#authentication solution

New Post has been published on http://mocco.sk/securing-ssh-on-ubuntu-precise-with-wikid-two-factor-authentication/

Securing SSH On Ubuntu Precise With WiKID Two-Factor Authentication

SSH offers a highly secure channel for remote administration of servers. However, if you face an audit for regulatory or business requirements, such as Visa/Mastercard PCI, you need to be aware of some potential authentication related short-comings that may cause headaches in an audit. For example:

There is no way to control which users have public key authorization

There is no way to enforce passphrase complexity (or even be sure that one is being used)

There is no way to expire a public key

Additionally, SSH keys work great, but not for other services. We recently showed you how to add two-factor authentication to Apache . Using Radius for SSH means that we are getting closer to using a single, standard authentication protocol for your organization. As we will see in future tutorials, this standardization makes identity management much easier and more secure.

In this document we are going to demonstrate how to combine two-factor authentication from WiKID on Ubuntu. The WiKID Strong Authentication System is a commercial/open source two-factor authentication solution. First, we will configure a domain on the WiKID server, then add the targeted server as a network client to the WiKID server, and finally configure the Ubuntu Precise box via pam-radius. This document will also serve as the basis for additional tutorials because many services on Linux use PAM for authentication.

The WiKID Strong Authentication server is available for Ubuntu. Please see the installation instructions for the .deb package and the complete installation manual.  We assume your server is up and running and you are ready to implement two-factor authentication in your environment.

Adding A Domain To The WiKID Server

Create A Network Client

After saving the domain information, click on the Network Client tab and Create New Network Client. Enter a name for this client and the IP Address of the SSH gateway on the internal network. Select Radius as the protocol and the domain you created above as the domain.

Click Add to get the next page and enter the shared secret for Radius.

You will need to repeat this process for each server on your network.

Configure SSH On Your Ubuntu Box

Now we will configure SSH on the target machine. Each flavor of linux handles PAM slightly differently.  This tutorial covers how to install pam-radius for two-factor authentication on Ubuntu. For instructions on how to install pam-radius on Redhat flavors, see this page.

First, install the package:

$ sudo apt-get install libpam-radius-auth

That was pretty painless. Now let’s configure it.  First, let’s tell pam_radius which radius server to talk to:

$ sudo vim /etc/pam_radius_auth.conf

Note that the file says to copy it to /etc/raddb/server, but DO NOT do that. 

Edit the line “other-server; other-secret 3″; replacing ‘other-server’ with IP address or hostname of your WiKID Strong Authentication server (or radius server if you have one set up in between WiKID and your servers) and change ‘other-secret’ the shared secret for this network client.

Now that the package is setup and pointing to your WiKID server, let’s configure a service to use it. 

Edit your /etc/pam.d/sshd file

$ sudo vim /etc/pam.d/sshd

And add the line:

auth       sufficient  pam_radius_auth.so

Just above:

# Standard Un*x authentication. @include common-auth

Now, you are ready to test. I recommend you run ‘tail -f /var/log/auth.log’ while you test.

Note that we have not made any changes to the account setup, so the user is expected to have a local account on the machine or you can configure account to use pam_ldap and point it to your AD/LDAP server.

Remote SSH is now extremely secure. No user can get access to the server without first getting a one-time passcode from the WiKID server. The two-factors of authentication are possession of the WiKID token (and it’s cryptographic key embedded in the token) and knowledge of the PIN. Because the PIN is validated on the WiKID server, it is very easy to disable a user. Everything is logged and any auditor should be very pleased.

Additionally, you could require a WiKID one-time passcode for root access on internal machines. Just create create a new domain for su and edit /etc/pam.d/su appropriately. This will also allow you to break the servers into different groups for management. Just create For example, if you have a set of servers for HR to which only certain admins have root access, they can be configured for a specific WiKID domain – allowing fine grained access control and strong authentication. Get more information on two-factor authentication from WiKID website.

New Post has been published on http://mocco.sk/methods-to-run-linotp-on-opensuse-12-3-with-postgresql/

Methods to Run LinOTP On OpenSuSE 12.3 With PostgreSQL

This describes the installation of LinOTP on OpenSUSE 12.3 using PostgreSQL as a token database. LinOTP is a two factor authentication solution with One Time Passwords. In the following Howto we are showing how to enable SSH authentication with LinOTP.

Getting prepared

We need to install the following packages:

zypper install python-virtualenv zypper install gcc zypper install python-devel zypper install zlib-devel

Setting up postgresql

LinOTP uses a database to store the token information. You can use any database on another server, you can use an existing database or you can install a database on the very same machine. In this example we are using  PostgreSQL on the same machine.

