Securing OpenVPN With A One Time Password (OTP) On Ubuntu

"-lpam"

Save the file and lets proceed, shall we?We need to compile this, so thats easy:

make

No errors? Good. It might be that you get an error about "displayQRCode". If so, you will need to make some changes to the makefile. If everything went as it should, you can just proceed.

find /usr/lib -name libdl.so

In the makefile, replace all 3 references to "/usr/lib/libdl.so" with the path you got (e.g. "/usr/lib/i386-linux-gnu/libdl.so").Save it up, and re-run make. You should now be able to proceed just fine.

If it was compiled succesfully, proceed with installing it: make install

We're done, let's proceed shall we?

 

Configuring OpenVPN to use PAM

Open up /etc/openvpn/server.conf and add the following line:

plugin /usr/lib/openvpn/openvpn-auth-pam.so openvpn

This will use PAM to provide additional means of authentication.The last part (openvpn) is the file in /etc/pam.d we'd like to use. Since we do not want it to interfere with other services (e.g. SSH or sudo) we just use a new file.

Restart OpenVPN to have it re-read the config file.

 

Configure PAM to authenticate using Google Authenticator

Create the file /etc/pam.d/openvpn:

cp /etc/pam.d/common-account /etc/pam.d/openvpn
vim /etc/pam.d/openvpn

Add the following line:

auth required pam_google_authenticator.so

If you are using encrypted homedirectories, you will need to change that to:

auth required pam_google_authenticator.so secret

View the Original article