Skip to content
This repository has been archived by the owner on Jun 9, 2023. It is now read-only.


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time


Mozilla's take at duo_openvpn support. Duo's own duo_openvpn appears to be aging off. We rewrote it to use duo_client_python, as well as logging for operational security needs.

Git submodules

In order to checkout all the modules necessary for this to build, run

git clone --recursive
# Or, if already checked out:
git submodule update --init --recursive


  • Simple. Sort of.
  • Fail open (optional).
  • OTP and Push (use push as password for push, passcode:123456 as password for OTP, where 123456 is your OTP).
  • MozDef support.
  • Optional-username hack, in case you use emails as certificate CN but only the first part of the email as login.
  • Deferred call.


C plugin

Call it from openvpn configuration with:

plugin /usr/lib/openvpn/plugins/ /usr/lib/openvpn/plugins/

This allow making a deferred call for authentication while using a script instead of blocking OpenVPN. This is needed as otherwise Duo will block OpenVPN while waiting for a push reply or OTP input.