OpenVPN enable MFA

[levkohimins]

A customer asked:

I created the duo account and the ami with --duo-version.
But I do not understand where put the variables:

duoIkey
duoSkey
duoHost 

r:terraform-aws-openvpn

Tracked in ticket #110453

[levkohimins]

These parameters are used by install-openvpn module to install the OpenVPN package and related template files onto a server.

sudo init-openvpn  \
...
 --duo-ikey "${duo_ikey}" \
 --duo-skey "${duo_skey}" \
 --duo-host "${duo_host}" \
...

The terraform-aws-openvpn contains out-of-the-box example.

---

The fastest way to deploy a test instance with duo MFA

1. Download openvpn-admin binary for AMI

GITHUB_OAUTH_TOKEN=<token> fetch \
	--repo="https://github.com/gruntwork-io/terraform-aws-openvpn" 
	--tag="v0.26.6" 
	--release-asset="openvpn-admin_linux_amd64"
	/tmp

2. Build an AMI (Amazon Machine Image)

packer build \
	-var aws_region=us-east-1 \
	-var openvpn_admin_binary=/tmp/openvpn-admin_linux_amd64 \
	-var active_git_branch=main \
	-var github_oauth_token=${GITHUB_OAUTH_TOKEN} \
	-only=ubuntu-20-build \
	./examples/packer/build.json

3. Create a DUO account (if it doesn't already exist), from there we need three values: Integration key, Secret key, API hostname. Create OpenVPN application, make sure that Duo Mobile passcodes is checked in the application policy.

4. Using terragrunt, deploy AWS infrastructure. Create terragrunt.hcl config and fill inputs with your values. After that, run terragrunt apply

terraform {
  source = "[email protected]:gruntwork-io/terraform-aws-openvpn.git//examples/openvpn-host-duo"
}

inputs = {
  aws_account_id = ""
  ami_id = ""
  aws_region = "us-east-1"
  backup_bucket_name = "openvpn-backups"
  keypair_name = ""

  duo_ikey = ""  # Integration key
  duo_skey = "" # Secret key
  duo_host = "" # API hostname.
}

6. Install openvpn-admin on your computer.

GITHUB_OAUTH_TOKEN=<token> gruntwork-install \
	--binary-name openvpn-admin \
	--repo https://github.com/gruntwork-io/terraform-aws-openvpn \
	--tag v0.26.6

7. Create OpenVPN accounts:
   openvpn-admin request --aws-region us-east-1 --username foo

8. To authenticate, pass passcode from DUO Mobile in the password prompt. Note that in order for 2FA to work, the certificate username (the value for --username when running openvpn-admin request) should exactly match the duo username.