google / google/google-authenticator-libpam

Verification succeeds in the debug logs, but OpenVPN reports that it failed

Open
#139 10 comments 1 reaction 0 assignees View on GitHub
openvpn
Dominant language
C
Stars
2k
Forks
305
PR merge metrics
No merged PRs in 30d

Description

I'm trying to get google-authenticator-libpam working with openvpn, but I'm running into an issue where openvpn claims that verification failed while the logs for google-authenticator-libpam say that verification succeeded. My current PAM configuration is

```
auth required /usr/lib/security/pam_google_authenticator.so secret=/etc/openvpn/google-authenticator/${USER} user=gauth debug echo_verification_code authtok_prompt=password forward_pass
```

and I reference this in my openvpn config with the following line (note that the openvpn config works fine if this line is commented out).

```
plugin "/usr/lib/openvpn/plugins/openvpn-plugin-auth-pam.so" "openvpn login USERNAME password PASSWORD"
```

The authentication succeeds when using `pamtester`

```bash
# pamtester openvpn myuser authenticate
password123456
pamtester: successfully authenticated
```

but I get the following error from openvpn when I try to connect.

```
AUTH-PAM: BACKGROUND: user 'myuser' failed to authenticate: Authentication failure
Thu Jul 18 08:07:25 2019 42.123.17.102:56119 PLUGIN_CALL: POST /usr/lib/openvpn/plugins/openvpn-plugin-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
Thu Jul 18 08:07:25 2019 42.123.17.102:56119 PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/lib/openvpn/plugins/openvpn-plugin-auth-pam.so
Thu Jul 18 08:07:25 2019 42.123.17.102:56119 TLS Auth Error: Auth Username/Password verification failed for peer
```

The corresponding logs for google-authenticator-libpam are

```
Jul 18 08:07:25 myserver openvpn(pam_google_authenticator)[11888]: debug: start of google_authenticator for "myuser"
Jul 18 08:07:25 myserver openvpn(pam_google_authenticator)[11888]: debug: Secret file permissions are 0400. Allowed permissions are 0600
Jul 18 08:07:25 myserver openvpn(pam_google_authenticator)[11888]: debug: "/etc/openvpn/google-authenticator/myuser" read
Jul 18 08:07:25 myserver openvpn(pam_google_authenticator)[11888]: debug: shared secret in "/etc/openvpn/google-authenticator/myuser" processed
Jul 18 08:07:25 myserver openvpn(pam_google_authenticator)[11888]: debug: google_authenticator for host "(null)"
Jul 18 08:07:25 myserver openvpn(pam_google_authenticator)[11888]: debug: no scratch code used from "/etc/openvpn/google-authenticator/myuser"
Jul 18 08:07:25 myserver openvpn(pam_google_authenticator)[11888]: Accepted google_authenticator for myuser
Jul 18 08:07:25 myserver openvpn(pam_google_authenticator)[11888]: debug: "/etc/openvpn/google-authenticator/myuser" written
Jul 18 08:07:25 myserver openvpn(pam_google_authenticator)[11888]: debug: end of google_authenticator for "myuser". Result: Success
Jul 18 08:07:25 myserver openvpn[11888]: pam_warn(openvpn:account): function=[pam_sm_acct_mgmt] flags=0 service=[openvpn] terminal=[] user=[myuser] ruser=[] rhost=[]
```

which seem to suggest that the verification actually did succeed.

Any ideas why google-authenticator-libpam is saying that verification succeeded while openvpn is saying that it failed?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.