2

I'm looking to deploy openvpn as a linux RAS server (rather than site-to-site) and i'd like to use two factor authentication, specifically the use of ssl certificates and passwords tied into an ntlm domain or ldap server.

Is this even possible ? I'm really struggling to dig up information on doing such a thing so I'm starting to doubt it a little. If anyone has done this it'd be good to know (or knows of an open source way to do such a thing), or even better has the openvpn server config needed to pull this off.

edit: i know an ssl cert isn't an ideal factor. :)

1

4 Answers 4

5

From the client side you need the following option to prompt the user for username/password

auth-user-pass

On the server side you need the following option to verify the username/password

auth-user-pass-verify scriptname method

scriptname is a script or program that openvpn will execute in order to verify the user/pass. If the script's return code is true (0), the user gets logged in, otherwise invalidated. method is the way user and pass parameters are passed to the scriptname.

So you need to have a script/program to validate users based on an ldap server and you're done.

Edit: related documentation Using alternative authentication methods

4
  • can you put the auth-user-pass part onto the server side ? Otherwise im liking this as an option
    – Sirex
    Mar 14, 2011 at 13:06
  • No, that is a client only argument. It doesn't make sense to put it in the server side, since it's there to ask credentials from the user. If you don't want the user to enter any credentials, you can use the auth-user-pass filename option, which reads a user/pass pair from a txt file filename. You can put anything in that file and have scriptname authenticate the user based on other info, either way what matters is only if it returns 0 (success) or not.
    – forcefsck
    Mar 14, 2011 at 13:31
  • May have jumped the gun slightly. I have this working in terms of certificates and user/passwords, but i have no way currently to tie a certificate to a particular domain user. i.e: if they have any valid cert and any valid password, they are let in.
    – Sirex
    Mar 14, 2011 at 15:16
  • never mind, there's an env_var $common_name which can be used to compare against $username. awesome
    – Sirex
    Mar 14, 2011 at 15:22
1

I have a friend who is doing exactly that: OpenVPN with SSL certificates used to authenticate each endpoint, then a username/password prompt appears and the user's credentials are authenticated off an AD server via LDAP before the OpenVPN connection will come up. I know that's what he's doing, as I have on occasion had credentials to use it, and thus logged in myself. So yes, it's possible, but I don't have the configs; sorry.

6
  • ohhh so tantalising ! lol -- any chance you could pass him the url for this question ? (please + cherry ?)
    – Sirex
    Mar 14, 2011 at 8:57
  • He's a good egg, and a big believer in the GPL and knowledge-sharing, so we might get lucky. I've emailed him, and we'll see.
    – MadHatter
    Mar 14, 2011 at 9:08
  • The reply comes that he found LDAP to be unreliable so switched to openVPN+radius for the user auth step. I have some configs if you're open to that option.
    – MadHatter
    Mar 14, 2011 at 13:51
  • I'm currently getting somewhere with forcefsck's option, so I'll see where that takes me. I'll send you a message if i hit a wall on it though, currently it looks encouraging. Thanks for the help so far :) I'm actually using "net user" rather than ldap as the machine is already on the domain. Avoids messing with radius/ldap
    – Sirex
    Mar 14, 2011 at 14:21
  • @MadHatter : Yes. please =) I would very much like to look at your config files.
    – Sandra
    Aug 29, 2011 at 16:57
1

Have you tried to follow http://openvpn.net/index.php/open-source/documentation/howto.html#security and use the openvpn-auth-pam ?

Have not done it myself, but would go the path described in https://help.ubuntu.com/community/ActiveDirectoryHowto#Pam to setup pam against AD. After that's done, telling openvpn to use pam shouldn't be hard.

4
  • I don't have the facility to extend the AD schema to include unix attributes
    – Sirex
    Mar 14, 2011 at 10:52
  • @Sirex, ...and your AD is pre WS2003R2? (the article states that R2 and anything post that already has them)
    – Unreason
    Mar 14, 2011 at 11:44
  • i believe so. At least, this was the blocker on the recent move from winbind to pam_krb5. May be wrong.
    – Sirex
    Mar 14, 2011 at 12:53
  • Well ok, then winbind+pam (as described ftp.samba.org/samba/docs/man/Samba-HOWTO-Collection/…)
    – Unreason
    Mar 14, 2011 at 13:25
1

I use OpenVPN as a RAS server on Ubuntu and for two-fold uthentication I have a Deepnet Authentication Server which generates One Time Passwords to be used in conjunction with static passwords - which in turn authenticates the VPN users to AD.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .