2 files changed, 18 insertions, 1 deletions
diff --git a/data/templates/ocserv/ocserv_config.tmpl b/data/templates/ocserv/ocserv_config.tmpl
index 0be805235..19045c4b4 100644
--- a/data/templates/ocserv/ocserv_config.tmpl
+++ b/data/templates/ocserv/ocserv_config.tmpl
@@ -8,6 +8,14 @@ run-as-group = daemon
 
 {% if "radius" in authentication.mode %}
 auth = "radius [config=/run/ocserv/radiusclient.conf]"
+{% elif "local" in authentication.mode %}
+{%   if authentication.mode.local == "password-otp" %}
+auth = "plain[passwd=/run/ocserv/ocpasswd,otp=/run/ocserv/users.oath]"
+{%   elif authentication.mode.local == "otp" %}
+auth = "plain[otp=/run/ocserv/users.oath]"
+{%   else %}
+auth = "plain[/run/ocserv/ocpasswd]"
+{%   endif %}
 {% else %}
 auth = "plain[/run/ocserv/ocpasswd]"
 {% endif %}
@@ -42,7 +50,8 @@ rekey-method = ssl
 try-mtu-discovery = true
 cisco-client-compat = true
 dtls-legacy = true
-
+max-ban-score = 80
+ban-reset-time = 300
 
 # The name to use for the tun device
 device = sslvpn
diff --git a/data/templates/ocserv/ocserv_otp_usr.tmpl b/data/templates/ocserv/ocserv_otp_usr.tmpl
new file mode 100644
index 000000000..fea9af5d5
--- /dev/null
+++ b/data/templates/ocserv/ocserv_otp_usr.tmpl
@@ -0,0 +1,8 @@
+#<token_type> <username> <pin> <secret_hex_key> <counter> <lastpass> <time>
+{% if username is defined %}
+{%   for user, user_config in username.items() %}
+{%     if user_config.disable is not defined and user_config.otp is defined and user_config.otp is not none %}
+{{ user_config.otp.token_tmpl }} {{ user }} {{ user_config.otp.pin | default("-", true) }} {{ user_config.otp.key }}
+{%     endif %}
+{%   endfor %}
+{% endif %}