Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This can be useful for someone that is using a VPN in Internet cafe where someone could have installed a key logger. This way, even if they have recorded the password, it will not work the next time.

share|improve this question

I have used an OpenVPN setup that had a username/password phase to authenticate the actual user, and it back-ended this against PAM. Sadly, I don't have the config files from that installation, but anything that back-ends against PAM can take advantage of any PAM module, and PAM modules have all sort of one-time support - and better.

For straight one-time passwords, this chap writes about using OPIE under PAM, OPIE being (like S/KEY) one of the old OTP (one-time password) solutions from way back (digressing slightly, I can recall printing out a sheet of 20 OPIE passwords to take off to a conference in 1995, and I'm sure others will have even earlier memories of it). It may be old, but it's still solid, and now there are any number of OPIE software generators that you could use if you didn't like carrying the piece of paper. The article above references an iPhone app, but I'm sure there are others.

However, why stop there? Once you've got PAM wired into the authentication engine, you can get quite baroque - and increasingly secure.

This chap has a PAM module that sends a token via SMS which must be entered, so you could use your GSM phone as part of a two-factor solution.

I myself have used a Yubikey, which is a little USB-interfaced OTP generator, with PAM, so you could go all the way to a dedicated hardware solution if you wanted (all the code is GPL'ed). I use it to control ssh and sudo access, but because it's done via PAM it could easily be wired-into the OpenVPN user authentication phase.

Hopefully that clarifies that this is definitely possible in theory, and gives you some ideas. I'm sorry that I don't have a working OpenVPN+PAM config to append, but this article from seems to cover it in some detail.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.