Google Authenticator

[id628_]

What would be the process for using Google Authenticator as my 2-factor?

http://code.google.com/p/google-authenticator/

[ITdept_]

Hi,

I remember reading that the project had a PAM (Pluggable Authentication Module). Haven't tried this myself, but you may achieve what you want by installing a Linux machine, configure the Google PAM and configure your realm to use secondary authentication.

Hopes this points you in the right direction. Curious to hear how you're getting on with this.

-Jochum

[RasKal_]

I am currently doing research on integrating google 2FA authenticator to SSL VPN.  First step is to setup a linux server and download google 2FA and configure this as secondary autthentication. Has anyone here tried doing the same approach? I will post the project status here so those who are on the same project can  comment and perhaps suggest best way on achiving the goal.

[Myk Sumera_]

Hi,

were you able to set up google authenticator as your 2fa?

[benedikt.wehr_]

Hi,

did have success with your project. I'm also searching for an option to get the sslvpn working with google authenticator.

would be nice if you'd reply.

Thanks!

Benedikt Wehr

[id628_]

We implemented Phonefactor instead.

[filbert_ · Accepted solution]

Did some testing with google authenticator and it seems to work fine with Pulse. I'm not sure how reliable it would be in a production environment. It does require a radius server be setup for auth and enrolling users isn't all that refined but there are some options available for this that I am looking into. There are also securty concerns with such a solution.

[dlagace_]

Just to add more meat to this answer I just got this going as well.  Here's what I did to setup Google auth as a secondary password on our SA4500.  I use AD credentials for the 1st factor.

Setup a server on Ubuntu 12.04 LTS with Freeradius

Best link I found was: Gauth w/ FreeRADIUS

One thing to be careful is to compile google-authenticator from source and make sure you link PAM to it.  Add this line to the Makefile above the line VERSION := 1.0

LDFLAGS="-lpam"

Once this is compiled and installed follow the instructions up to where the modification to /etc/pam.d/radiusd is:

Unless you also want to authenticate with local users from your server and the gauth code as an addition to the server password only put in the following:

auth requisite pam_google_authenticator.so

 Comment out everything else.

At this point you're almost ready to test, you'll have to create the same user that would authenticate to AD, on your local server and run google-authenticator on it then scan the resulting QR code into your phone with the Gauth app.

On the SA I added a new RADIUS Auth server put in the hostname or IP of your FreeRadius server with the shared secret you created.  I also clicked off 'Users authenticate using tokens or one-time passwords'.

I then created a realm called OTP

In the general tab, I setup the Authentication as my AD server and then checked off 'Additional authentication server'  

I chose my new RADIUS server from the drop-down

Username is: predefined as: <USERNAME> (you don't want your domain info going to RADIUS)

Password is: specified by user on sign-in page

As a last cosmetic change I went into the Default Sign in Page and checked off 'Prompt the secondary credentials on the second page' so that the user experience is the same from the old way of doing things and the user is only prompted for the OTP once succeeding through the initial AD authentication.

Hope this helps out a bit more.

--Dave

[chillipepper_]

Thanks dlagace for the inputs  followed the instructions and was able to set google auth as a dual factor auth to replace RSA , but i still couldnt get the second page to display token , it keeps prompting for "Secondary Password"  which is the token, is there something that needs to be changed on the IVE so as to replace the word password as token instead?