{"id":1844,"date":"2013-02-28T05:14:29","date_gmt":"2013-02-28T05:14:29","guid":{"rendered":"http:\/\/hyunsu.com\/wordpress\/?p=1844"},"modified":"2013-02-28T05:14:29","modified_gmt":"2013-02-28T05:14:29","slug":"openvpn-%ec%9d%b8%ec%a6%9d%eb%b0%a9%ec%8b%9d%ec%9d%84-otp%eb%a1%9c-%eb%b3%80%ea%b2%bd%ed%95%98%ea%b8%b0","status":"publish","type":"post","link":"https:\/\/hyunsu.com\/wordpress\/?p=1844","title":{"rendered":"openvpn \uc778\uc99d\ubc29\uc2dd\uc744 OTP\ub85c \ubcc0\uacbd\ud558\uae30"},"content":{"rendered":"
\n
\n
openvpn\uc5d0 \uc778\uc99d\ud560 \ub54c otp\ubc29\uc2dd\uc744 \uc0ac\uc6a9\ud574\ubcf4\uc790.<\/font><\/div>\n
\uc774\ubbf8 openvpn\uc744 \uc798 \uc6b4\uc601\ud558\uace0 \uc788\ub294 \uc0c1\ud0dc\uc5d0\uc11c \uc778\uc99d\ubd80\ubd84\ub9cc otp\ubc29\uc2dd\uc73c\ub85c \ubcc0\uacbd\ud55c\ub2e4\uace0 \uac00\uc815\ud55c\ub2e4.<\/font><\/div>\n
centos6.3 \uc5d0\uc11c \ud14c\uc2a4\ud2b8\ud588\ub2e4.<\/font><\/div>\n

<\/font><\/p>\n
otp\uc194\ub8e8\uc158\uc740 google-authenticator\ub97c \uc774\uc6a9\ud560 \uac83\uc774\ub2e4.<\/font><\/div>\n

<\/font><\/div>\n
https:\/\/code.google.com\/p\/google-authenticator\/<\/font><\/a><\/div>\n

<\/font><\/div>\n
google-authenticator\ub97c \ub2e4\uc6b4\ub85c\ub4dc \ubc1b\uc544\uc11c \ucef4\ud30c\uc77c\uc744 \ud558\uc790.<\/font><\/div>\n
\ucef4\ud30c\uc77c \ud560 \ub54c Makefile \uc5f4\uc5b4\uc11c \ucd5c\uc0c1\ub2e8\uc5d0 \uc544\ub798 \uad6c\ubb38\uc744 \ucd94\uac00\ud558\uc790.<\/font><\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n

<\/font><\/div>\n
\n\n\n\n
\n
1<\/font><\/div>\n<\/td>\n
\n
\n
LDFLAGS=\"-lpam\"<\/font><\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

<\/font><\/div>\n

<\/font><\/div>\n
openvpn\uc758 server.conf\uc744 \uc5f4\uc5b4\uc11c \uc778\uc99d \ud50c\ub7ec\uadf8\uc778\uc744 \ubd80\ubd84\uc744 \uc218\uc815\ud558\uc790.<\/font><\/div>\n

<\/font><\/div>\n
\n\n\n\n
\n
1<\/font><\/div>\n<\/td>\n
\n
\n
plugin \/usr\/local\/openvpn\/openvpn-auth-pam.so openvpn<\/b><\/font><\/font><\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

<\/font><\/div>\n
\uc778\uc99d\uc740 openvpn<\/b>\uc774\ub77c\ub294 \ub188\uc744 \uc0ac\uc6a9\ud558\ub3c4\ub85d \ud588\uc73c\ubbc0\ub85c \/etc\/pam.d\/openvpn<\/b> \ud30c\uc77c\uc744 \uc544\ub798\uc640 \uac19\uc774 \ub9cc\ub4e4\uc790.<\/font><\/div>\n

<\/font><\/div>\n
\n\n\n\n
\n
1<\/font><\/div>\n
2<\/font><\/div>\n
3<\/font><\/div>\n
4<\/font><\/div>\n
5<\/font><\/div>\n<\/td>\n
\n
\n
#%PAM-1.0<\/font><\/code><\/div>\n
auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so<\/font><\/code><\/div>\n
auth    required     pam_google_authenticator.so<\/font><\/code><\/div>\n
account    required     pam_nologin.so<\/font><\/code><\/div>\n
account    include      system-auth<\/font><\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

<\/font><\/div>\n

<\/font><\/div>\n

<\/font><\/div>\n
vpn\uc744 \uc811\uc18d\ud560 \uacc4\uc815\uc73c\ub85c \uc544\ub798 \uba85\ub839\uc744 \uc2e4\ud589\ud558\uc790.<\/font><\/div>\n

