selinux is DISABLED
I am trying to add a 2FA functionality using the google-authenticator package, but unable to get OpenVPN to authenticate a user (google auth itself is working)
my server.conf, I'm using the OpenVPN plugin PAM here,
Code: Select all
port 1194
proto udp
dev tun-us
user nobody
group nobody
persist-key
persist-tun
keepalive 10 120
topology subnet
management 127.0.0.1 5555
server 10.8.24.0 255.255.255.0
ifconfig-pool-persist ipp.txt
duplicate-cn
push "route xxx.xxx.xxx.xxx 255.255.255.255" # Elastic
push "dhcp-option DOMAIN mycorp.domain"
push "dhcp-option DNS xxx.xxx.xxx.xxx"
push "dhcp-option DNS xxx.xxx.xxx.xxx"
crl-verify crl.pem
ca ca.crt
cert server_RQ7fpBxxx.crt
key server_RQ7fpBxxx.key
tls-auth tls-auth.key 0
dh dh.pem
auth SHA256
cipher AES-128-CBC
tls-server
tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256
status /var/log/openvpn/status.log
verb 5
plugin /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so "openvpn login USERNAME password PASSWORD pin OTP"
Code: Select all
client
proto udp
remote <Pub IP of OpenVPN server> 1194
dev tun
dev-type tun
resolv-retry infinite
nobind
persist-key
persist-tun
verify-x509-name server_RQ7fpBIT7xxxx name
auth SHA256
auth-nocache
cipher AES-128-CBC
tls-client
tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256
setenv opt block-outside-dns
pull-filter ignore redirect-gateway
verb 3
remote-cert-tls server
auth-user-pass
static-challenge "Enter 2FA Authenticator code:" 1
script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf
down-pre
dhcp-option DOMAIN-ROUTE .
Code: Select all
auth required /usr/lib64/security/pam_google_authenticator.so secret=/opt/openvpn/google-auth/${USER} user=root authtok_prompt=pin debug allowed_perm=0400 echo_verification_code
auth [success=1 default=ignore] pam_unix.so nullok_secure
this is how I generate the QR code:
Code: Select all
google-authenticator -t -d -f -r 3 -R 30 -W -C -s "/opt/openvpn/google-auth/${CLIENT}" || { echo "error generating QR code"; exit 1; }
secret=$(head -n 1 "/opt/openvpn/google-auth/${CLIENT}")
qrencode -t PNG -o "/opt/openvpn/google-auth/$CLIENT.png" "otpauth://totp/${CLIENT}@qbvpn-us2?secret=${secret}&issuer=openvpn" || { echo "error generating PNG"; exit 1; }
heres a client logging in from their laptop, using 2FA code, looking at /var/log/messages on the Server, I can see the Google Auth is working for this user:
Accepted google_authenticator for bob
"/opt/openvpn/google-auth/bob" written
debug: end of google_authenticator for "bob". Result: Success
Code: Select all
Mar 13 11:09:42 qbvpn-us2 openvpn(pam_google_authenticator)[10842]: debug: start of google_authenticator for "bob"
Mar 13 11:09:42 qbvpn-us2 openvpn(pam_google_authenticator)[10842]: debug: Secret file permissions are 0400. Allowed permissions are 0400
Mar 13 11:09:42 qbvpn-us2 openvpn(pam_google_authenticator)[10842]: debug: "/opt/openvpn/google-auth/bob" read
Mar 13 11:09:42 qbvpn-us2 openvpn(pam_google_authenticator)[10842]: debug: shared secret in "/opt/openvpn/google-auth/bob" processed
Mar 13 11:09:42 qbvpn-us2 openvpn(pam_google_authenticator)[10842]: debug: google_authenticator for host "(null)"
Mar 13 11:09:42 qbvpn-us2 openvpn(pam_google_authenticator)[10842]: debug: no scratch code used from "/opt/openvpn/google-auth/bob"
Mar 13 11:09:42 qbvpn-us2 openvpn(pam_google_authenticator)[10842]: Accepted google_authenticator for bob
Mar 13 11:09:42 qbvpn-us2 openvpn(pam_google_authenticator)[10842]: debug: "/opt/openvpn/google-auth/bob" written
Mar 13 11:09:42 qbvpn-us2 openvpn(pam_google_authenticator)[10842]: [b]debug: end of google_authenticator for "bob". Result: Success[/b]
Mar 13 11:09:42 qbvpn-us2 openvpn[10842]: pam_unix(openvpn:auth): check pass; user unknown
