MFA for OpenConnect (ocserv)
OpenConnect server (ocserv) is the open-source VPN server that speaks the AnyConnect protocol, so users connect with the OpenConnect client or a compatible AnyConnect client. ocserv can check logins against RADIUS through radcli, but it has no second factor of its own. Authnull becomes the RADIUS server ocserv uses and requires MFA on every VPN login. You point radcli at Authnull, switch ocserv to RADIUS authentication, and users must approve a push or enter a code before the tunnel comes up.
OpenConnect (ocserv) forwards the login; Authnull adds the factor.
ocserv sends the login to Authnull over RADIUS through radcli. Authnull checks the password against your directory, asks for the factor, and returns Access-Accept. Raise the radcli timeout so users have time to approve.
Configure MFA for OpenConnect (ocserv)
Real steps — the exact menus, fields, and values. Follow along in your console; the whole thing takes about 20 minutes.
Point radcli at Authnull
In the radcli client config, set the Authnull connector as the auth and accounting server and raise the timeout.
Add the shared secret
Add the Authnull connector and the shared secret from the Authnull console to the radcli servers file.
Switch ocserv to RADIUS
Set ocserv to authenticate through RADIUS, and optionally send accounting records.
Restart and test
Restart ocserv, then connect with the OpenConnect client using a test account. Expect a password prompt, then an MFA challenge. Approving it brings the tunnel up.
Closes the MFA gap auditors look for
Enforcing MFA on OpenConnect (ocserv) gives you evidence for the remote-access and privileged-access controls in SOC 2 and the access requirements under CCPA — with per-login logs you can hand straight to an assessor.
Add MFA to OpenConnect (ocserv) — free to start.
Spin up Authnull, point OpenConnect (ocserv) at it, and enforce a factor on a pilot group today. No card, no rip-and-replace.