3

We have a corporate VPN server running OpenVPN 2.3 on an AWS instance with Ubuntu 16.04 Xenial. The server has been configured using an Ansible playbook.

I'm planning to upgrade to Ubuntu 18.04 Bionic, which also upgrades OpenVPN to version 2.4 (this is a desired side effect, as OpenVPN 2.3 is getting deprecated). So I created a test instance with Bionic on it, and ran the Ansible playbook against it. The configuration includes MFA through Google Authenticator, so I also copied ~/.google_authenticator file from the old server and applied chmod 400 to it.

There were also a couple of compatibility issues which I had to solved before the new server worked:

  • openvpn-plugin-auth-pam.so file location has changed, and now its full path doesn't need to be specified in the server config.
  • CAP_AUDIT_WRITE permission missing in openvpn systemd service (see more details here)

However, even after that authentication still fails on the new server. Here's what my /etc/pam.d/openvpn looks like:

auth required pam_google_authenticator.so

If I replace this line with auth required pam_permit.so, I get successfully authenticated (with any password of course) and connected, so the problem is definitely where MFA steps in.

At the same time, pamtester tells me that pam_google_authenticator.so works fine:

$ sudo pamtester openvpn vlad authenticate
Verification code:
pamtester: successfully authenticated

Here's what I see in syslog when trying to authenticate to VPN server:

Aug 16 15:17:39 ip-10-7-0-230 openvpn[10873]: AUTH-PAM: BACKGROUND: received command code: 0
Aug 16 15:17:39 ip-10-7-0-230 openvpn[10873]: AUTH-PAM: BACKGROUND: USER: vlad
Aug 16 15:17:39 ip-10-7-0-230 openvpn[10873]: AUTH-PAM: BACKGROUND: my_conv[0] query='login:' style=2
Aug 16 15:17:39 ip-10-7-0-230 openvpn[10873]: AUTH-PAM: BACKGROUND: user 'vlad' failed to authenticate: Authentication failure

In this thread I found a suggestion that the line in server config that calls auth-pam module should be changed from

plugin openvpn-plugin-auth-pam.so openvpn

to:

plugin openvpn-plugin-auth-pam.so "openvpn login USERNAME password PASSWORD"

However, neither of them seems to work - I still get "Authentication failure".

Interestingly, the same experiment with rebuilding the server on the base of Xenial worked - so the problem seems to be either in Ubuntu Bionic (some additional security features?) or in OpenVPN 2.4 (some compatibility issues).

Does anyone have any ideas how to fix this?

Update. Just tried adding nullok to /etc/pam.d/openvpn and deleting ~/.google_authenticator file. Still fails, same error.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.