Hi all,
Although this thread is slightly old, I still thought it would be worthwhile to post my solution. In summary, pfSense 2.x on ALIX hardware using OpenVPN with DuoSecurity PUSH authentication is working (for me) and hopefully the following notes will help :D
The following setup works for the three forms of authentication from DuoSecurity - PUSH, Call and SMS.
I used a server, separate from pfSense, to run the DuoSecurity RADIUS proxy, FreeRADIUS and authentication database (UNIX). Once you have identified the server, follow these instructions on DuoSecurity's website: http://www.duosecurity.com/docs/radius
During the DuoSecurity Generic RADIUS configuration, follow the instructions for RADIUS (not Active Directory) and add the IP address of pfSense (not hostname) as a RADIUS client
Test the RADIUS installation locally as suggested by DuoSecurity and be certain it is working before continuing
Add the RADIUS details in pfSense:
Go to System -> User Manager -> Servers
Add the RADIUS client with the RADIUS secret you set during DuoSecurity proxy configuration. Set Services offered: to Authentication.
Save
Test authentication via DuoSecurity SMS only (PUSH won't work yet) by going to Diagnostics -> Authentication. Password is in the format <password>,sms</password> and if you already have the SMS OTPs, the format is e.g. <password>,A123456</password>. Once this is working, you can continue with the final steps.
To set the RADIUS client timeout and retry limit to the values recommended by DuoSecurity, do the following:
In pfSense, select Diagnostics -> Edit File
Press Browse and select /etc/inc/radius.inc
| | NOTE: If the editing window is grey and you can't edit the file, you will have to amend the file via SSH and making the file system writeable by typing |
| | mount -u -w /dev/ufs/<pfsense_partition></pfsense_partition> |
| | To make it read-only after the change type |
| | mount -u -r /dev/ufs/<pfsense_partition></pfsense_partition> |
In the editor, find the lines:
function addServer($servername = 'localhost', $port = 0, $sharedSecret = 'testing123', $timeout = 3, $maxtries = 3)
function putServer($servername, $port = 0, $sharedsecret = 'testing123', $timeout = 3, $maxtries = 3)
Change the
timeout and
maxtries values to the DuoSecurity recommended values e.g.:
function addServer($servername = 'localhost', $port = 0, $sharedSecret = 'testing123', $timeout = 10, $maxtries = 10)
function putServer($servername, $port = 0, $sharedsecret = 'testing123', $timeout = 10, $maxtries = 10)
Save the changes
Test authentication via DuoSecurity PUSH by going to Diagnostics -> Authentication. Password is in the format <password>,push</password>
Hopefully it works.
