WIUNIX ACADEMY
OpenVPN MFA with client certificates and Google Authenticator
Page 5 of 5. Review the earlier steps and prerequisites before continuing.
YOUR SYSTEM. YOUR STEPS.
Where are you working?
Choose your OS and version. The prerequisites, commands and troubleshooting follow your environment.
USE YOUR OWN VALUES
Configure this tutorial
Set the example values for your environment; related explanations and copy panels update together. Never enter passwords, private keys or tokens. Values stay in this tab and are not sent to the server or share links. Check actual DNS, certificates and network policy before running commands.
Different IP addresses, domains or ports? Open the settings below, change the values and select “Apply to tutorial”, then copy the updated commands.
Set values for my environment7 editable values
What was actually tested
A disposable Ubuntu24.04 container with no published host ports ran real distribution OpenVPN, auth-pam and google-authenticator PAM, temporary accounts, a private fixture CA and a TUN interface. The final recorded results below are bounded fixture evidence; no production account, firewall, route, service or credential was changed. OS release alternatives are documentation-reviewed.
22 recorded checks passed with OpenVPN 2.6.19, google-authenticator PAM 20191231 and Python 3.12.3: valid/wrong/empty TOTP, replay rejection, missing/loosely permissioned seed, expired account, rate limiting and single-use recovery. Real TLS/TUN establishment worked after daemon privilege drop; wrong OTP, mismatched certificate CN and a revoked certificate were denied. Revocation was confirmed by the explicit server rejection, not merely a client timeout. Application data between independent client/server namespaces and the alternative password+OTP stack were not tested.
The fixture is not acceptance of your GUI client, public internet/NAT path, time synchronization daemon, systemd boot/reboot, an HA service or backup restoration. Your actual CN issuance, revocation delivery, firewall authorization, recovery identity verification and renegotiation behavior remain pilot acceptance work. Personalizing the public examples does not run or validate your environment.
Move from one pilot to controlled enrollment
After positive and denial checks, enroll users individually with unique CN/account/seed mapping, monitor sanitized authentication failures, certificate/CRL expiry, disk and clock health, and rehearse lost-device response. Define permitted destinations before adding any route or forwarding rule. Use WireGuard guides for a different key-based site topology, not as a drop-in replacement for this PAM workflow.
GO TO THE SOURCE
Official references
Each environment states how it was reviewed. A documentation review does not claim a hands-on test of every version.
- OpenVPN2.6 configuration and authentication manual
- Packaged auth-pam split privilege and prompt mapping
- Google Authenticator PAM options and stacking
- Authenticator file state/replay format
- Ubuntu release and support cycle
- Debian release lifecycle
- Debian13 OpenVPN package
- NIST authenticator factors and assurance boundaries
KEEP LEARNING