Hi, On Tue, Aug 13, 2013 at 11:44:52PM +0200, Jan Just Keijser wrote: > ???????? ?????????????? wrote: > > we are using "auth-user-pass-verify /etc/openvpn/blah-blah-blah.sh > > via-env" and user/password authentication is done by external program. > > it can be adopted to one time password as well. > interesting - is there Unix/Linux support for these things?
For the RSA SecureID stuff, at least for AIX and Linux, there are libraries
available to authenticate against the server given username+code - I'm not
sure how it works in detail, but I found it a pain to work with.
We use something else called "Kobil SecOVID", which is not time-based
but "press the button, get an OTP token" based - but the principle is
similar. The Kobil auth server speaks RADIUS, so our OpenVPN server
uses plugin-auth-pam to authenticate vs. PAM, and then pam_radius to
talk to the Kobil server - it could use the openvpn radius plugin as
well, but back in the day, that was more complicated to setup.
gert
--
USENET is *not* the non-clickable part of WWW!
//www.muc.de/~gert/
Gert Doering - Munich, Germany g...@greenie.muc.de
fax: +49-89-35655025 g...@net.informatik.tu-muenchen.de
pgpvLmg2gFwH0.pgp
Description: PGP signature
------------------------------------------------------------------------------ Get 100% visibility into Java/.NET code with AppDynamics Lite! It's a free troubleshooting tool designed for production. Get down to code-level detail for bottlenecks, with <2% overhead. Download for free and get started troubleshooting in minutes. http://pubads.g.doubleclick.net/gampad/clk?id=48897031&iu=/4140/ostg.clktrk
_______________________________________________ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-users