So we install the necessary packages:

zypper install postgresql postgresql-server zypper install postgresql-devel

linux-6a8c:/opt/LINOTP # su – postgres postgres@linux-6a8c:~> initdb -D /var/lib/pgsql/data/

The database cluster will be initialized with locale “en_US.UTF-8″. The default database encoding has accordingly been set to “UTF8″. The default text search configuration will be set to “english”. creating directory /var/lib/pgsql/data … ok creating subdirectories … ok selecting default max_connections … 100 selecting default shared_buffers … 24MB creating configuration files … ok creating template1 database in /var/lib/pgsql/data/base/1 … ok initializing pg_authid … ok initializing dependencies … ok creating system views … ok loading system objects’ descriptions … ok creating collations … ok creating conversions … ok creating dictionaries … ok setting privileges on built-in objects … ok creating information schema … ok loading PL/pgSQL server-side language … ok vacuuming database template1 … ok copying template1 to template0 … ok copying template1 to postgres … ok WARNING: enabling “trust” authentication for local connections You can change this by editing pg_hba.conf or using the option -A, or –auth-local and –auth-host, the next time you run initdb. Success. You can now start the database server using: postgres -D /var/lib/pgsql/data or pg_ctl -D /var/lib/pgsql/data -l logfile start

postgres@linux-6a8c:~> pg_ctl -D /var/lib/pgsql/data -l pglog.log start

Now, create a postgres user, create the database and grant access to this database:

postgres@linux-6a8c:~> createuser -P linotp2

postgres=# CREATE DATABASE LinOTP2;

CREATE DATABASE

postgres=# GRANT ALL ON DATABASE LinOTP2 TO linotp2;

GRANT

Setting up linotp

We are setting up LinOTP using a virtual python environment. This is also described here:

linux-6a8c:~ # mkdir /opt/LINOTP

linux-6a8c:~ # cd /opt/

linux-6a8c:/opt # virtualenv /opt/LINOTP/

linux-6a8c:/opt # cd LINOTP/

linux-6a8c:/opt/LINOTP # source bin/activate

(LINOTP)linux-6a8c:/opt/LINOTP

The changed prompt (LINOTP) indicates, that you are now in the python virtual environment.

Now you can install linotp from PyPI. All dependencies are also installed.

(LINOTP)linux-6a8c:/opt/LINOTP # pip install linotp linotpuseridresolver pil configobj psycopg2

Create necessary directories and config file:

(LINOTP)linux-6a8c:/opt/LINOTP # mkdir /var/log/linotp

(LINOTP)linux-6a8c:/opt/LINOTP # cp etc/linotp2/linotp.ini.example etc/linotp2/linotp.ini

Start postgres and make it start at boot time:

(LINOTP)linux-6a8c:/opt/LINOTP # service postgresql start

(LINOTP)linux-6a8c:/opt/LINOTP # chkconfig postgresql on

Create a local postgres user:

useradd -r linotp2

Now you need to edit the linotp.ini configuration file and adapt the following line:

sqlalchemy.url = postgresql+psycopg2://linotp2:test123!@localhost/linotp2

Please note: PostgreSQL uses small characters for the database name!

Now you need to create the encryption key:

(LINOTP)linux-6a8c:/opt/LINOTP # dd if=/dev/urandom of=etc/linotp2/encKey bs=1 count=96

Then create the database tables:

(LINOTP)linux-6a8c:/opt/LINOTP # paster setup-app etc/linotp2/linotp.ini Running setup_app() from linotp.websetup

Now you can test your server:

(LINOTP)linux-6a8c:/opt/LINOTP # paster serve etc/linotp2/linotp.ini Starting server in PID 12355. serving on 0.0.0.0:5001 view at http://127.0.0.1:5001

Now you can point your browser to http://127.0.01:5001/manage and start to configure your LinOTP-Server, create a new useridresolver, a realm and enroll tokens for the users.

See the how to do the first steps at linotp.org.

Configuring Apache

You might want to run LinOTP within Apache or any other web server, that supports wsgi. Thus you get authentication and encryption.

First we need to install some packages and activate modules:

zypper install apache2 apache2-mod_wsgi a2enmod wsgi a2enmod ssl

chkconfig apache2 on service apache2 start

Open the https port in the firewall and restart the firewall:

SuSEfirewall2 open EXT TCP https SuSEfirewall2 SuSEfirewall2: Setting up rules from /etc/sysconfig/SuSEfirewall2 … SuSEfirewall2: Firewall rules successfully set

Certificate

Create a self signed certificate:

cp etc/apache2/sites-available/linotp2 /etc/apache2/vhosts.d/linotp.conf openssl genrsa -out /etc/ssl/private/linotpserver.key 2048 chmod 400 /etc/ssl/private/linotpserver.key openssl req -x509 -new -key /etc/ssl/private/linotpserver.key -out /etc/ssl/certs/linotpserver.pem

Config

Now edit your /etc/apache2/vhosts.d/linotp.conf:

 WSGIPythonHome /opt/LINOTP <VirtualHost _default_:443>         ServerAdmin webmaster@localhost         ServerName linux-6a8c.az.local

