#mutual authentication

New Post has been published on http://mocco.sk/how-you-can-configure-apache-to-apply-radius-for-wikid-two-factor-authentication-on-ubuntu/

How you can Configure Apache To apply Radius For WiKID Two-Factor Authentication On Ubuntu

This document describes how to add WiKID two-factor authentication to Apache 2.x using mod_auth_radius on Ubuntu 12.04 Precise.

It is recommended that you consider using mutual https authentication for web applications that are worthy of two-factor authentication. Strong mutual authentication means that the targeted website is authenticated to the user in some cryptographically secure manner, thwarting most man-in-the-middle attacks. The use of cryptography is key. While some sites use an image in an attempt to validate a server, it should be noted that any man-in-the-middle could simply replay such an image.

The WiKID software token performs mutual authentication by retrieving a hash of the website’s SSL certificate from the WiKID server and comparing a hash of the downloaded SSL certificate. If the two match, the token will launch the default browser to the target site for the user. If they don’t match an error will be displayed, much like SSH. To configure mutual authentication for web applications, see this tutorial.

Our configuration was as follows:

Ubuntu 12.04

Apache 2.2.22-1 

libapache2-mod-auth-radius 1.5.8-1.  

For two-factor authentication, we were using WiKID, in this case, the commercial version.

Here’s how it will work, when the user clicks on a two-factor protected link, they will be prompted for a username and password. The user generates the one-time passcode on their WiKID software token and enters it into the password prompt. Apache will route the username and one-time password to the WiKID server via mod_auth_radius. If the username and one-time password match what WiKID expects, the server will tell Apache to grant access. First, we add Apache to the WiKID Strong Authentication Server as a network client, then add radius to Apache. I assume you already have a WiKID domain and users setup.

So, start by adding a new Radius network client to the WiKID server for your web server:

Log into WiKID server web interface (http://yourwikidserver/WiKIDAdmin).

Select Network Clients tab.

Click on Create New Network Client.

Fill in the requested information.

For the IP Address, use the web server IP address

For Protocol, select Radius

Hit the Add button, and on the next page, enter a shared secret

Do not enter anything into the Return Attribute box

From the terminal or via ssh, run ‘stop’ and then ‘start’ to load the network client into the built-in WiKID radius server

That is it for the WiKID server.

Now to get Apache ready for two-factor authentication. I started from a fresh Ubuntu 12.04 install so I had to install both apache and mod_auth_radius.

$ sudo apt-get install libapache2-mod-auth-radius

Now you need to add two more things to your apache2.conf and httpd.conf. First create a directory that will be protected by two-factor authentication. In this case, the entire site is protected. Enter this into your apache2.conf:

<Directory /var/www> Options Indexes FollowSymlinks AuthType Basic AuthName "WiKID Two-factor authentication" AuthBasicAuthoritative Off AuthBasicProvider radius AuthRadiusAuthoritative on AuthRadiusActive On Require valid-user </Directory>

Note the “AuthBasicProvider radius” directive. That stops the browser from re-submitting cached credentials to the WiKID server, which clearly will not work for one-time passwords.

Now, in httpd.conf, enter:

AddRadiusAuth wikid_server_address:1812 wikidserver_shared_secret 5 AuthRadiusCookieValid 60

You will want to change wikid_server_address to the IP address of the WiKID server and wikidserver_shared_secret to the shared secret you configured above in the WiKID server. Note that the the AddRadiusAuth line ends with 5 and not 5:3. The 3 in the later setting is for the number of times to attempt a password use. For one-time passwords, we only want them tried once, therefore we leave it empty. The 5 is for a 5 second time out. The AuthRadiusCookieValid directive is set for 60 minutes.

That should be all you need. You can use a .htaccess file, but that is frowned upon. The Directory method is deemed more secure.

 Using radius allows you to run the authentication through your directory using NPS on Windows/AD or Freeradius for OpenLDAP.  Such a configuration allows you to disable a user in one place – the directory – which is much more secure.

Links

Related Tutorials