Yubico Forum

Hello,
I am trying to setup my YubiKeys to work with OpenVPN running on my pfSense Firewall , using the YubiRADIUS server to authenticate users against Active Directory.

And it works! Sort of… I have a test user that works perfectly. The problem is that I can’t seem to get any other users to work… well unless there name is test or test2 ect.

I currently have it so that the OTP is being added to the username since the virtual appliance manual mentioned this was able to get around the issue OpenVPN and some other VPN services have with user name length. But it seems this is also an issue with the username field

With user “testomgwhy”

The “VA configuration” error just started before it was just the OTP message

With user test



I have read that people have been able to get this to work by using Yubico-PAM in conjunction with freeradius to get the this situation to work. The problem is that the since I am using pfSense to host my OpenVPN server the complexity of this one off install is something that I don’t want to do / can’t do since no one else at my work could pull this off if I got hit by a bus tomorrow.

Is my only option to run a normal installation of OpenVPN + FreeRADIUS that uses Yubico-PAM and PAM_Radius?

Thanks for any help.

Hello,

It seems that you have configured the "Append to OTP" with password in "Global Configuration" and you are sending request/radtest the OTP with username. If you want to send the OTP with username please change the settings "Append to OTP" with username in "Global Configuration"

Go to “Global Configuration ”>> “General” >> select “Append OTP to” with “Username” and click on save.

Hope this helps! If you are still facing the same issue please send us the detailed screenshot of the error and logs to "support@yubico.com".

Thanks and best regards,
Samir.

I do have "Append OTP to Username" set in the golbal configuration. And this works fine when i am using a small name like Test, but anything longer then 5 characters and the username starts to to show up in the "YubiKey Public ID" field.

I guess will try and get as much information as i can and and send it to the support email.

Thanks

We are using this combination, but appending the OTP to passwords.

There was a problem with the max password length being too short in the OpenVPN GUI client (see http://sourceforge.net/tracker/index.ph ... id=1327094) - I wonder whether there is a similar restriction on the username in the client?

A built of OpenVPN GUI with that fix worked fine when we tried it, or there are other OpenVPN clients about (eg Viscosity, which is not free, but works well for us).

Steve.

!!!
IT WORKS!

After applying the patch from oct 1st to fix FreeRADIUS...
And pfSense's "OpenVPN Client Export Utility" has been upgraded to 0.25 and includes the OpenVPN 2.3 Beta Client.

It all works, and i have the OTP being appended to the password.

Thanks MrSteve for the heads up on this being a vpn client problem.

Since this is the only thread that comes up when searching for this error in google.

If you have a domain in YubiRadius, domain.com and a user logs in with username@another.com then you will get

Hello,

If you have a domain in YubiRadius as abc.com then a user from that domain have to log in with username@abc.com then only it will be authenticated.

If you are still facing the same issue please send us the detailed screenshot of the error and logs to "support@yubico.com".

Thanks and best regards,
Samir.