        DocumentRoot /var/www         <Directory />                 Options FollowSymLinks                 AllowOverride None         </Directory>         <Directory /var/www/>                 Options Indexes FollowSymLinks MultiViews                 AllowOverride None                 Order allow,deny                 allow from all         </Directory>

        <Directory /opt/LINOTP/etc/linotp2/>           Order allow,deny           Allow from all         </Directory>

        WSGIScriptAlias /       /opt/LINOTP/etc/linotp2/linotpapp.wsgi         #         # The daemon is running as user 'linotp'         # This user should have access to the encKey database encryption file         WSGIDaemonProcess linotp processes=1 threads=15 display-name=%{GROUP} user=linotp         WSGIProcessGroup linotp         WSGIPassAuthorization On

        <Location /admin>                 AuthType Digest                 AuthName "LinOTP2 admin area"                 AuthDigestProvider file                 AuthUserFile /opt/LINOTP/etc/linotp2/admins                 Require valid-user         </Location>

        <Location /audit>                 AuthType Digest                 AuthName "LinOTP2 admin area"                 AuthDigestProvider file                 AuthUserFile /opt/LINOTP/etc/linotp2/admins                 Require valid-user         </Location>

        <Location /gettoken>                 AuthType Digest                 AuthName "LinOTP2 gettoken"                 AuthDigestProvider file                 AuthUserFile /opt/LINOTP/etc/linotp2/gettoken-api                 Require valuid-user         </Location>

        <Location /mlogout>                 AuthType Digest                 AuthName "LinOTP2 admin area"                 AuthDigestProvider file                 AuthUserFile /etc/linotp2/admins                 AuthDigestProvider file                 AuthUserFile /etc/linotp2/admins                 Require user EXIT         </Location>

        <Location /manage>                 AuthType Digest                 AuthName "LinOTP2 admin area"                 AuthDigestProvider file                 AuthUserFile /opt/LINOTP/etc/linotp2/admins                 Require valid-user         </Location>

        <Location /selfservice>                 # THe authentication for selfservice is done from within the application         </Location>

        <Location /system>                 AuthType Digest                 AuthName "LinOTP2 admin area"                 AuthDigestProvider file                 AuthUserFile /opt/LINOTP/etc/linotp2/admins                 Require valid-user         </Location>

        <Location /license>                 # This should have at least the same access rights like /system                AuthType Digest                AuthName "LinOTP2 admin area"                AuthDigestProvider file                AuthUserFile /opt/LINOTP/etc/linotp2/admins                Require valid-user         </Location>

        <Location /validate>         # No Authentication         </Location>

        LogLevel info         ErrorLog /var/log/apache2/error_log

        # Do not use %q! This will reveal all parameters, including setting PINs and Keys!         # Using SSL_CLINET_S_DN_CN will show you, which administrator did what task         LogFormat "%h %l %u %t %>s \"%m %U %H\"  %b \"%{Referer}i\" \"%{User-agent}i\" \"%{SSL_CLIENT_S_DN_CN}x\"" LinOTP2         CustomLog /var/log/apache2/ssl_access.log LinOTP2

        #   SSL Engine Switch:         #   Enable/Disable SSL for this virtual host.         SSLEngine on

        #   If both key and certificate are stored in the same file, only the         #   SSLCertificateFile directive is needed.         SSLCertificateFile    /etc/apache2/ssl.crt/server.crt         SSLCertificateKeyFile /etc/apache2/ssl.key/server.key

        <FilesMatch "\.(cgi|shtml|phtml|php)$">                 SSLOptions +StdEnvVars         </FilesMatch>         <Directory /usr/lib/cgi-bin>                 SSLOptions +StdEnvVars         </Directory>         BrowserMatch ".*MSIE.*" \                 nokeepalive ssl-unclean-shutdown \                 downgrade-1.0 force-response-1.0

        ErrorDocument 500 "<h1>Internal Server Error</h1> Possible reasons can be missing modules or bad access rights on LinOTP configuration files or log files. Please check the apache logfile <pre>/var/log/apache2/error.log</pre> for more details."

</VirtualHost>

Create your first administrator account:

htdigest2 -c etc/linotp2/admins “LinOTP2 admin area” admin

Create a local account, under which the LinOTP wsgi runs:

useradd -r linotp

Do some Apache stuff:

a2enmod mod_auth_digest

a2dismod php5

a2dismod cgi

a2dismod userdir a2dismod auth_basic

Edit /etc/sysconfig/apache2 to make Apache start using SSL:

APACHE_SERVER_FLAGS="-D SSL"

Finally, make the services start at boot time and adapt access rights on files:

chkconfig postgresql on chkconfig apache2 on chown -R linotp /var/log/linotp chown -R linotp /opt/LINOTP/etc/linotp2/data/