Learn OpenVPN - Advanced Authentication: LDAP, RADIUS & MFA

#Introduction

Episode 5 completed the authentication layer with auth-user-pass and PAM-based verification. Episode 9 gave you per-client policy. Now the question: what if you have hundreds of users and their credentials are managed in a corporate directory?

Episode 10 covers advanced authentication. You will learn to connect OpenVPN to LDAP to pull credentials from a user directory, to RADIUS for centralized authentication, and to add MFA with OTP and TOTP as a second layer. These are the features that separate a personal lab from a real enterprise deployment.

Why does this matter? Because passwords alone are no longer sufficient. Password breaches happen every day, and MFA is the layer that prevents a compromised account from remaining a threat. Combined with directory integration, user management becomes centralized and easy to audit.

#LDAP Integration

#The PAM and LDAP Concept

The simplest way to verify credentials against LDAP is through PAM. The pam_ldap module makes SSH and OpenVPN logins use the same database:

plugin /usr/lib/openvpn/openvpn-auth-pam.so openvpn

The openvpn-auth-pam plugin forwards the username and password from auth-user-pass to a PAM service named openvpn. That PAM service can be mapped to LDAP, Kerberos, or a local database — depending on the /etc/pam.d/openvpn configuration.

#Dedicated LDAP Plugin

For finer-grained control, some distributions provide a dedicated LDAP plugin:

plugin /usr/lib/openvpn/openvpn-auth-ldap.so /etc/openvpn/auth/ldap.conf

The ldap.conf file contains the LDAP server address, the base DN for searches, and the user filter. This plugin gives full control over which attributes are used as the basis of verification.

#Verification Scripts for Advanced Policy

When a policy can't be expressed through plugins, write a verification script. The via-file and via-env modes from episode 5 are used again:

auth-user-pass-verify /etc/openvpn/check-ldap.sh via-env
script-security 2

The script can check group membership, account validity, or forward requests to an internal tool. This flexibility is what lets OpenVPN fit into any organization's authentication flow.

#RADIUS Integration

#The auth-radius Plugin

RADIUS is the industry standard for centralized authentication, used from enterprise Wi-Fi to ISPs. The openvpn-auth-radius plugin connects OpenVPN to a RADIUS server:

plugin /usr/lib/openvpn/openvpn-radius.so /etc/openvpn/radius/radius.cnf

The radius.cnf file contains the server address, the agreed secret, and the port. When a client sends a username and password, OpenVPN forwards an Access-Request to the RADIUS server and waits for Access-Accept.

#RADIUS Advantages

One advantage of RADIUS over plain PAM is dynamic authorization — policy can be revoked centrally without touching the VPN server. There are also RADIUS attributes that can be mapped to OpenVPN directives, for example to apply specific routes or bandwidth per user.

#auth-gen-token for Slow RADIUS

RADIUS servers are often far away, making every request feel slow. Episode 5 introduced auth-gen-token, and its combination with RADIUS is a perfect fit:

auth-gen-token 7200

auth-gen-token 7200 makes the server issue a 2-hour session token after the first successful RADIUS verification. Reconnects within the token's lifetime don't need to contact RADIUS again — a smoother user experience.

#Multi-Factor Authentication

#Adding the OTP Layer

MFA adds a second factor beyond the password. A common approach: verify the password first with PAM or RADIUS, then run a second verification for the TOTP code. OpenVPN supports this via an auth-user-pass-verify script that checks both:

auth-user-pass-verify /etc/openvpn/check-mfa.sh via-env
script-security 2

The check-mfa.sh script reads the password and TOTP code combined in a single username or password field, verifies both, then returns an exit code based on the result.

#TOTP with FreeOTP or Authenticator

TOTP codes are generated from a time-based secret. The secret is given to the user during onboarding, then configured in an authenticator app such as Google Authenticator, FreeOTP, or Aegis. The server computes the same code based on time to compare.

oathtool --totp --base32 --generate 10 user-secret

oathtool --totp --base32 --generate 10 user-secret generates the current TOTP code for a given secret — useful for testing and quickly verifying that the MFA configuration is correct.

#Choosing the Right Combination

• Personal lab: certificates are sufficient, MFA optional.
• Small company: LDAP for users, MFA for remote access.
• Large company: centralized RADIUS plus mandatory MFA for all remote workers.

#Conclusion

Key takeaways:

• auth-pam connects OpenVPN to PAM, which can be mapped to LDAP.
• A dedicated LDAP plugin gives finer attribute control.
• RADIUS provides centralized authentication and dynamic authorization.
• auth-gen-token reduces repeated requests to the authentication server.
• MFA adds a second factor in the form of an OTP or TOTP code.
• Combining LDAP or RADIUS with MFA is the enterprise deployment standard.

In the next episode, episode 11, we will discuss connection broker and scalability — limiting clients with --max-clients, controlling connection rate with --connect-freq and rate limiting, running multiple OpenVPN instances, and load balancing with learn-address and round-robin DNS. After this episode, your server is ready to serve hundreds of users.