search

CyberNinjas / pam_aad

Azure Active Directory PAM Module
GNU General Public License v3.0
54 stars 19 forks source link

OpenVPN Integration #14

Closed Jnchi closed 5 years ago

Jnchi commented 5 years ago

The openvpn-auth-pam module implements username/password authentication via PAM, and essentially allows any authentication method supported by PAM (such as LDAP, RADIUS, or Linux Shadow passwords) to be used with OpenVPN. --README.auth-pam

https://github.com/OpenVPN/openvpn/tree/master/src/plugins/auth-pam

Jnchi commented 5 years ago

Resources:

Jnchi commented 5 years ago

/etc/openvpn/server.conf

plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so openvpn
client-cert-not-required
username-as-common-name

/etc/pam.d/openvpn

auth required pam_aad.so client_id= resource_id= tenant= required_group_id=
@include common-auth
account required pam_nologin.so
@include common-account
@include common-session
@include common-password

Or,

cp /etc/pam.d/sshd /etc/pam.d/openvpn

Adapted from: yubico-pam: YubiKey and OpenVPN via PAM

Jnchi commented 5 years ago

OpenVPN Client is never prompted

AUTH-PAM: BACKGROUND: received command code: 0
AUTH-PAM: BACKGROUND: USER: dev
AUTH-PAM: BACKGROUND: my_conv[0] query='Enter the following code at https://aka.ms/devicelogin : BQBJRSVMC
Please hit enter after you have logged in.' style=1
AUTH-PAM: BACKGROUND: my_conv[0] query='Password: ' style=1
AUTH-PAM: BACKGROUND: user 'dev' failed to authenticate: Authentication failure
Tue Dec  4 13:16:48 2018 us=249047 192.168.254.1:1194 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-plugin-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
Tue Dec  4 13:16:48 2018 us=249075 192.168.254.1:1194 PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/lib/openvpn/openvpn-plugin-auth-pam.so
Tue Dec  4 13:16:48 2018 us=249116 192.168.254.1:1194 TLS Auth Error: Auth Username/Password verification failed for peer
Tue Dec  4 13:16:48 2018 us=249214 192.168.254.1:1194 SIGTERM[soft,auth-control-exit] received, client-instance exiting

Full log: openvpn-server.log

Jnchi commented 5 years ago

https://www.slsmk.com/getting-started-with-openvpn/openvpn-with-id-and-password-authentication-on-ubuntu

Jnchi commented 5 years ago

The OpenVPN plugin passes the username/password from the client to the server during authentication (See: https://github.com/OpenVPN/openvpn/blob/master/src/plugins/auth-pam/auth-pam.c#L510), however, the device prompt/code is not sent back to the client from the server, resulting in the module failing automatically.

OpenVPN server output:

openvpn --config /etc/openvpn/server.conf
[ . . . TRUNCATED . . . ]
AUTH-PAM: BACKGROUND: received command code: 0
AUTH-PAM: BACKGROUND: USER: jnchi
Connected
AUTH-PAM: BACKGROUND: my_conv[0] query='Enter the following code at https://aka.ms/devicelogin : FJQH7VK77
Please hit enter after you have logged in.' style=2
Connected
no upn?
AUTH-PAM: BACKGROUND: user 'jnchi' failed to authenticate: Authentication failure

PAM module output:

tail /var/log/auth.log
Mar  4 10:34:11 debian jnchi(pam_azure_authenticator)[9701]: debug: start of azure_authenticator for jnchi

See: https://github.com/CyberNinjas/pam_aad/issues/24

Jnchi commented 5 years ago

OpenVPN Configuration

First, follow this tutorial from the Debian Wiki:

Then there are a few modifications needed, (See: previous comment).

Example configuration files:

Jnchi commented 5 years ago 
$ ssh jnchi@10.8.0.1
The authenticity of host '10.8.0.1 (10.8.0.1)' can't be established.
ECDSA key fingerprint is SHA256:UboLDzf2gy/tbDr7cUfW4pJWrduU+Tlex/vaaLY3kNM.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.8.0.1' (ECDSA) to the list of known hosts.
An email with a one-time passcode was sent to your email.
Enter the code at https://aka.ms/devicelogin, then press enter.

Linux debian 4.9.0-8-amd64 #1 SMP Debian 4.9.144-3.1 (2019-02-19) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Thu Mar 21 12:01:09 2019 from 192.168.1.125
jnchi@debian:~$
Jnchi commented 5 years ago

https://serverfault.com/questions/970125/how-to-tunnel-all-traffic-through-an-openvpn-server

Jnchi commented 5 years ago

openvpn-gui

Note: The OpenVPN GUI will prompt for a password, however, the user's password is not used by pam_aad; simply set it to an arbitrary value and select "Save password".

https://github.com/OpenVPN/openvpn-gui