Re: [EXTERNAL] Separate Topic -- FreeIPA and RADIUS

[White, Daniel E. (GSFC-770.0)[NICS]]

Mariusz,
I do not want to hijack your thread, so I am starting another.
I would be very interested to know your FreeIPA/RADIUS configuration.

______________________________________________________________________________________________

Daniel E. White
[e-mail]<mailto:[e-mail]>
NASCOM Linux Engineer
NASA Goddard Space Flight Center
Science Applications International Corporation (SAIC)
Office: [phone]
Mobile: [phone]

From: FreeIPA-Users <freeipa-users(a)lists.fedorahosted.org&gt;
Reply-To: FreeIPA-Users <freeipa-users(a)lists.fedorahosted.org&gt;
Date: Friday, February 19, 2021 at 08:51
To: FreeIPA-Users <freeipa-users(a)lists.fedorahosted.org&gt;
Cc: Mariusz Stysiak <server.is.not.responding(a)gmail.com&gt;
Subject: [EXTERNAL] [Freeipa-users] MFA for AD users

Hello List,

I'd really appreciate some insight here.
I've setup FreeIpa POC (centos7, freeipa 4.7, two freeipa servers as multimaster along
with some clients). Added OTP's for several users and made it work with RADIUS for vpn
access authentication purpose. Next, I've added AD trust and I am able to log in as AD
user. All groovy. Now I'd like to enforce MFA for AD users by adding OTP tokens for
them. Is it possible at all? Since AD user authenticates against AD, shouldn't it be
AD who provides MFA?

FreeIPA behaves strangely when it comes to AD users (mapped via external group and POSIX
group): AD user 'ipatest' is visible with 'id' command (and has it's
own UID GID and so on) but cannot be found via 'ipa user-find' command even with
specific UID provided:

admin@ipa-poc-1 ~ $ id
[e-mail]<mailto:[e-mail]>
uid=748801177([e-mail]<mailto:[e-mail]>)
gid=748801177([e-mail]<mailto:[e-mail]>)
groups=748801177([e-mail]<mailto:[e-mail]>),748800513(domain
[e-mail]<mailto:[e-mail]>),748801180([e-mail]<mailto:[e-mail]>),793600008(ad_users)

admin@ipa-poc-1 ~ $ ipa user-find ipatest
---------------
0 users matched
---------------
----------------------------
Number of entries returned 0
----------------------------
admin@ipa-poc-1 ~ $ ipa user-find
[e-mail]<mailto:[e-mail]>
---------------
0 users matched
---------------
----------------------------
Number of entries returned 0
----------------------------
admin@ipa-poc-1 ~ $ ipa user-find ipatest@TRUSTEDOMAIN-LAB
---------------
0 users matched
---------------
----------------------------
Number of entries returned 0


admin@ipa-poc-1 ~ $ ipa user-find uid=748801177
---------------
0 users matched
---------------
----------------------------
Number of entries returned 0
----------------------------
I reckon it is due to the one-way trust with AD domain but not sure here. Since "ipa
otptoken-add' command requires 'owner' parameter (type string and doesn't
work with UID) I cannot add OTP token for this user.

Another approach I've tried (since ipa otptoken-add command by default uses current
user as owner) was to log on as AD user and create OTP token 'for myself', but it
didn't work either:

[e-mail]<mailto:[e-mail]>@ipa-poc-1 ~ $
kinit [e-mail]<mailto:[e-mail]>
    Password for
[e-mail]<mailto:[e-mail]>:
    [e-mail]<mailto:[e-mail]>@ipa-poc-1 ~
$ ipa otptoken-add --type='TOTP'
    ipa: ERROR: cannot connect to 'any of the configured servers':
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fipa-poc...,
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fipa-poc...
So, to make it short:

Is it possible to add OTP token to external AD user?
How to do it?
rgrds

M.
_______________________________________________
FreeIPA-users mailing list --
[e-mail]<mailto:[e-mail]>
To unsubscribe send an email to
[e-mail]<mailto:[e-mail]>
Fedora Code of Conduct:
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.fe...
List Guidelines:
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedorap...
List Archives:
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.f...
Do not reply to spam on the list, report it:
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fpagure....

