Securing OpenVPN with two-factor
-
We have been using pfSense (2.1.5-release) as our firewall and to provide staff with VPN access to the network. Twice now we suspect someone has been able to connect to the VPN that shouldn't, because we're seeing myself connected from foreign IPs while I'm not even working. We are using certificates too, so this is all a bit strange.
We need to put in some sort of two-factor authentication (my preferred would be something that works with the Google Authenticator RFC6238).
Is there a relatively easy established 2FA method for a pfSense VPN solution? If not, can anyone recommend a product that could do this?
-
If your VPN server works in "SSL/TLS + user auth" mode and you have checked "Strict User/CN Matching" you have a 2FA.
However, if "Strict User/CN Matching" isn't checked connection is established if user/pw combination matches to any entry in users database and certificate matches to servers CA. With other words, any user who has an available certificate can login with any username in database.