Muu buenas, aquí os traigo una guía para habilitar el doble factor en nuestro usuario de OpenVpn
Lo primero de todo actualizar nuestro repositorios, para luego instalar las dependencias que nos harán falta.
Dicho esto lo primero será loguearnos via SSH en nuestro router… después entramos en modo configuración (configure) y aplicamos lo siguiente:
set system package repository stretch components 'main contrib non-free'
set system package repository stretch distribution stretch
set system package repository stretch url http://http.us.debian.org/debian
Y después lo aplicamos y guardamos ( commit ; save )
Instalar las dependencias
apt-get update
apt-get -y install libqrencode3 easy-rsa libpam-google-authenticator
2· Configurar fichero PAM
cd /etc/pam.d
cp common-account openvpn
echo "auth requisite pam_google_authenticator.so forward_pass" >> openvpn
echo "auth required pam_unix.so use_first_pass" >> openvpn
3· Openvpn
set interfaces openvpn vtun0 openvpn-option '--plugin /usr/lib/openvpn/openvpn-auth-pam.so openvpn'
4· Creamos el usuario
configure
set system login user "${USERNAME}" authentication plaintext-password "${PASSWORD}"
commit
save
5· Generamos MFA
sudo su -c "google-authenticator --label=\"My OpenVPN 2FA\"" my-user
** Y a las preguntas en el momento de habilitar el MFA yo pongo la siguiente configuración...
Do you want to disallow multiple uses of the same authentication
token? This restricts you to one login about every 30s, but it increases
your chances to notice or even prevent man-in-the-middle attacks (y/n) y
By default, tokens are good for 30 seconds and in order to compensate for
possible time-skew between the client and the server, we allow an extra
token before and after the current time. If you experience problems with poor
time synchronization, you can increase the window from its default
size of 1:30min to about 4min. Do you want to do so (y/n) n
If the computer that you are logging into isn't hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every 30s.
Do you want to enable rate-limiting (y/n) y
6· Le damos permisos de lectura a nuestro usuario recien creado sobre su directorio de google auth.
sudo chmod 400 /home/openvpn-user/.google_authenticator
**Recordar que ahora cuando nos vayamos a autenticar primero introducimos nuestra clave de usuario y seguido la clave MFA**