[EXTERNAL] Separate Topic -- FreeIPA and RADIUS

[Mariusz Stysiak]

Hi Daniel, 
My configuration bases on the guide I found at
https://www.freeipa.org/page/Using_FreeIPA_and_FreeRadius_as_a_RADIUS_bas...
Skip the first part and start with "Install, configure and test RADIUS Server as a
frontend to IPA".

Since this is a POC, I've set up radius server on one of my ipa servers
"ipa-poc-1.lab" (would have added another one on second ipa machine for
redundancy if I went to PROD) and added it to my IPA vie GUI under Authentication ->
RADIUS servers.

Below my radius config w/o commented lines:

ipa-poc-1 /etc/raddb # cat radiusd.conf |egrep -v "^\s*(#|$)"
prefix = /usr
exec_prefix = /usr
sysconfdir = /etc
localstatedir = /var
sbindir = /usr/sbin
logdir = ${localstatedir}/log/radius
raddbdir = ${sysconfdir}/raddb
radacctdir = ${logdir}/radacct
name = radiusd
confdir = ${raddbdir}
modconfdir = ${confdir}/mods-config
certdir = ${confdir}/certs
cadir   = ${confdir}/certs
run_dir = ${localstatedir}/run/${name}
db_dir = ${localstatedir}/lib/radiusd
libdir = /usr/lib64/freeradius
pidfile = ${run_dir}/${name}.pid
correct_escapes = true
max_request_time = 30
cleanup_delay = 5
max_requests = 16384
hostname_lookups = no
log {
	destination = files
	colourise = yes
	file = ${logdir}/radius.log
	syslog_facility = daemon
	stripped_names = no
	auth = no
	auth_badpass = no
	auth_goodpass = no
	msg_denied = "You are already logged in - access denied"
}
checkrad = ${sbindir}/checkrad
security {
	user = radiusd
	group = radiusd
	allow_core_dumps = no
	max_attributes = 200
	reject_delay = 1
	status_server = yes
}
proxy_requests  = yes
$INCLUDE proxy.conf
$INCLUDE clients.conf
thread pool {
	start_servers = 5
	max_servers = 32
	min_spare_servers = 3
	max_spare_servers = 10
	max_requests_per_server = 0
	auto_limit_acct = no
}
modules {
	$INCLUDE mods-enabled/
}
instantiate {
}
policy {
	$INCLUDE policy.d/
}
$INCLUDE sites-enabled/

 

And clients config file:

ipa-poc-1 /etc/raddb # cat clients.conf |egrep -v "^\s*(#|$)"
client default {
	ipaddr = FREEIPA_SERVER_IP/32
	proto = udp
	secret = very_secure_pass
	require_message_authenticator = no
	nas_type	 = cisco	# localhost isn't usually a NAS...
	limit {
		max_connections = 16
		lifetime = 0
		idle_timeout = 30
	}
}
client localhost_ipv6 {
	ipv6addr	= ::1
	secret		= very_secure_pass
}
client asa-V {
	ipaddr = CISCO_ASA_IP/32
	proto = udp
	secret = very_complicated_secret
	require_message_authenticator = no
	nas_type	 = cisco	# localhost isn't usually a NAS...
	limit {
		max_connections = 16
		lifetime = 0
		idle_timeout = 30
	}
}

We plan to put all TACACS rules/acls on ASA.

[EXTERNAL] Separate Topic -- FreeIPA and RADIUS

[White, Daniel E. (GSFC-770.0)[NICS]]

Thanks for sharing.

