Arch Linux

billbrown

Member

From: Chicago, IL USA

Registered: 2011-03-11

Posts: 11

2fa (Duo) for openconnect (cisco anyconnect) VPN issue

Hello Arch users.

My employer recently updated their VPN to enforce 2fa authentication which broke my ability to connect to the campus VPN.  They utilize the DUO service for secondary authentication and I'm not sure if the issue is unique to this vendor.  Both the command line openconnect and the network-manager applet loop continuously with the login prompt.  Has anyone found a workaround through configuration other means to get it working?  I did send a chat to the openconnect IRC channel where they suggested that it already has 2fa support. I just don't know how to configure it.  Any help would be appreciated.

Bill

mikeyjoel

Member

Registered: 2021-10-22

Posts: 2

Re: 2fa (Duo) for openconnect (cisco anyconnect) VPN issue

Same here. We recently federated to Cisco Duo and openconnect used to work fine using stoken with RSA for auth but since we migrated to Cisco Duo for MFA and are getting rid of RSA there is no way now to connect via openconnect or Cisco Anyconnect using the latest build 4 of 4.10.03104.

I'll keep researching for a way to get the 2FA prompt in someway that powershell for example does when using Connect-AZConnect.

Last edited by mikeyjoel (2021-12-02 16:21:02)

progandy

Member

Registered: 2012-05-17

Posts: 5,321

Re: 2fa (Duo) for openconnect (cisco anyconnect) VPN issue

First, this thread is already more than 3 years old, please do not resurrect such an old thread, but create a new one.

These people seem to have some documentation:
https://kb.rice.edu/page.php?id=113148
https://blog.techotom.com/post/2017-09- … t-and-duo/

It looks like the second "password" prompt asks for your auth method (push / phone / sms)

duo themselves seem to propose appending that with a comma to the first password dialog if no second password is queried: https://guide.duo.com/anyconnect

Last edited by progandy (2021-12-02 16:38:18)

---

| alias CUTF='LANG=en_XX.UTF-8@POSIX ' | alias ENGLISH='LANG=C.UTF-8 ' |