Disable 2FA for one user

[Cieptak]

hello, can I disable 2FA for one user? I have one Synology server that doesn't support this feature? As far as I know, 2FA is a global setting - it's either everyone or no one.

[d3vilh]

Hi @Cieptak
Yes, this settings is global for the openvpn server instance.
But there is workaround, to run additional set of containers (openvpn-ui and openvpn-server) in parallel with different options.

Something like this:

kashenko@hospital:~/build/openvpn-server-2fa $ docker ps
CONTAINER ID   IMAGE                          PORTS                    NAMES
1d47e182625d   d3vilh/openvpn-server:latest   0.0.0.0:1195->1194/udp   openvpn-2fa
d822aed4b1cd   d3vilh/openvpn-ui:latest       0.0.0.0:8081->8080/tcp   openvpn-ui-2fa
cdcc47e4d7ea   d3vilh/openvpn-server:latest   0.0.0.0:1194->1194/udp   openvpn
572b4c4cd071   d3vilh/openvpn-ui:latest       0.0.0.0:8080->8080/tcp   openvpn-ui
kashenko@hospital:~/build/openvpn-server-2fa $

Here we have additional openvpn-2fa and openvpn-ui-2fa running in tandem on different external ports (1195 && 8081) and having 2FA enabled, while other tandem openvpn and openvpn-ui using default ports and don't have 2FA enabled.

You just need to clone repo in different directory (pay attention to last command part, it is destination directory name):

git clone https://github.com/d3vilh/openvpn-server openvpn-server-2fa

and apply modified docker-compose.yml inside this new directory (openvpn-server-2fa):

---
version: "3.5"

services:
    openvpn-2fa:
       container_name: openvpn-2fa
       # If you want to build your own image with docker-compose, uncomment the next line, comment the "image:" line and run "docker-compose build" following by "docker-compose up -d"
       # build: .
       image: d3vilh/openvpn-server:latest
       privileged: true
       ports:
          - "1195:1194/udp"   # openvpn UDP port
         # - "1194:1194/tcp"   # openvpn TCP port
         # - "2080:2080/tcp"  # management port. uncomment if you would like to share it with the host
       environment:
           TRUST_SUB: "10.0.70.0/24"
           GUEST_SUB: "10.0.71.0/24"
           HOME_SUB: "192.168.88.0/24"
       volumes:
           - ./pki:/etc/openvpn/pki
           - ./clients:/etc/openvpn/clients
           - ./config:/etc/openvpn/config
           - ./staticclients:/etc/openvpn/staticclients
           - ./log:/var/log/openvpn
           - ./fw-rules.sh:/opt/app/fw-rules.sh
           - ./checkpsw.sh:/opt/app/checkpsw.sh
           - ./server.conf:/etc/openvpn/server.conf
       cap_add:
           - NET_ADMIN
       restart: always
       depends_on:
           - "openvpn-ui-2fa"

    openvpn-ui-2fa:
       container_name: openvpn-ui-2fa
       image: d3vilh/openvpn-ui:latest
       environment:
           - OPENVPN_ADMIN_USERNAME=admin
           - OPENVPN_ADMIN_PASSWORD=gagaZush
       privileged: true
       ports:
           - "8081:8080/tcp"
       volumes:
           - ./:/etc/openvpn
           - ./db:/opt/openvpn-ui/db
           - ./pki:/usr/share/easy-rsa/pki
           - /var/run/docker.sock:/var/run/docker.sock:ro
       restart: always

then run containers as usual docker-compose up -d

Please note, this will be completely different OpenVPN server instance connected to different OpenVPN-UI instance.