从shell命令使用Google身份验证OTP登录OpenVPN

pokxtpni  于 2023-06-24  发布在  Shell
关注(0)|答案(1)|浏览(895)

所以我写了一个脚本自动登录到OpenVPN连接,这需要usernamepassword,和Google Authenticator code.
下面是我目前得到的命令(从我提供的credential_file.txt文件中读取的用户名和密码)

sudo openvpn --config /client.ovpn --auth-user-pass /credential_file.txt

以下是credential_file.txt的内容

username
password

由于登录凭据也需要一次性的Google Authenticator OTP,因此使用上述命令登录肯定会失败。
连接日志

Fri Jan 14 14:33:20 2022 OpenVPN 2.3.10 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jan  9 2019
Fri Jan 14 14:33:20 2022 library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.08
Fri Jan 14 14:33:20 2022 WARNING: file '/credential_file.txt' is group or others accessible
Fri Jan 14 14:33:20 2022 Control Channel Authentication: tls-auth using INLINE static key file
Fri Jan 14 14:33:20 2022 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jan 14 14:33:20 2022 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jan 14 14:33:20 2022 Socket Buffers: R=[131072->200000] S=[16384->200000]
Fri Jan 14 14:33:20 2022 Attempting to establish TCP connection with [AF_INET]xx.xxx.xxx.xxx:443 [nonblock]
Fri Jan 14 14:33:21 2022 TCP connection established with [AF_INET]xx.xxx.xxx.xxx:443
Fri Jan 14 14:33:21 2022 TCPv4_CLIENT link local: [undef]
Fri Jan 14 14:33:21 2022 TCPv4_CLIENT link remote: [AF_INET]xx.xxx.xxx.xxx:443
Fri Jan 14 14:33:21 2022 TLS: Initial packet from [AF_INET]xx.xxx.xxx.xxx:443, sid=5c312627 2ca5dddd
Fri Jan 14 14:33:21 2022 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Fri Jan 14 14:33:21 2022 VERIFY OK: depth=1, CN=OpenVPN CA
Fri Jan 14 14:33:21 2022 VERIFY OK: nsCertType=SERVER
Fri Jan 14 14:33:21 2022 VERIFY OK: depth=0, CN=OpenVPN Server
Fri Jan 14 14:33:22 2022 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 14 14:33:22 2022 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jan 14 14:33:22 2022 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 14 14:33:22 2022 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jan 14 14:33:22 2022 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 xxxxx-xxx-xxxxx-xxx-xxxxx, 2048 bit RSA
Fri Jan 14 14:33:22 2022 [OpenVPN Server] Peer Connection Initiated with [AF_INET]xx.xxx.xxx.xxx:443
Fri Jan 14 14:33:24 2022 SENT CONTROL [OpenVPN Server]: 'PUSH_REQUEST' (status=1)
Fri Jan 14 14:33:24 2022 AUTH: Received control message: AUTH_FAILED,CRV1:R,E:nTsBKXl8QotPD+MvqjKoM9f9TII4SF8r:YW5kcm9pZF9jbGllbnQ=:Enter Google Authenticator Code
Fri Jan 14 14:33:24 2022 SIGTERM[soft,auth-failure] received, process exiting

有人能告诉我如何将我的一次性OTP(我已经用另一个Python脚本拥有了它,并准备作为变量传递给上面的命令)以某种方式传递给上面的登录命令吗?
这里有一个类似的/未回答的问题:https://security.stackexchange.com/questions/191517/openvpn-use-auth-user-pass-with-a-file-and-authenticator
谢谢

holgip5t

holgip5t1#

我们需要传入--auth-retry interact作为openvpn命令的附加选项,使其请求TOTP代码。
完整的命令如下所示

sudo openvpn \
    --config /client.ovpn \
    --auth-user-pass /credential_file.txt \
    --auth-retry interact

相关问题