We have a corporate VPN server running OpenVPN 2.3 on an AWS instance with Ubuntu 16.04 Xenial. The server has been configured using an Ansible playbook.
I'm planning to upgrade to Ubuntu 18.04 Bionic, which also upgrades OpenVPN to version 2.4 (this is a desired side effect, as OpenVPN 2.3 is getting deprecated). So I created a test instance with Bionic on it, and ran the Ansible playbook against it. The configuration includes MFA through Google Authenticator, so I also copied
~/.google_authenticator file from the old server and applied
chmod 400 to it.
There were also a couple of compatibility issues which I had to solved before the new server worked:
openvpn-plugin-auth-pam.sofile location has changed, and now its full path doesn't need to be specified in the server config.
CAP_AUDIT_WRITEpermission missing in
openvpnsystemd service (see more details here)
However, even after that authentication still fails on the new server. Here's what my
/etc/pam.d/openvpn looks like:
auth required pam_google_authenticator.so
If I replace this line with
auth required pam_permit.so, I get successfully authenticated (with any password of course) and connected, so the problem is definitely where MFA steps in.
At the same time,
pamtester tells me that
pam_google_authenticator.so works fine:
$ sudo pamtester openvpn vlad authenticate Verification code: pamtester: successfully authenticated
Here's what I see in syslog when trying to authenticate to VPN server:
Aug 16 15:17:39 ip-10-7-0-230 openvpn: AUTH-PAM: BACKGROUND: received command code: 0 Aug 16 15:17:39 ip-10-7-0-230 openvpn: AUTH-PAM: BACKGROUND: USER: vlad Aug 16 15:17:39 ip-10-7-0-230 openvpn: AUTH-PAM: BACKGROUND: my_conv query='login:' style=2 Aug 16 15:17:39 ip-10-7-0-230 openvpn: AUTH-PAM: BACKGROUND: user 'vlad' failed to authenticate: Authentication failure
In this thread I found a suggestion that the line in server config that calls auth-pam module should be changed from
plugin openvpn-plugin-auth-pam.so openvpn
plugin openvpn-plugin-auth-pam.so "openvpn login USERNAME password PASSWORD"
However, neither of them seems to work - I still get "Authentication failure".
Interestingly, the same experiment with rebuilding the server on the base of Xenial worked - so the problem seems to be either in Ubuntu Bionic (some additional security features?) or in OpenVPN 2.4 (some compatibility issues).
Does anyone have any ideas how to fix this?
Update. Just tried adding
/etc/pam.d/openvpn and deleting
~/.google_authenticator file. Still fails, same error.