/duo_openvpn

Mozilla's take on duo_openvpn

Primary LanguagePythonMozilla Public License 2.0MPL-2.0

Duo_openvpn

Mozilla's take at duo_openvpn support. Duo's own duo_openvpn appears to be aging off. We rewrote it to use duo_client_python, as well as logging for operational security needs.

Git submodules

In order to checkout all the modules necessary for this to build, run

git clone --recursive git@github.com:mozilla-it/duo_openvpn.git
# Or, if already checked out:
git submodule update --init --recursive

Features

  • Simple. Sort of.
  • Fail open (optional).
  • OTP and Push (use push as password for push, passcode:123456 as password for OTP, where 123456 is your OTP).
  • MozDef support.
  • Optional-username hack, in case you use emails as certificate CN but only the first part of the email as login.
  • Deferred call.

Configuration

C plugin

Call it from openvpn configuration with:

plugin /usr/lib/openvpn/plugins/duo_openvpn.so /usr/lib/openvpn/plugins/duo_openvpn.py

This allow making a deferred call for authentication while using a script instead of blocking OpenVPN. This is needed as otherwise Duo will block OpenVPN while waiting for a push reply or OTP input.