احراز هویت OpenVPN با گواهی و Google Authenticator

VM مستقل پایلوت؛ ترمینال خصوصی برای ثبت دستگاه

set -eu
cat /etc/os-release
test "$(ps -p 1 -o comm=)" = systemd
ip -br address
ip route show table all
sudo ss -lunp
getent passwd 'academyvpn' && exit 1 || test "$?" = 2
for path in '/srv/academy-openvpn-mfa' '/etc/pam.d/academy-mfa' '/etc/systemd/system/academy-mfa.service'; do
  test ! -e "$path" && test ! -L "$path"
done
ip link show 'tun-mfa' >/dev/null 2>&1 && exit 1 || test "$?" = 1
timedatectl status
timedatectl show -p NTPSynchronized --value

VM مستقل پایلوت؛ ترمینال خصوصی برای ثبت دستگاه

set -eu
. /etc/os-release
test "$VERSION_CODENAME" = 'bookworm'
sudo apt-get update
apt-cache policy openvpn libpam-google-authenticator python3
sudo apt-get install --no-install-recommends openvpn libpam-google-authenticator python3 openssl ca-certificates nano
openvpn --version | head -n 2
dpkg-query -W openvpn libpam-google-authenticator python3

VM مستقل پایلوت؛ ترمینال خصوصی برای ثبت دستگاه

sudo python3 - <<'PY'
import os, pathlib, pwd, subprocess
root=pathlib.Path('/srv/academy-openvpn-mfa')
assert root.is_absolute()
for p in [root, *root.parents]:
    assert not p.is_symlink(), 'Symlink path refused'
assert not root.exists(), 'Existing root refused'
for p in ['/etc/pam.d/academy-mfa','/etc/systemd/system/academy-mfa.service']:
    assert not os.path.lexists(p), 'Existing service refused'
try:
    pwd.getpwnam('academyvpn')
except KeyError:
    pass
else:
    raise SystemExit('Existing user refused')
root.mkdir(mode=0o755)
os.chmod(root,0o755)
for name,mode in [('pki',0o700),('users',0o755),('auth-tmp',0o700)]:
    (root/name).mkdir(mode=mode)
    os.chmod(root/name,mode)
subprocess.run(['useradd','--system','--user-group','--home-dir',str(root/'users/academyvpn'),'--create-home','--shell','/usr/sbin/nologin','academyvpn'],check=True)
u=pwd.getpwnam('academyvpn')
os.chmod(root/'users/academyvpn',0o700)
os.chown(root/'users/academyvpn',u.pw_uid,u.pw_gid)
n=pwd.getpwnam('nobody')
os.chown(root/'auth-tmp',n.pw_uid,n.pw_gid)
paths=[p for p in subprocess.check_output(['dpkg','-L','openvpn'],text=True).splitlines() if p.endswith('/openvpn-plugin-auth-pam.so') and pathlib.Path(p).is_file()]
targets={pathlib.Path(p).resolve() for p in paths}
assert len(targets)==1, 'Ambiguous/missing package plugin'
plugin=next(iter(targets))
assert plugin.stat().st_uid==0 and not plugin.stat().st_mode & 0o022
(root/'auth-pam.so').symlink_to(plugin)
print('Dedicated account/tree created; packaged plugin:',plugin)
PY

VM مستقل پایلوت؛ ترمینال خصوصی برای ثبت دستگاه

set -eu
sudo test ! -e '/srv/academy-openvpn-mfa/users/academyvpn/.google_authenticator'
sudo test ! -L '/srv/academy-openvpn-mfa/users/academyvpn/.google_authenticator'
sudo -H -u 'academyvpn' google-authenticator -t -d -w 3 -r 3 -R 30
sudo chmod 0600 '/srv/academy-openvpn-mfa/users/academyvpn/.google_authenticator'
sudo stat -c '%U %a %n' '/srv/academy-openvpn-mfa/users/academyvpn/.google_authenticator'