OPNsense Forum

Archive => 23.1 Legacy Series => Topic started by: yohighnest on March 28, 2023, 09:31:07 AM

Title: Openvpn with 2FA extra challenge in Client
Post by: yohighnest on March 28, 2023, 09:31:07 AM
Hi,

anybody knows howto get the extra challenge working in the OpenVPN Client? I tried with Openvpn Connect V3 and Securepoint 2.0.38. As far is i know both Clients should be capable of asking for the otp token in a extra field.

I added:

static-challenge "TOTP Token" 1

in the server but this wasnt working. Any ideas?

Title: Re: Openvpn with 2FA extra challenge in Client
Post by: franco on March 28, 2023, 09:55:49 AM
At this point I think this looks like trolling more than anything.


Cheers,
Franco
Title: Re: Openvpn with 2FA extra challenge in Client
Post by: yohighnest on March 28, 2023, 10:19:56 AM
lol franco i think we are becoming friends. please checkout

https://openvpn.net/cloud-docs/two-factor-authentication-on-profile-download-2/

in the openvpn cloud this is already working. securepoint utm and the client seem to be capable of it.

if a ui designer is seeing the solution of prefixing the totp token to the password, he probably wants to die.

so this is no trolling but a valid question.
Title: Re: Openvpn with 2FA extra challenge in Client
Post by: franco on March 28, 2023, 10:23:59 AM
Perhaps :) See https://github.com/opnsense/core/issues/3290#issuecomment-470026999 from 2019.


Cheers,
Franco
Title: Re: Openvpn with 2FA extra challenge in Client
Post by: mimugmail on March 28, 2023, 10:25:48 AM
This has to be done at the client, Tunnelblick for Mac already has a separate OTP field putting the OTP behind the password
Title: Re: Openvpn with 2FA extra challenge in Client
Post by: yohighnest on March 28, 2023, 10:37:44 AM
thx this was helpfull.

the ui designer asks me why this is not setting in the config export?
Title: Re: Openvpn with 2FA extra challenge in Client
Post by: franco on March 28, 2023, 11:08:09 AM
It hasn't been explicitly requested and it could break your authentication so it was left as an advanced field option.


Cheers,
Franco
Title: Re: Openvpn with 2FA extra challenge in Client
Post by: mimugmail on March 28, 2023, 04:11:37 PM
Quote from: yohighnest on March 28, 2023, 10:37:44 AM
thx this was helpfull.

the ui designer asks me why this is not setting in the config export?

TBH I wasn't aware of the config setting, maybe there could be room for another checkbox to add during config export, but as franco said, custom options is your friend and export options get stored in config :)

Welcome to open source :D