3 ms·
Enable Two-Factor Auth on your VPN.
- davemtl 13y agoI've been doing this for a while using the Google Authenticator PAM plugin[1]. I use the same module to add two factor authentication to both SSH and OpenVPN connections. [1] http://code.google.com/p/google-authenticator/ http://code.google.com/p/google-authenticator/
- daemon13 13y agoCan you share some "how to" pointers - may be a blog post describing how to do this?
- davemtl 13y agoReal quick and dirty. But you should be able to get it to work from these notes. Be warned, I don't go into how to set-up OpenVPN. You can find documentation for OpenVPN at http://openvpn.net/index.php/open-source/documentation/howto.html http://openvpn.net/index.php/open-source/documentation/howto... You'll need to install Google Authenticator on your phone to complete the set-up. Here are my notes: https://invaliddomain.com/openvpn-google-auth-howto.txt https://invaliddomain.com/openvpn-google-auth-howto.txt (please excuse the lack of a real SSL cert). Once enabled, your password becomes <password><OTP> .. e.g. Pa55w0rd!987654 Hope that helps.
- teraflop 13y agoOr, if you want to do the same thing without trusting the security of your VPN to a third party, and you're willing to do a little more fiddling with configuration files, you can just use libpam-google-authenticator: http://www.howtoforge.com/securing-openvpn-with-a-one-time-password-otp-on-ubuntu http://www.howtoforge.com/securing-openvpn-with-a-one-time-p...
- dcu 13y agoYou are only trusting the half of the security which is better IMHO. The evil person would need to hack/steal both you and the (likely more careful) third party in order to access your accounts. In your scenario it would only need to hack you to get everything.
- molf 13y agoBetter yet, use passwords plus client side certificates. It prevents these scenarios without requiring you to trust a third party with your two-factor authentication tokens.