OpenVPN 2.4 + Google Authenticator = authentication failure

Ubuntu 18.04 and higher use a more strict sandboxing config in systemd which interferes with google-authenticator.

Simply edit /lib/systemd/system/[email protected] and remove this line:

[Service]
...
ProtectHome=true

This is a newer feature of systemd that makes directories with 'user' content in them appear empty, for example /home, /root, and /run/user

It's generally a good idea to enable this as /home often contains SSH and GPG keys, but in this case it prevents OpenVPN from reading the .google-authenticator file in the users' home directory.

More info:

• https://www.redhat.com/sysadmin/mastering-systemd
• https://github.com/google/google-authenticator-libpam/issues/98