Mar 13 11:09:42 qbvpn-us2 openvpn[10842]: pam_unix(openvpn:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
looking at /var/log/secure, OpenVPN is not authenticating this user however:
TLS Auth Error: Auth Username/Password verification failed for peer
Code: Select all
Mar 13 11:09:42 qbvpn-us2 openvpn[10841]: Sun Mar 13 11:09:42 2022 us=154262 PLUGIN AUTH-PAM: BACKGROUND: USER: bob
Mar 13 11:09:42 qbvpn-us2 openvpn[10841]: Sun Mar 13 11:09:42 2022 us=154271 PLUGIN AUTH-PAM: BACKGROUND: parsed static challenge password
Mar 13 11:09:42 qbvpn-us2 openvpn[10841]: Sun Mar 13 11:09:42 2022 us=158787 PLUGIN AUTH-PAM: BACKGROUND: my_conv[0] query='login:' style=2
Mar 13 11:09:42 qbvpn-us2 openvpn[10841]: Sun Mar 13 11:09:42 2022 us=158803 PLUGIN AUTH-PAM: BACKGROUND: name match found, query/match-string ['login:', 'login'] = 'USERNAME'
Mar 13 11:09:42 qbvpn-us2 openvpn[10841]: Sun Mar 13 11:09:42 2022 us=160025 PLUGIN AUTH-PAM: BACKGROUND: my_conv[0] query='pin' style=2
Mar 13 11:09:42 qbvpn-us2 openvpn[10841]: Sun Mar 13 11:09:42 2022 us=160039 PLUGIN AUTH-PAM: BACKGROUND: name match found, query/match-string ['pin', 'pin'] = 'OTP'
Mar 13 11:09:42 qbvpn-us2 openvpn[10841]: Sun Mar 13 11:09:42 2022 us=163559 PLUGIN AUTH-PAM: BACKGROUND: my_conv[0] query='Password: ' style=1
Mar 13 11:09:42 qbvpn-us2 openvpn[10841]: Sun Mar 13 11:09:42 2022 us=163578 PLUGIN AUTH-PAM: BACKGROUND: name match found, query/match-string ['Password: ', 'password'] = 'PASSWORD'
Mar 13 11:09:42 qbvpn-us2 openvpn[10841]: Sun Mar 13 11:09:42 2022 us=164823 PLUGIN AUTH-PAM: BACKGROUND: user 'bob' failed to authenticate: Authentication failure
Mar 13 11:09:42 qbvpn-us2 openvpn[10841]: Sun Mar 13 11:09:42 2022 us=165624 172.50.1.68:55092 PLUGIN_CALL: POST /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
Mar 13 11:09:42 qbvpn-us2 openvpn[10841]: Sun Mar 13 11:09:42 2022 us=165643 172.50.1.68:55092 PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so
[b]Mar 13 11:09:42 qbvpn-us2 openvpn[10841]: Sun Mar 13 11:09:42 2022 us=165662 172.50.1.68:55092 TLS Auth Error: Auth Username/Password verification failed for peer
Mar 13 11:09:42 qbvpn-us2 openvpn[10841]: WWRRSun Mar 13 11:09:42 2022 us=182963 172.50.1.68:55092 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 3072 bit RSA
Mar 13 11:09:42 qbvpn-us2 openvpn[10841]: Sun Mar 13 11:09:42 2022 us=183005 172.50.1.68:55092 [bob] Peer Connection Initiated with [AF_INET]172.50.1.68:55092
Mar 13 11:09:43 qbvpn-us2 openvpn[10841]: RSun Mar 13 11:09:43 2022 us=216084 172.50.1.68:55092 PUSH: Received control message: 'PUSH_REQUEST'
Mar 13 11:09:43 qbvpn-us2 openvpn[10841]: Sun Mar 13 11:09:43 2022 us=216117 172.50.1.68:55092 Delayed exit in 5 seconds
Mar 13 11:09:43 qbvpn-us2 openvpn[10841]: Sun Mar 13 11:09:43 2022 us=216135 172.50.1.68:55092 SENT CONTROL [bob]: 'AUTH_FAILED' (status=1)
Mar 13 11:09:43 qbvpn-us2 openvpn[10841]: RSun Mar 13 11:09:43 2022 us=216084 172.50.1.68:55092 PUSH: Received control message: 'PUSH_REQUEST'
Mar 13 11:09:43 qbvpn-us2 openvpn[10841]: Sun Mar 13 11:09:43 2022 us=216117 172.50.1.68:55092 Delayed exit in 5 seconds
Mar 13 11:09:43 qbvpn-us2 openvpn[10841]: Sun Mar 13 11:09:43 2022 us=216135 172.50.1.68:55092 SENT CONTROL [bob]: 'AUTH_FAILED' (status=1)
Mar 13 11:09:48 qbvpn-us2 openvpn[10841]: WWWSun Mar 13 11:09:48 2022 us=351634 172.50.1.68:55092 SIGTERM[soft,delayed-exit] received, client-instance exiting
Mar 13 11:09:48 qbvpn-us2 openvpn[10841]: WWWSun Mar 13 11:09:48 2022 us=351634 172.50.1.68:55092 SIGTERM[soft,delayed-exit] received, client-instance exiting
Not sure where its breaking, the user "bob" is not a OS system user, only a VPN profile user, do I need to physically create users on the VPN server?
Is there an issue with the PAM plugin?
Thank you.