I've been told by my tech guys that, to authenticate using two-factor, each time I wish to connect to our VPN, I have to [i][u][b]edit the password to append the 2FA token to it[/b][/u][/i] - is this the only way? surely there is a way of getting a 2FA challenge popup - rather than having to edit the password manually? It's running on a Sophos UTM

2FA palaver

jayartibee

I've been told by my tech guys that, to authenticate using two-factor, each time I wish to connect to our VPN, I have to edit the password to append the 2FA token to it - is this the only way? surely there is a way of getting a 2FA challenge popup - rather than having to edit the password manually?

It's running on a Sophos UTM

openvpn_inc

Hello jayartibee,

MFA can be implemented either in a separate challenge, or by combining the MFA response with the password, and having the target authentication system splitting those up again. This is not something that OpenVPN decides. This is something that the authentication system decides. This is just the way they have decided to implement it.

Only thing I can advise you is that if you don't like this, and you would the challenge to be separate, to ask your tech guys if they can implement it that way. OpenVPN certainly supports that. It's just not been implemented this way by whatever system you're using. If this system supports doing it with a separate challenge then get them to do that. If it doesn't, well, then there's not much you can do aside from looking for another VPN server solution that does implement MFA with a separate dialog.

Kind regards,
Johan

legalsolver

You don't necessarily have to combine your normal password and the 2FA token every time. OpenVPN supports a separate challenge-response authentication method, where the VPN client can display an additional prompt for the one-time code instead of requiring users to manually edit their password.

The important part is how Sophos UTM handles authentication. It needs to support and be configured for a separate OTP challenge, and the VPN client must also support displaying that challenge. OpenVPN's challenge-response protocol supports both static and dynamic challenges, so this is not a limitation of the OpenVPN protocol itself.

I'd recommend checking the [https://openvpn.net/community-docs/management-interface/] to understand how the separate authentication prompt works.

One thing worth checking with your administrators is whether the Sophos UTM authentication backend can issue a dynamic challenge and whether the particular client being used can display it. If the current Sophos configuration only supports password-plus-OTP authentication, changing the client alone won't solve the issue.

It would be worth testing this with a separate challenge-response configuration before changing the existing VPN authentication setup, especially if you want a smoother and more convenient 2FA experience.