{"id":208,"date":"2015-04-03T00:19:33","date_gmt":"2015-04-02T23:19:33","guid":{"rendered":"https:\/\/blog.lemongrass.org.uk\/lemongrass\/?p=208"},"modified":"2016-02-02T20:31:00","modified_gmt":"2016-02-02T20:31:00","slug":"google-authenticator-with-openvpn","status":"publish","type":"post","link":"https:\/\/blog.lemongrass.org.uk\/lemongrass\/google-authenticator-with-openvpn\/","title":{"rendered":"Google Authenticator with OpenVPN"},"content":{"rendered":"<p>Here are some pointers, but note that some information is out of date:<\/p>\n<ul>\n<li><a href=\"https:\/\/vorkbaard.nl\/setup-openvpn-with-google-authenticator-on-ubuntu-12-04-lts-server\/\">https:\/\/vorkbaard.nl\/setup-openvpn-with-google-authenticator-on-ubuntu-12-04-lts-server\/<\/a><\/li>\n<li><a href=\"https:\/\/blog.lemongrass.org.uk\/lemongrass\/wp-content\/uploads\/sites\/2\/2015\/04\/Setup-OpenVPN-with-Google-Authenticator-on-Ubuntu-12.04-LTS-server-Vorkbaard-uit-de-toekomst.pdf\" rel=\"\">Setup OpenVPN with Google Authenticator on Ubuntu 12.04 LTS server | Vorkbaard uit de toekomst<\/a>\u00a0(PDF copy of above)<\/li>\n<\/ul>\n<p>The easy-rsa package is now separate from OpenVPN and is installed using &#8220;sudo apt-get install easy-rsa&#8221;.<\/p>\n<p>Add the following line to the end of the server&#8217;s OpenVPN configuration file, which might be called server.conf:<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">plugin \/usr\/lib\/openvpn\/openvpn-auth-pam.so openvpn<\/pre>\n<p>To install Google Authenticator on the server, the instructions in the above link are outdated.\u00a0 Get the source from github.com. It&#8217;s called &#8220;google\/google-authenticator&#8221;. I used &#8220;git clone&#8221; to get it:<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">% git clone https:\/\/github.com\/google\/google-authenticator<\/pre>\n<p>On Ubuntu, you&#8217;ll have to install the PAM development libraries before building:<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">% sudo apt-get install libpam-dev<\/pre>\n<p>The part you need on the server is in google-authenticator\/libpam.\u00a0 Follow the instructions in the README in that directory to build and install it, ending with &#8220;sudo make install&#8221;.\u00a0 It installs the generated library in \/usr\/local\/lib\/security.\u00a0 Next, you need a PAM config file for OpenVPN. Create \/etc\/pam.d\/openvpn with the following content:<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\n@include common-account\r\nauth requisite \/usr\/local\/lib\/security\/pam_google_authenticator.so forward_pass\r\nauth required pam_unix.so use_first_pass\r\n<\/pre>\n<p>Then follow the remaining steps in the above article.\u00a0 One day, I&#8217;ll write it up more completely.\u00a0 Probably too late.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Here are some pointers, but note that some information is out of date: https:\/\/vorkbaard.nl\/setup-openvpn-with-google-authenticator-on-ubuntu-12-04-lts-server\/ Setup OpenVPN with Google Authenticator on Ubuntu 12.04 LTS server | Vorkbaard uit de toekomst\u00a0(PDF copy of above) The easy-rsa package is now separate from OpenVPN and is installed using &#8220;sudo apt-get install easy-rsa&#8221;. Add the following line to the end [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-208","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/blog.lemongrass.org.uk\/lemongrass\/wp-json\/wp\/v2\/posts\/208","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.lemongrass.org.uk\/lemongrass\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.lemongrass.org.uk\/lemongrass\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.lemongrass.org.uk\/lemongrass\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.lemongrass.org.uk\/lemongrass\/wp-json\/wp\/v2\/comments?post=208"}],"version-history":[{"count":8,"href":"https:\/\/blog.lemongrass.org.uk\/lemongrass\/wp-json\/wp\/v2\/posts\/208\/revisions"}],"predecessor-version":[{"id":237,"href":"https:\/\/blog.lemongrass.org.uk\/lemongrass\/wp-json\/wp\/v2\/posts\/208\/revisions\/237"}],"wp:attachment":[{"href":"https:\/\/blog.lemongrass.org.uk\/lemongrass\/wp-json\/wp\/v2\/media?parent=208"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.lemongrass.org.uk\/lemongrass\/wp-json\/wp\/v2\/categories?post=208"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.lemongrass.org.uk\/lemongrass\/wp-json\/wp\/v2\/tags?post=208"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}