When a user connects, the following happens: Īfter presenting the number of curses that will fall on your head, in the case of using the default freeradius bundle with Google Authenticator, it was decided to use the pam module configuration so as to check only the Google Authenticator token. The default options for implementing the freeradius bundle with the google authenticator involve the user entering credentials in the format: username / password + OTP. In the nf file, write the parameters with which Fortigate will connect :Īuth sufficient pam_google_authenticator.so In the authenticate section of the same files, uncomment the pam. An important point - the name of the policy is determined not by the name of the file in the policy.d directory, but by the directive inside the file before the curly braces.

In the files raddb / sites-enabled / default and raddb / sites-enabled / inner-tunnel, in the authorize section, I add the name of the policy that will be used - group_authorization. If (&LDAP-Group = 'CN=vpn_admins,OU=vpn-groups,DC=domain,DC=local') ))' To do this, in the raddb / policy.d directory, create a file with the following contents: To be able to use groups in the Fortigate settings, you need to pass the Vendor Specific Attribute. In /etc/raddb/nf, only the user and group, under which freeradius starts, is changed, since the radiusd service must be able to read files in all subdirectories of / home /. The logic of work is as follows: when connecting to a VPN, a user must enter a domain login and OTP instead of a password. Shellinabox, figlet, freeeradius-ldap, rebel.tlf font from repository. Prerequisites: * nix host with freeradius installed, sssd - entered into the domain, domain users can easily authenticate on it. RSASecureID, Duo and the like have not been considered, because I want open source. Policy regarding its own tokens cannot be called less than redneck - there are already 10 free tokens, the rest are at a very non-kosher price. Saving the password for the VPN client is prohibited by security policy. This solution is not something super original, but rather a mix of different solutions found on the Internet.ĭomain users using a VPN, like many today. What if you want two-factor authentication and it hurts, but there is no money for hardware tokens, and in general they offer to stay in a good mood.

Fortinet vpn 2fa