Login OpenVPN with Google Authentication OTP from shell command

Question

So I'm writing a script to automatically log into OpenVPN connection, which requires username, password, and Google Authenticator code.

Here's the command I've got so far (username and password read from my provided credential_file.txt file)

sudo openvpn --config /client.ovpn --auth-user-pass /credential_file.txt

Here's the content of credential_file.txt

username
password

Since the login credentials requires one-time Google Authenticator OTP too, login will definitely failed with above command.

Connection log

Fri Jan 14 14:33:20 2022 OpenVPN 2.3.10 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jan  9 2019
Fri Jan 14 14:33:20 2022 library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.08
Fri Jan 14 14:33:20 2022 WARNING: file '/credential_file.txt' is group or others accessible
Fri Jan 14 14:33:20 2022 Control Channel Authentication: tls-auth using INLINE static key file
Fri Jan 14 14:33:20 2022 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jan 14 14:33:20 2022 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jan 14 14:33:20 2022 Socket Buffers: R=[131072->200000] S=[16384->200000]
Fri Jan 14 14:33:20 2022 Attempting to establish TCP connection with [AF_INET]xx.xxx.xxx.xxx:443 [nonblock]
Fri Jan 14 14:33:21 2022 TCP connection established with [AF_INET]xx.xxx.xxx.xxx:443
Fri Jan 14 14:33:21 2022 TCPv4_CLIENT link local: [undef]
Fri Jan 14 14:33:21 2022 TCPv4_CLIENT link remote: [AF_INET]xx.xxx.xxx.xxx:443
Fri Jan 14 14:33:21 2022 TLS: Initial packet from [AF_INET]xx.xxx.xxx.xxx:443, sid=5c312627 2ca5dddd
Fri Jan 14 14:33:21 2022 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Fri Jan 14 14:33:21 2022 VERIFY OK: depth=1, CN=OpenVPN CA
Fri Jan 14 14:33:21 2022 VERIFY OK: nsCertType=SERVER
Fri Jan 14 14:33:21 2022 VERIFY OK: depth=0, CN=OpenVPN Server
Fri Jan 14 14:33:22 2022 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 14 14:33:22 2022 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jan 14 14:33:22 2022 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 14 14:33:22 2022 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jan 14 14:33:22 2022 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 xxxxx-xxx-xxxxx-xxx-xxxxx, 2048 bit RSA
Fri Jan 14 14:33:22 2022 [OpenVPN Server] Peer Connection Initiated with [AF_INET]xx.xxx.xxx.xxx:443
Fri Jan 14 14:33:24 2022 SENT CONTROL [OpenVPN Server]: 'PUSH_REQUEST' (status=1)
Fri Jan 14 14:33:24 2022 AUTH: Received control message: AUTH_FAILED,CRV1:R,E:nTsBKXl8QotPD+MvqjKoM9f9TII4SF8r:YW5kcm9pZF9jbGllbnQ=:Enter Google Authenticator Code
Fri Jan 14 14:33:24 2022 SIGTERM[soft,auth-failure] received, process exiting

Can somebody tell me how I can pass my one-time OTP (Which I already have with another Python script, and ready to be passed to the above command as a variable) to the above login command somehow?

There's a similar/unanswered question here: https://security.stackexchange.com/questions/191517/openvpn-use-auth-user-pass-with-a-file-and-authenticator

Thanks

Answer 1

We need to pass in --auth-retry interact as additional option to openvpn command to make it request for the TOTP code.

The full command will look like

sudo openvpn \
    --config /client.ovpn \
    --auth-user-pass /credential_file.txt \
    --auth-retry interact