<\/font><\/div>\n
\n\n\n\n
\n
1<\/font><\/div>\n
2<\/font><\/div>\n<\/td>\n
\n
\n
root<\/code> # su - vpnuser<\/code><\/font><\/div>\n
[vpnuser@vpn ~]$ google-authenticator<\/font><\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

<\/font><\/div>\n

<\/font><\/div>\n
\uadf8\ub7ec\uba74 \uc774\ub807\uac8c \ub72c\ub2e4.<\/font><\/div>\n

<\/font><\/div>\n
\n\n\n\n
\n
1<\/font><\/div>\n
2<\/font><\/div>\n
3<\/font><\/div>\n
4<\/font><\/div>\n
5<\/font><\/div>\n
6<\/font><\/div>\n
7<\/font><\/div>\n
8<\/font><\/div>\n
9<\/font><\/div>\n
10<\/font><\/div>\n<\/td>\n
\n
\n
https:\/\/www.google.com\/chart?chs=200x200&chld=M<\/a>|0&cht=qr&chl=otpauth:\/\/totp\/vpnuser@vpn.hyunsu.com%3Fsecret%3DZUTR5Y3WEHRDMRDX<\/a><\/font><\/code><\/div>\n
Your new secret key is: ZUTR5Y3WEHRDMRDX<\/font><\/code><\/div>\n
Your verification code is 264476<\/font><\/code><\/div>\n
Your emergency scratch codes are:<\/font><\/code><\/div>\n
  <\/code>21748738<\/code><\/font><\/div>\n
  <\/code>88769415<\/code><\/font><\/div>\n
  <\/code>51651509<\/code><\/font><\/div>\n
  <\/code>95973574<\/code><\/font><\/div>\n
  <\/code>99309175<\/code><\/font><\/div>\n
Do you want me to update your \"~\/.google_authenticator\"<\/font><\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

<\/font><\/div>\n
URL\uc740 \uc6f9\ube0c\ub77c\uc6b0\uc800\uc5d0\uc11c \uc811\uc18d\ud558\uba74 QR\ucf54\ub4dc\uac00 \ub728\ub294\ub370 \ud074\ub77c\uc774\uc5b8\ud2b8\uc5d0\uc11c \uc811\uc18d\ud560 \ub54c \uc368\uba39\uc744 \uac83\uc774\ub2e4.<\/font><\/div>\n

<\/font><\/div>\n
\uadf8\ub9ac\uace0 \uc544\ub798\uc640 \uac19\uc774 \uc138\ubc88\uc758 \uc9c8\ubb38\uc774 \ub72c\ub2e4.<\/font><\/div>\n

<\/font><\/div>\n
\n\n\n\n
\n
1<\/font><\/div>\n
2<\/font><\/div>\n
3<\/font><\/div>\n<\/td>\n
\n
\n
Do you want to disallow multiple uses of the same authentication<\/font><\/code><\/div>\n
token? This restricts you to one login about every 30s, but it increases<\/font><\/code><\/div>\n
your chances to notice or even prevent man-in-the-middle attacks (y\/n)<\/font><\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

<\/font><\/div>\n
y\ub97c \uc120\ud0dd<\/font><\/div>\n

<\/font><\/div>\n

<\/font><\/div>\n
\n\n\n\n
\n
1<\/font><\/div>\n
2<\/font><\/div>\n
3<\/font><\/div>\n
4<\/font><\/div>\n
5<\/font><\/div>\n<\/td>\n
\n
\n
By default, tokens are good for 30 seconds and in order to compensate for<\/font><\/code><\/div>\n
possible time-skew between the client and the server, we allow an extra<\/font><\/code><\/div>\n
token before and after the current time. If you experience problems with poor<\/font><\/code><\/div>\n
time synchronization, you can increase the window from its default<\/font><\/code><\/div>\n
size of 1:30min to about 4min. Do you want to do so (y\/n)<\/font><\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n


\nn\ub97c \uc120\ud0dd<\/p>\n

<\/font><\/p>\n\n\n\n
\n
1<\/font><\/div>\n
2<\/font><\/div>\n
3<\/font><\/div>\n
4<\/font><\/div>\n<\/td>\n
\n
\n
If the computer that you are logging into isn't hardened against brute-force<\/font><\/code><\/div>\n
login attempts, you can enable rate-limiting for the authentication module.<\/font><\/code><\/div>\n
By default, this limits attackers to no more than 3 login attempts every 30s.<\/font><\/code><\/div>\n
Do you want to enable rate-limiting (y\/n)<\/font><\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

<\/font><\/div>\n
y\ub97c \uc120\ud0dd<\/font><\/div>\n

<\/font><\/div>\n

<\/font><\/div>\n
\uc11c\ubc84\ucabd \uc138\ud305\uc740 \ub05d\ub0ac\ub2e4.<\/font><\/div>\n
openvpn\uc744 (\uc7ac)\uc2dc\uc791\ud55c\ub2e4.<\/font><\/div>\n

