
auth SHA256
reneg-sec 60
log-append /var/log/openvpn.log
status /var/run/vpn.status 10
user nobody
group nogroup
keepalive 30 120
comp-lzo
verb 3
persist-key
persist-tun
client-config-dir /etc/openvpn/ccd
reneg-sec 0

Everything else is according to the instructions: https://medium.com/we-have-all-been-there/using-google-authenticator-mfa-with-openvpn-on-ubuntu-16-04-774e4acc2852

Thanks for help.

tuxmartin

I found a partial solution:

# cat /etc/pam.d/openvpn
account    [success=1 new_authtok_reqd=done default=ignore]	pam_unix.so 
account    requisite                 pam_deny.so
account    required                  pam_permit.so
auth       sufficient                pam_exec.so expose_authtok /bin/gauth-skip-check
auth       required                  pam_google_authenticator.so secret=/etc/openvpn/google-authenticator/${USER} user=gauth forward_pass

#/bin/gauth-skip-check 
#!/bin/bash
cat /etc/openvpn/gauth-skip-users | grep -q ${PAM_USER}

Now user enter username and any string to password. If username is in file /etc/openvpn/gauth-skip-users, login is accepted.

But I still must have auth-user-pass in user config.
How can I do it without auth-user-pass?
auth-user-pass accepts file with user and password. But I need only one file for client.

TinCanTech

tuxmartin wrote I need to configure multi factor authentication per user, not per server.

Think again.

tuxmartin

TinCanTech wrote
tuxmartin wrote I need to configure multi factor authentication per user, not per server.
Think again.

How do you mean?

I have 15 VPN users.
For 10 (normal users) of them I need multi factor authentication.

But for the 5 remaining users (admins, servers) I do not want multi factor authentication.

For simplicity I would like to have only one running OpenVPN server.

TinCanTech

Did you think at all ?

tuxmartin

TinCanTech wrote Did you think at all ?

Yes, of course!

Is possible to enable multifactor auth in client-config-dir? Or do I have to have two vpn servers?