9

I have a working OpenVPN system on Ubuntu 12.04 and I'd like to add Google Authenticator for extra security.

This is my current openvpn config:

dev tun
proto udp
port 1096
ca ubuserv04-ca.crt
cert ubuserv04.crt
key ubuserv04.key
dh dh1024.pem
server 10.10.0.0 255.255.255.0
push "redirect-gateway def1"
push "route 192.168.0.0 255.255.255.0"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
float
log-append /var/log/openvpn-otp-1096-status.log

(This is just a test setup, I know I should change certain aspects of it but this works for now.)

On the client I have:

dev tun
client
proto udp
remote my.server.fqdn 1096
resolv-retry infinite
ca ubuserv04-ca.crt
cert user1.crt
key user1.key
verb 3

The above setup works fine: no errors, fast, stable.

I've tried several howtos to get Google Authenticator running but I end up troubleshooting side problems in those articles every time. I don't want to authenticate against the server's local user/password database, just the system I already have in place plus Google Authenticator.

I have Google Authenticator running; I installed it using apt-get install libpam-google-authenticator and have used it before to authenticate ssh sessions. That worked fine but I have now disabled that because it's just a test server and that particular test was finished.

Please be specific. I know I should add a plugin to my server's ovpn config and that I should add something to /etc/pam.d/openvpn but what exactly?

Any help would be greatly appreciated!

/extra info

I've followed this article: http://www.howtoforge.com/securing-openvpn-with-a-one-time-password-otp-on-ubuntu Instead of compiling from the source I've installed Google Authenticator with apt-get install libpam-google-authenticator. I've also read, but not used in this case, these articles: http://www.howtogeek.com/121650/how-to-secure-ssh-with-google-authenticators-two-factor-authentication/ and http://zcentric.com/2012/10/09/google-authenticator-with-openvpn-for-2-factor-auth/. And I've read up on PAM, as suggested ;)

Now, here are some interesting developmens.

/etc/pam.d/openvpn has this:

account [success=2 new_authtok_reqd=done default=ignore]    pam_unix.so 
account [success=1 new_authtok_reqd=done default=ignore]    pam_winbind.so 
account requisite           pam_deny.so
account required            pam_permit.so
auth required pam_google_authenticator.so

As per the howto I copied the original from /etc/pam.d/common-account and added the last line. Now if I comment the last line out, the OpenVPN connection succeeds. If the last line is not commented out however, /var/log/auth.log logs this:

PAM unable to dlopen(pam_google_authenticator.so): /lib/security/pam_google_authenticator.so: undefined symbol: pam_get_item
PAM adding faulty module: pam_google_authenticator.so

and /var/log/openvpn-otp-1096.log logs this:

PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/lib/openvpn/openvpn-auth-pam.so
TLS Auth Error: Auth Username/Password verification failed for peer
e-using SSL/TLS context
AUTH-PAM: BACKGROUND: user 'martin' failed to authenticate: Module is unknown

The problem seems to be between PAM and Google Authenticator.

Google lists problems with other plugins but I can't really find information regarding Google Authenticator specifically.

7
  • "I've tried several howtos to get Google Authenticator running" Could you link to some of those? It's rather vague what you've tried exactly and it would be sad if other users come up with approaches you've already tried. By the way, libpam-google-authenticator is for authenticating using Google Authenticator in PAM. This is of no use in OpenVPN as you're using certificates there. I suggest you read about what PAM is - you'll understand that it has nothing to do with OpenVPN in your case.
    – gertvdijk
    May 29, 2013 at 9:27
  • @"This is of no use in OpenVPN as you're using certificates there." That's OK. You can use certificates and a one time password from Google Authenticator via PAM as the second factor for authentication in OpenVPN. May 29, 2013 at 9:38
  • Adding extra info to the original question. Not sure if I'm doing this right...
    – Forkbeard
    May 29, 2013 at 10:43
  • @gertvdijk: I get your point about it being redundant but I'd like to use both certificates and a one time password. It seems safer to me then using either method individually.
    – Forkbeard
    May 29, 2013 at 10:50
  • Hm, it seems to be a bug in Google Authenticator. Building it with LDFLAGS="-lpam" should help but I'm not sure how to do that, the example on Howtoforge (link in the original question) doesn't work, the url returns a 404.
    – Forkbeard
    May 29, 2013 at 11:02

2 Answers 2

4

Ok, Google is my friend.

I did this:

# apt-get purge libpam-google-authenticator
# download https://code.google.com/p/google-authenticator/downloads/list
# apt-get install libpam-dev

Add this to Makefile, right after the license:

LDFLAGS="-lpam"

Then

# make
# make install
# service openvpn restart

Also, make sure /home/username/.google_authenticator has no rights at all except read rights for the user that's going to use it.

Now I need to enter my username that's my local username on the server (my shell account) as my OpenVPN username and the Google Authenticator 6-digit code as the password.

Now it works.

Thank you all for your time :)

(How can I mark this post as solved? Do I just edit the topic title?)

3

If you just want OTP auth for OpenVPN, there is a native OTP OpenVPN plugin available. It is compatible with Google Authenticator secret keys. All secrets are stored in a single text file and there is no need to configure PAM or create user directories.

Check it out: https://github.com/evgeny-gridasov/openvpn-otp

1
  • Thanks for your reply, egridasov. Since I have a working setup now I'm not going to try it but I might give it a go on another system. The reneg-sec 0 bit I find particularly helpful, I had been breaking my head on how to get the connection to not drop after 3600 seconds
    – Forkbeard
    Apr 3, 2014 at 11:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .