How to Add RFC 6238 Suffix to Client Passwords in pfSense OpenVPN Server

In this article, we will guide you through the process of adding an RFC 6238 suffix to client passwords in pfSense OpenVPN Server. This is a useful security measure that can help protect your network by adding an extra layer of complexity to your VPN passwords. By the end of this article, you should have a good understanding of how to implement this feature, even if you are new to pfSense and OpenVPN.

What is RFC 6238?

RFC 6238 is a standard for generating time-based one-time passwords (TOTPs). It is often used in two-factor authentication (2FA) systems, where a user must provide both a password and a time-based one-time password to gain access to a system. The TOTP is generated using a shared secret key and the current time, and is only valid for a short period of time (typically 30 seconds). This makes it much more difficult for an attacker to gain access to a system, even if they have obtained the user's password.

Why Add an RFC 6238 Suffix to Client Passwords?

Adding an RFC 6238 suffix to client passwords can provide an extra layer of security for your OpenVPN server. By requiring clients to provide both a password and a time-based one-time password, you can make it much more difficult for an attacker to gain access to your network. Even if an attacker obtains a client's password, they will still need to generate a valid time-based one-time password in order to gain access to the network. This can help protect your network from unauthorized access, and can provide an extra layer of security for your users.

How to Add an RFC 6238 Suffix to Client Passwords in pfSense OpenVPN Server

Adding an RFC 6238 suffix to client passwords in pfSense OpenVPN Server is a relatively straightforward process. Here are the steps you need to follow:

1. First, you will need to generate a shared secret key for each client. This key will be used to generate the time-based one-time passwords. You can generate these keys using a tool like the Google Authenticator app, or by using a command line tool like oathtool.

2. Next, you will need to configure your OpenVPN server to require time-based one-time passwords. To do this, go to the OpenVPN server settings page in pfSense, and select the Authentication tab. From here, you can enable the Use time-based one-time passwords (TOTP) option, and enter the shared secret key for each client.

3. Once you have enabled time-based one-time passwords, you will need to modify your OpenVPN client configuration files to include the RFC 6238 suffix. To do this, you can add the following line to your client configuration file:

   auth-user-pass-verify /path/to/totp-script.sh via-file
   

   This line tells the OpenVPN client to use a script to generate the time-based one-time password, and to pass the result to the OpenVPN server using the via-file option. The script should generate the time-based one-time password using the shared secret key for the client, and should return the result in the following format:

   username:totp
   

   For example, if the client's username is jdoe and the time-based one-time password is 123456, the script should return the following:

   jdoe:123456
   

4. Finally, you will need to create the totp-script.sh script, and make sure it is executable. This script should use the oathtool command to generate the time-based one-time password, and should return the result in the format described above. Here is an example script that you can use as a starting point:

   #!/bin/bash
   
   # Get the client's shared secret key
   SECRET=$(cat /path/to/client/secret.key)
   
   # Generate the time-based one-time password
   TOTP=$(oathtool --totp --base32 "$SECRET")
   
   # Return the username and time-based one-time password
   echo "$1:$TOTP"
   

   Make sure to replace the paths to the client's secret key and the script itself in the auth-user-pass-verify line and in the script itself.

Once you have completed these steps, your pfSense OpenVPN server should be configured to require time-based one-time passwords, and your clients should be configured to provide them. This can help protect your network from unauthorized access, and can provide an extra layer of security for your users.

Adding an RFC 6238 suffix to client passwords in pfSense OpenVPN Server is a useful security measure that can help protect your network by adding an extra layer of complexity to your VPN passwords. By following the steps outlined in this article, you should be able to implement this feature quickly and easily, even if you are new to pfSense and OpenVPN. So why not give it a try, and see how it can help improve the security of your network?

References