how to re-authenticate after inactivity

cwensink

I have IPFire running with openVPN running smoothly, however one issue that's coming up is that if a client's PC goes idle, and the VPN tunnel times out, when the computer is woken back up, the VPN connection is automatically resumed, and re-connected without having to type in credentials again. I want them to have to type in credentials again after 15 minutes of inactivity. The IPFire server options are pretty basic, I push out DHCP optoins for the DNS/WINS server, and Redirect the gateway def1, and I have LZO compression turned on, Max clients is 100 Keep alive (ping/ping-restart) is 60,86400,Logfile options VERB 11.

What parameters do I need to put into the client / server to force putting credentials in again?

Also, is it possible to use a physical key / hasp similar to how Mastercam protects the use of their software, that would require an encrypted flash drive or a pass code generator to be used to authenticate for two factor authentication? Can anyone point me to some resources on how to set that up?

Chris

cwensink

[root@ipfire ~]# uname -a
Linux ipfire.inside.host 4.14.173-ipfire #1 SMP Thu Mar 12 12:07:28 GMT 2020 x86_64 Intel(R) Xeon(R) CPU E3-1225 v3 @ 3.20GHz GenuineIntel GNU/Linux
[root@ipfire ~]#

[root@ipfire ovpn]# cat server.conf
#OpenVPN Server conf
daemon openvpnserver
writepid /var/run/openvpn.pid
#DAN prepare OpenVPN for listening on blue and orange
;local x.x.x.x
dev tun
proto udp
port 1194
script-security 3
ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600
client-config-dir /var/ipfire/ovpn/ccd
tls-server
ca /var/ipfire/ovpn/ca/cacert.pem
cert /var/ipfire/ovpn/certs/servercert.pem
key /var/ipfire/ovpn/certs/serverkey.pem
dh /var/ipfire/ovpn/ca/dh1024.pem
server x.x.x.x 255.255.255.0
tun-mtu 1400
keepalive 60 86400
status-version 1
status /var/run/ovpnserver.log 30
ncp-disable
cipher AES-256-CBC
auth SHA512
comp-lzo
push "redirect-gateway def1"
push "dhcp-option DNS x.x.x.x"
push "dhcp-option WINS x.x.x.x"
max-clients 100
tls-verify /usr/lib/openvpn/verify
crl-verify /var/ipfire/ovpn/crls/cacrl.pem
user nobody
group nobody
persist-key
persist-tun
verb 11

CCD:

# OpenVPN clientconfig from ccd extension by Copymaster#

#This client uses the dynamic pool

#Client gets routes to these networks (behind IPFire)
push "route x.x.x.x 255.255.255.0"

#Client gets these nameservers
push "dhcp-option DNS x.x.x.x"

########################################
#
#  Custom Entries by user
#######################################

#Force clients to disconnect after 5 minutes
push "inactive 300"

[root@ipfire ovpn]# cat settings
DPROTOCOL=udp
LOG_VERB=11
DHCP_DNS=x.x.x.x
ROOTCERT_CITY='city'
ROOTCERT_EMAIL=netadmin
ROOTCERT_COUNTRY=US
ENABLED_ORANGE=off
ROOTCERT_OU=IT
ROUTES_PUSH=
COMPLZO=on
KEEPALIVE_2=86400
VPN_IP=x.x.x.x
DCIPHER=AES-256-CBC
ADDITIONAL_CONFIGS=
DOVPN_SUBNET=x.x.x.x/255.255.255.0
DAUTH=SHA512
ENABLED_BLUE=off
DDEST_PORT=1194
ROOTCERT_HOSTNAME=ipfire.host
REDIRECT_GW_DEF1=on
DHCP_DOMAIN=
ENABLED=on
TLSAUTH=
ROOTCERT_ORGANIZATION='org'
KEEPALIVE_1=60
ROOTCERT_STATE=WI
CLIENT2CLIENT=
DCOMPLZO=on
DHCP_WINS=x.x.x.x
DMTU=1400
MAX_CLIENTS=100
[root@ipfire ovpn]#

Server Log file is dumped into /var/log/messages, and that's a 5.1G text file, way too much to post, but I can cat/grep out snippets to give the relevant bits of data if someone can tell me what to pull out.

TinCanTech

cwensink wrote Server Log file is dumped into /var/log/messages, and that's a 5.1G text file

Which you can control with --verb