google / google/google-authenticator-libpam
Verification succeeds in the debug logs, but OpenVPN reports that it failed
- Dominant language
- C
- Stars
- 2k
- Forks
- 305
- PR merge metrics
- No merged PRs in 30d
Description
I'm trying to get google-authenticator-libpam working with openvpn, but I'm running into an issue where openvpn claims that verification failed while the logs for google-authenticator-libpam say that verification succeeded. My current PAM configuration is
```
auth required /usr/lib/security/pam_google_authenticator.so secret=/etc/openvpn/google-authenticator/${USER} user=gauth debug echo_verification_code authtok_prompt=password forward_pass
```
and I reference this in my openvpn config with the following line (note that the openvpn config works fine if this line is commented out).
```
plugin "/usr/lib/openvpn/plugins/openvpn-plugin-auth-pam.so" "openvpn login USERNAME password PASSWORD"
```
The authentication succeeds when using `pamtester`
```bash
# pamtester openvpn myuser authenticate
password123456
pamtester: successfully authenticated
```
but I get the following error from openvpn when I try to connect.
```
AUTH-PAM: BACKGROUND: user 'myuser' failed to authenticate: Authentication failure
Thu Jul 18 08:07:25 2019 42.123.17.102:56119 PLUGIN_CALL: POST /usr/lib/openvpn/plugins/openvpn-plugin-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
Thu Jul 18 08:07:25 2019 42.123.17.102:56119 PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/lib/openvpn/plugins/openvpn-plugin-auth-pam.so
Thu Jul 18 08:07:25 2019 42.123.17.102:56119 TLS Auth Error: Auth Username/Password verification failed for peer
```
The corresponding logs for google-authenticator-libpam are
```
Jul 18 08:07:25 myserver openvpn(pam_google_authenticator)[11888]: debug: start of google_authenticator for "myuser"
Jul 18 08:07:25 myserver openvpn(pam_google_authenticator)[11888]: debug: Secret file permissions are 0400. Allowed permissions are 0600
Jul 18 08:07:25 myserver openvpn(pam_google_authenticator)[11888]: debug: "/etc/openvpn/google-authenticator/myuser" read
Jul 18 08:07:25 myserver openvpn(pam_google_authenticator)[11888]: debug: shared secret in "/etc/openvpn/google-authenticator/myuser" processed
Jul 18 08:07:25 myserver openvpn(pam_google_authenticator)[11888]: debug: google_authenticator for host "(null)"
Jul 18 08:07:25 myserver openvpn(pam_google_authenticator)[11888]: debug: no scratch code used from "/etc/openvpn/google-authenticator/myuser"
Jul 18 08:07:25 myserver openvpn(pam_google_authenticator)[11888]: Accepted google_authenticator for myuser
Jul 18 08:07:25 myserver openvpn(pam_google_authenticator)[11888]: debug: "/etc/openvpn/google-authenticator/myuser" written
Jul 18 08:07:25 myserver openvpn(pam_google_authenticator)[11888]: debug: end of google_authenticator for "myuser". Result: Success
Jul 18 08:07:25 myserver openvpn[11888]: pam_warn(openvpn:account): function=[pam_sm_acct_mgmt] flags=0 service=[openvpn] terminal=[] user=[myuser] ruser=[] rhost=[]
```
which seem to suggest that the verification actually did succeed.
Any ideas why google-authenticator-libpam is saying that verification succeeded while openvpn is saying that it failed?
Contributor guide
Assessment
This issue has not been assessed yet.