0

Q: How can I autoload user and password with OTP based MFA dynamic challenge for openvpn3 and only prompt for MFA code?

Attempts Made:

I created the below script to inject OTP based MFA code at request time into a .autoload config with openvpn3-autoload to simplify the login process with our OpenVPN requirements. I figure the script should be able to get around the static requirement until the MFA needs renewal but I am still getting issues with the dynamic_challenge parameter.

I get the following message from connection with the openvpn3-autoload using openvpn3 sessions-list:

Status: Connection, Configuration requires user input: Dynamic Challenge

OpenVPN3 Autoload Credentials Script

#!/bin/bash
set -e

## Requirements
# - openvpn3
# - openvpn3-autoload

# When you are logged in you may download a client.ovpn file.  First create a
# subdir at ~/.openvpn and copy the downloaded file to this directory.  

echo '{"autostart": true,"user-auth": { "autologin": true,"username": "{{ OPENVPN_USR }}", "password": "{{ OPENVPN_PW }}", "dynamic_challenge": "{{ OPENVPN_MFA_CODE }}"},"tunnel": {"ipv6": [ "default" ],"persist": true}}' > ${HOME}/.openvpn/autoload.tmpl

OPENVPN_CLIENT=client
OPENVPN_USR="my.user"
OPENVPN_PW="password"
OPENVPN_USR=${OPENVPN_USR:-`read -p "User login: " OPENVPN_USR; echo $OPENVPN_USR`}
OPENVPN_PW=${OPENVPN_PW:-`read -p "User Pass: " OPENVPN_PW; echo $OPENVPN_PW`}

read -p "Please enter MFA code: " OPENVPN_MFA_CODE

export OPENVPN_USR=${OPENVPN_USR}
export OPENVPN_PW=${OPENVPN_PW}
export OPENVPN_MFA_CODE=${OPENVPN_MFA_CODE}

## This is an internal tool to our org but you could figure out how to use jq also.
## tmpz -t ${HOME}/.openvpn/autoload.tmpl -o ${HOME}/.openvpn/${OPENVPN_CLIENT}.autoload
rm ${HOME}/.openvpn/autoload.tmpl

# I am open to suggestions if you have a better way.
openvpn3-autoload --directory ${HOME}/.openvpn

I have tried passing a parameter file like below to the ovpn file with auth-user-pass credentials.txt.

credentials.txt

my.user
password

I get connection failure with auth-user-pass and no dynamic challenge.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.