mirror of
https://github.com/vincentmli/bpfire.git
synced 2026-04-19 23:43:00 +02:00
e1e10515ec
Add two-factor authentication (2FA) to OpenVPN host connections with one-time passwords. The 2FA can be enabled or disabled per host connection and requires the client to download it's configuration again after 2FA has beend enabled for it. Additionally the client needs to configure an TOTP application, like "Google Authenticator" which then provides the second factor. To faciliate this every connection with enabled 2FA gets an "show qrcode" button after the "show file" button in the host connection list to show the 2FA secret and an 2FA configuration QRCode. When 2FA is enabled, the client needs to provide the second factor plus the private key password (if set) to successfully authorize. This only supports time based one-time passwords, TOTP with 30s window and 6 digits, for now but we may update this in the future. Signed-off-by: Timo Eissler <timo.eissler@ipfire.org>
109 lines
4.2 KiB
Plaintext
109 lines
4.2 KiB
Plaintext
###############################################################################
|
|
# #
|
|
# IPFire.org - A linux based firewall #
|
|
# Copyright (C) 2007-2021 IPFire Team <info@ipfire.org> #
|
|
# #
|
|
# This program is free software: you can redistribute it and/or modify #
|
|
# it under the terms of the GNU General Public License as published by #
|
|
# the Free Software Foundation, either version 3 of the License, or #
|
|
# (at your option) any later version. #
|
|
# #
|
|
# This program is distributed in the hope that it will be useful, #
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of #
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
|
|
# GNU General Public License for more details. #
|
|
# #
|
|
# You should have received a copy of the GNU General Public License #
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>. #
|
|
# #
|
|
###############################################################################
|
|
|
|
###############################################################################
|
|
# Definitions
|
|
###############################################################################
|
|
|
|
include Config
|
|
|
|
VER = 2.5.6
|
|
|
|
THISAPP = openvpn-$(VER)
|
|
DL_FILE = $(THISAPP).tar.gz
|
|
DL_FROM = $(URL_IPFIRE)
|
|
DIR_APP = $(DIR_SRC)/$(THISAPP)
|
|
TARGET = $(DIR_INFO)/$(THISAPP)
|
|
|
|
###############################################################################
|
|
# Top-level Rules
|
|
###############################################################################
|
|
|
|
objects = $(DL_FILE)
|
|
|
|
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
|
|
|
|
$(DL_FILE)_BLAKE2 = d0466d2b95dae892606b6369d2c227add1de43fb708bf1c31a3ef78b28fc37382d501cc559767c8c8358ec28b88d3eb80a0eb915d7872ce30757c7080a37fde2
|
|
|
|
install : $(TARGET)
|
|
|
|
check : $(patsubst %,$(DIR_CHK)/%,$(objects))
|
|
|
|
download :$(patsubst %,$(DIR_DL)/%,$(objects))
|
|
|
|
b2 : $(subst %,%_BLAKE2,$(objects))
|
|
|
|
###############################################################################
|
|
# Downloading, checking, b2sum
|
|
###############################################################################
|
|
|
|
$(patsubst %,$(DIR_CHK)/%,$(objects)) :
|
|
@$(CHECK)
|
|
|
|
$(patsubst %,$(DIR_DL)/%,$(objects)) :
|
|
@$(LOAD)
|
|
|
|
$(subst %,%_BLAKE2,$(objects)) :
|
|
@$(B2SUM)
|
|
|
|
###############################################################################
|
|
# Installation Details
|
|
###############################################################################
|
|
|
|
$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
|
|
@$(PREBUILD)
|
|
@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
|
|
cd $(DIR_APP) && ./configure \
|
|
--prefix=/usr \
|
|
--sysconfdir=/var/ipfire/ovpn \
|
|
--enable-iproute2 \
|
|
--enable-plugins \
|
|
--enable-plugin-auth-pam \
|
|
--enable-plugin-down-root
|
|
|
|
cd $(DIR_APP) && make $(MAKETUNING)
|
|
cd $(DIR_APP) && make install
|
|
cd $(DIR_APP) && cp -Rvf $(DIR_SRC)/config/ovpn /var/ipfire
|
|
-mkdir -vp /usr/lib/openvpn/plugins
|
|
-mkdir -vp /var/log/openvpn
|
|
-mkdir -vp /var/ipfire/ovpn/ca
|
|
-mkdir -vp /var/ipfire/ovpn/ccd
|
|
-mkdir -vp /var/ipfire/ovpn/crls
|
|
-mkdir -vp /var/ipfire/ovpn/n2nconf
|
|
-mkdir -vp /var/ipfire/ovpn/scripts
|
|
touch /var/ipfire/ovpn/ovpn-leases.db
|
|
chmod 600 /var/ipfire/ovpn/ovpn-leases.db
|
|
chown -R root:root /var/ipfire/ovpn/scripts
|
|
chown -R nobody:nobody /var/ipfire/ovpn
|
|
chmod 700 /var/ipfire/ovpn/certs
|
|
mv -v /var/ipfire/ovpn/verify /usr/lib/openvpn/verify
|
|
chown root:root /usr/lib/openvpn/verify
|
|
chmod 755 /usr/lib/openvpn/verify
|
|
mv -v /var/ipfire/ovpn/otp-verify /usr/lib/openvpn/otp-verify
|
|
chown root:root /usr/lib/openvpn/otp-verify
|
|
chmod 755 /usr/lib/openvpn/otp-verify
|
|
# Add crl updater
|
|
mv -v /var/ipfire/ovpn/openvpn-crl-updater /etc/fcron.daily
|
|
chown root:root /etc/fcron.daily/openvpn-crl-updater
|
|
chmod 750 /etc/fcron.daily/openvpn-crl-updater
|
|
|
|
@rm -rf $(DIR_APP)
|
|
@$(POSTBUILD)
|