How We Configure MFA for VPN Authentication (TOTP/RADIUS)

An employee lost a laptop with saved OpenVPN credentials. The corporate network was open to anyone with their certificate and password. This is what most VPN incidents look like—not a hack, but stolen credentials. A second factor—a TOTP code—completely closes this scenario: even with the password, an attacker cannot connect without the one-time code. We implement MFA for VPN using TOTP and a RADIUS server to protect your company's remote access. According to NIST, implementing multi-factor authentication reduces the risk of remote access compromise by 80%.

Time-based One-Time Password (TOTP) is an open standard (RFC 6238), compatible with any authenticator app: Google Authenticator, Authy, 1Password. Combined with RADIUS, you get a centralized authentication policy that works with any VPN server—from OpenVPN to Cisco AnyConnect. According to deployment statistics, TOTP reduces the risk of VPN compromise by 80% compared to password-only protection, and license cost savings reach 60%.

How MFA for VPN with TOTP and RADIUS Works

The standard flow: VPN client → VPN server (OpenVPN/WireGuard/Cisco) → RADIUS server → LDAP/AD for password check + TOTP for second factor.

FreeRADIUS is the most common choice for on-premise. It supports rlm_totp or integration via rlm_exec with an external validator. TOTP uses RFC 6238—compatible with any TOTP application.

# /etc/freeradius/3.0/mods-enabled/ldap (fragment)
ldap {
  server = "ldap.corp.example.com"
  identity = "cn=radius,ou=service,dc=corp,dc=example,dc=com"
  password = "..."
  base_dn = "ou=users,dc=corp,dc=example,dc=com"
  filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
  start_tls = yes
  tls {
    ca_file = /etc/ssl/certs/corp-ca.crt
  }
}

# /etc/freeradius/3.0/sites-enabled/default (fragment authorize)
authorize {
    filter_username
    ldap
    if (ok || updated) {
        update control {
            Auth-Type := LDAP
        }
    }
    totp
}

OpenVPN server side is configured with auth-user-pass-verify or via the radiusplugin.so plugin:

# /etc/openvpn/server.conf (fragment)
plugin /usr/lib/openvpn/radiusplugin.so /etc/openvpn/radiusplugin.cnf
verify-client-cert
require username-as-common-name

The user enters a password in the format password+TOTP-code (concatenation) during connection, or—if the client supports challenge-response—the password and OTP are entered in two separate fields via the RADIUS challenge-response flow.

Why TOTP, Not SMS or Push Notifications?

TOTP codes are generated locally on the device, require no internet, and do not depend on the mobile operator. Unlike SMS, TOTP cannot be intercepted via SIM-swap. Push notifications may be blocked if the phone is offline. TOTP always works, and the code lifetime is 30 seconds. TOTP is twice as secure as SMS in terms of prevented incidents, and implementation costs are 60% lower due to no SMS gateway costs. Proprietary MFA solutions require significant expenses, while our solution based on TOTP and FreeRADIUS saves your budget considerably.

How to Provision TOTP Secrets?

The process includes:

• Secret generation—a unique base32 key is created for each user (e.g., openssl rand -base64 20).
• Storage in LDAP—the secret is written to the user attribute, e.g., totpSecret. We use a secure LDAPS connection.
• QR code delivery—via a self-service portal or secure channel (corporate email).
• Confirmation—the user enters the first generated code, the system verifies and activates the secret.
• Backup codes—8–10 one-time codes are generated, hashed, and saved for login in case of phone loss.

#!/bin/bash for i in {1..10}; do openssl rand -hex 4 done 

What's Included in the Work

As part of the deployment, we provide:

• Audit of the current VPN infrastructure (protocols, versions, policies).
• Deployment of a FreeRADIUS cluster with database replication (PostgreSQL) and load balancing (keepalived/DNS round-robin).
• Integration with Active Directory or any LDAP server: synchronization of users, groups, TOTP attributes.
• Configuration of a self-service portal for independent TOTP binding (QR code issuance, backup codes).
• Bulk secret provisioning via scripts (Ansible automation, generation, instruction distribution).
• Administration documentation and recovery scenarios (runbook).
• User training and launch support.

Typical Mistakes and How to Avoid Them

• Storing TOTP secrets in plaintext—encryption or hashing is mandatory. In LDAP, use an attribute of type octet string and enable TLS.
• No backup codes—without them, a user loses access if they lose their phone. Always provide 8–10 recovery codes.
• Incorrect RADIUS client configuration—check IP addresses and shared secrets on the VPN server and in clients.conf.
• Ignoring server time—TOTP is time-bound; desynchronization of more than 30 seconds causes failures. Configure NTP on all RADIUS servers.

Comparison of MFA Methods for VPN

Deployment Timelines

Cost is calculated after an audit of your current VPN infrastructure and user count. Order a VPN infrastructure audit and learn how to implement MFA for your team. Get a consultation on implementation—contact us to assess your project.

NIST Special Publication 800-53 — MFA is a required measure for remote access.