OpenVPN, FreeRadius and LDAP

Totem974 0

I turn to the community to seek help regarding the integration of LDAP authentication and Google Authenticator for VPN access using FreeRadius, OpenVPN, and PfSense.

Here's my current situation: I have successfully installed and tested FreeRadius, OpenVPN, and PfSense independently, and each component is functioning correctly. However, I now want to implement a more secure authentication process for users connecting to the VPN.

My goal is to allow users to connect to the VPN by providing their credentials and password from the Active Directory (LDAP), and then prompt users to enter the temporary code provided by Google Authenticator via FreeRadius. And if there is a way to get one QRcode by User, it would be better.

In summary:
PF + LDAP = ok
OVPN + LDAP = ok
OVPN + PAP = ok
OVPN + (LDAP + PAP) = error

Is this even possible?

michmoor

@Totem974-0 https://www.netgate.com/blog/freeradius-on-pfsense-for-2fa

Ive accomplished 2FA using DUO which is free for 10 users.
OpenVPN user authenticates with LDAP. LDAP query gets sent to DUO proxy and then sent to LDAP server. LDAP server approves and DUO proxy will send a push notification to users phone. Works flawlessly. Might be a cleaner solution then sending every users a qr code.

Totem974 0

@michmoor

It can indeed be a solution, but I need to be able to accommodate at least 20 users. Nevertheless, it's a lead worth exploring (the idea of using a proxy to access a third-party server). And if possible using Microsoft Authenticator.

Thank you for this tip.

DonP

This post is deleted!

bamypamy

I have the same question. Did you manage to get it working?
I can get it to work with local users and 2fa and I can also get it to work with ldap users and no 2fa but not in combination.

michmoor

@bamypamy
Its very easy to set up DUO. You set up a Proxy. Have the proxy point to your LDAP. Thats it.

https://duo.com/docs/authproxy-reference

bamypamy

@michmoor I checked this option but I also have the problem that it is more than 10 Users. I guess I need to ask for some money. ;-)
Thanks for replying.