From b776003cf55e1035ac83186e44f72764e52e9e0d Mon Sep 17 00:00:00 2001
From: goodNETnick <pknet@ya.ru>
Date: Mon, 7 Feb 2022 02:04:28 -0500
Subject: ocserv: T4231: Added OTP support for Openconnect 2FA

---
 data/templates/ocserv/ocserv_config.tmpl  | 11 ++++++++++-
 data/templates/ocserv/ocserv_otp_usr.tmpl |  8 ++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)
 create mode 100644 data/templates/ocserv/ocserv_otp_usr.tmpl

(limited to 'data')

diff --git a/data/templates/ocserv/ocserv_config.tmpl b/data/templates/ocserv/ocserv_config.tmpl
index 0be805235..19045c4b4 100644
--- a/data/templates/ocserv/ocserv_config.tmpl
+++ b/data/templates/ocserv/ocserv_config.tmpl
@@ -8,6 +8,14 @@ run-as-group = daemon
 
 {% if "radius" in authentication.mode %}
 auth = "radius [config=/run/ocserv/radiusclient.conf]"
+{% elif "local" in authentication.mode %}
+{%   if authentication.mode.local == "password-otp" %}
+auth = "plain[passwd=/run/ocserv/ocpasswd,otp=/run/ocserv/users.oath]"
+{%   elif authentication.mode.local == "otp" %}
+auth = "plain[otp=/run/ocserv/users.oath]"
+{%   else %}
+auth = "plain[/run/ocserv/ocpasswd]"
+{%   endif %}
 {% else %}
 auth = "plain[/run/ocserv/ocpasswd]"
 {% endif %}
@@ -42,7 +50,8 @@ rekey-method = ssl
 try-mtu-discovery = true
 cisco-client-compat = true
 dtls-legacy = true
-
+max-ban-score = 80
+ban-reset-time = 300
 
 # The name to use for the tun device
 device = sslvpn
diff --git a/data/templates/ocserv/ocserv_otp_usr.tmpl b/data/templates/ocserv/ocserv_otp_usr.tmpl
new file mode 100644
index 000000000..db8893ae8
--- /dev/null
+++ b/data/templates/ocserv/ocserv_otp_usr.tmpl
@@ -0,0 +1,8 @@
+#<token_type> <username> <pin> <secret_hex_key> <counter> <lastpass> <time>
+{% if username is defined %}
+{%   for user, user_config in username.itmes() %}
+{%     if user_config.disable is not defined and user_config.otp is defined and user_config.otp is not none %}
+{{ user_config.otp.token_tmpl }} {{ user }} {{ user_config.otp.pin | default("-", true) }} {{ user_config.otp.key }}
+{%     endif %}
+{%   endfor %}
+{% endif %}
-- 
cgit v1.2.3