43 lines
1.4 KiB
Plaintext
43 lines
1.4 KiB
Plaintext
; Duo Authentication Proxy — rendered from env vars at container start.
|
|
; Chain: OpenVPN (pam_radius) -> [radius_server_auto] -> [ad_client] LDAPS
|
|
; to AHDC01/AHDC03 over wg0, factor via Duo cloud (outbound 443).
|
|
|
|
[main]
|
|
log_stdout=true
|
|
debug=false
|
|
|
|
[ad_client]
|
|
host=${TROCH_DC1_IP}
|
|
host_2=${TROCH_DC2_IP}
|
|
service_account_username=${DUO_SVC_USER}
|
|
service_account_password=${DUO_SVC_PASSWORD}
|
|
search_dn=${AD_SEARCH_DN}
|
|
transport=ldaps
|
|
port=636
|
|
ssl_ca_certs_file=/certs/ad-ldaps-ca.pem
|
|
; We target the DCs by IP, so hostname verification can't match the cert
|
|
; SAN. The chain is still validated against your AD CA. To go strict:
|
|
; use DC FQDNs in host/host_2, point the VPS resolver at Unbound, and
|
|
; set this to true.
|
|
ssl_verify_hostname=false
|
|
; Restrict VPN access to one AD group (fill DUO_SECURITY_GROUP_DN in .env
|
|
; and uncomment):
|
|
;security_group_dn=${DUO_SECURITY_GROUP_DN}
|
|
|
|
[radius_server_auto]
|
|
ikey=${DUO_IKEY}
|
|
skey=${DUO_SKEY}
|
|
api_host=${DUO_API_HOST}
|
|
client=ad_client
|
|
; Only OpenVPN on this host may talk to us
|
|
interface=127.0.0.1
|
|
port=1812
|
|
radius_ip_1=127.0.0.1
|
|
radius_secret_1=${RADIUS_SECRET}
|
|
; Password-only = auto (push); "password,123456" appends a passcode —
|
|
; the fallback for connect-before-logon when the phone is offline.
|
|
allow_concat=true
|
|
; safe = allow password-only auth if Duo cloud is unreachable (Duo default).
|
|
; Set to "secure" to fail closed instead.
|
|
failmode=safe
|