<\/font><\/div>\n

<\/font><\/div>\n
\n
\n

<\/font><\/div>\n
\uc774\uc81c \uc544\uc774\ud3f0\uc740 \uc571\uc2a4\ud1a0\uc5b4\uc5d0\uc11c google Authenticator<\/b>\ub97c \ub2e4\uc6b4\ubc1b\uace0, \uc548\ub4dc\ub85c\uc774\ub4dc\ud3f0\uc5d0\uc11c\ub294 google OTP<\/b>\ub97c \ub2e4\uc6b4\ubc1b\uc790.<\/font><\/div>\n

<\/font><\/div>\n
\uc704\uc758 URL\uc5d0 \uc811\uc18d\ud558\uba74 QR\ucf54\ub4dc\uac00 \ub728\ub294\ub370 google Authenticator<\/b>\ub97c \uc2e4\ud589\ud574\uc11c QR\ucf54\ub4dc\ub97c \ucc0d\uc73c\uba74 \ub41c\ub2e4.<\/font><\/div>\n
\ud639\uc740 \uc9c1\uc811 \uc785\ub825\ud558\uba74 \ub418\ub294\ub370 \uacc4\uc815\uc740 vpnuser@vpn.hyunsu.com<\/a>, \ud0a4\ub294 ZUTR5Y3WEHRDMRDX \uc774\ub7f0\uc2dd\uc73c\ub85c \uc785\ub825\ud558\uba74 \ub41c\ub2e4.<\/span><\/font><\/div>\n

<\/font><\/span><\/div>\n
\uc774\uc81c \ud074\ub77c\uc774\uc5b8\ud2b8\uc5d0\uc11c openvpn\uc811\uc18d \ud560 \ub54c id\ub294 vpnuser, pw\ub294 otp\ud0a4 6\uc790\ub9ac\ub97c \uc0ac\uc6a9\ud558\uba74 \ub41c\ub2e4.<\/font><\/span><\/div>\n

<\/font><\/span><\/div>\n

<\/span><\/div>\n
<\/div>\n

<\/div>\n<\/div>\n


<\/font><\/div>\n

<\/div>\n","protected":false},"excerpt":{"rendered":"

openvpn\uc5d0 \uc778\uc99d\ud560 \ub54c otp\ubc29\uc2dd\uc744 \uc0ac\uc6a9\ud574\ubcf4\uc790. \uc774\ubbf8 openvpn\uc744 \uc798 \uc6b4\uc601\ud558\uace0 \uc788\ub294 \uc0c1\ud0dc\uc5d0\uc11c \uc778\uc99d\ubd80\ubd84\ub9cc otp\ubc29\uc2dd\uc73c\ub85c \ubcc0\uacbd\ud55c\ub2e4\uace0 \uac00\uc815\ud55c\ub2e4. centos6.3 \uc5d0\uc11c \ud14c\uc2a4\ud2b8\ud588\ub2e4. otp\uc194\ub8e8\uc158\uc740 google-authenticator\ub97c \uc774\uc6a9\ud560 \uac83\uc774\ub2e4. https:\/\/code.google.com\/p\/google-authenticator\/ google-authenticator\ub97c \ub2e4\uc6b4\ub85c\ub4dc \ubc1b\uc544\uc11c \ucef4\ud30c\uc77c\uc744 \ud558\uc790. \ucef4\ud30c\uc77c \ud560 \ub54c Makefile \uc5f4\uc5b4\uc11c \ucd5c\uc0c1\ub2e8\uc5d0 \uc544\ub798 \uad6c\ubb38\uc744 \ucd94\uac00\ud558\uc790. 1 LDFLAGS=”-lpam” openvpn\uc758 server.conf\uc744 \uc5f4\uc5b4\uc11c \uc778\uc99d \ud50c\ub7ec\uadf8\uc778\uc744 \ubd80\ubd84\uc744 \uc218\uc815\ud558\uc790. 1 plugin \/usr\/local\/openvpn\/openvpn-auth-pam.so openvpn \uc778\uc99d\uc740 openvpn\uc774\ub77c\ub294 \ub188\uc744 \uc0ac\uc6a9\ud558\ub3c4\ub85d \ud588\uc73c\ubbc0\ub85c […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1844","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/hyunsu.com\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/1844","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hyunsu.com\/wordpress\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hyunsu.com\/wordpress\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hyunsu.com\/wordpress\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hyunsu.com\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1844"}],"version-history":[{"count":0,"href":"https:\/\/hyunsu.com\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/1844\/revisions"}],"wp:attachment":[{"href":"https:\/\/hyunsu.com\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1844"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hyunsu.com\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1844"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hyunsu.com\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1844"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}