______________________________________________________________________________________________

Daniel E. White
[e-mail]<mailto:[e-mail]>
NASCOM Linux Engineer
NASA Goddard Space Flight Center
Science Applications International Corporation (SAIC)
Office: [phone]
Mobile: [phone]

From: FreeIPA-Users <freeipa-users(a)lists.fedorahosted.org&gt;
Reply-To: FreeIPA-Users <freeipa-users(a)lists.fedorahosted.org&gt;
Date: Monday, February 22, 2021 at 03:45
To: FreeIPA-Users <freeipa-users(a)lists.fedorahosted.org&gt;
Cc: Mariusz Stysiak <server.is.not.responding(a)gmail.com&gt;
Subject: [Freeipa-users] Re: [EXTERNAL] Separate Topic -- FreeIPA and RADIUS

Hi Daniel,
My configuration bases on the guide I found at
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.fre...
Skip the first part and start with "Install, configure and test RADIUS Server as a
frontend to IPA".

Since this is a POC, I've set up radius server on one of my ipa servers
"ipa-poc-1.lab" (would have added another one on second ipa machine for
redundancy if I went to PROD) and added it to my IPA vie GUI under Authentication ->
RADIUS servers.

Below my radius config w/o commented lines:

ipa-poc-1 /etc/raddb # cat radiusd.conf |egrep -v "^\s*(#|$)"
prefix = /usr
exec_prefix = /usr
sysconfdir = /etc
localstatedir = /var
sbindir = /usr/sbin
logdir = ${localstatedir}/log/radius
raddbdir = ${sysconfdir}/raddb
radacctdir = ${logdir}/radacct
name = radiusd
confdir = ${raddbdir}
modconfdir = ${confdir}/mods-config
certdir = ${confdir}/certs
cadir   = ${confdir}/certs
run_dir = ${localstatedir}/run/${name}
db_dir = ${localstatedir}/lib/radiusd
libdir = /usr/lib64/freeradius
pidfile = ${run_dir}/${name}.pid
correct_escapes = true
max_request_time = 30
cleanup_delay = 5
max_requests = 16384
hostname_lookups = no
log {
                destination = files
                colourise = yes
                file = ${logdir}/radius.log
                syslog_facility = daemon
                stripped_names = no
                auth = no
                auth_badpass = no
                auth_goodpass = no
                msg_denied = "You are already logged in - access denied"
}
checkrad = ${sbindir}/checkrad
security {
                user = radiusd
                group = radiusd
                allow_core_dumps = no
                max_attributes = 200
                reject_delay = 1
                status_server = yes
}
proxy_requests  = yes
$INCLUDE proxy.conf
$INCLUDE clients.conf
thread pool {
                start_servers = 5
                max_servers = 32
                min_spare_servers = 3
                max_spare_servers = 10
                max_requests_per_server = 0
                auto_limit_acct = no
}
modules {
                $INCLUDE mods-enabled/
}
instantiate {
}
policy {
                $INCLUDE policy.d/
}
$INCLUDE sites-enabled/



And clients config file:

ipa-poc-1 /etc/raddb # cat clients.conf |egrep -v "^\s*(#|$)"
client default {
                ipaddr = FREEIPA_SERVER_IP/32
                proto = udp
                secret = very_secure_pass
                require_message_authenticator = no
                nas_type              = cisco  # localhost isn't usually a NAS...
                limit {
                                max_connections = 16
                                lifetime = 0
                                idle_timeout = 30
                }
}
client localhost_ipv6 {
                ipv6addr              = ::1
                secret                    = very_secure_pass
}
client asa-V {
                ipaddr = CISCO_ASA_IP/32
                proto = udp
                secret = very_complicated_secret
                require_message_authenticator = no
                nas_type              = cisco  # localhost isn't usually a NAS...
                limit {
                                max_connections = 16
                                lifetime = 0
                                idle_timeout = 30
                }
}

We plan to put all TACACS rules/acls on ASA.
_______________________________________________
FreeIPA-users mailing list --
[e-mail]<mailto:[e-mail]>
To unsubscribe send an email to
[e-mail]<mailto:[e-mail]>
Fedora Code of Conduct:
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.fe...
List Guidelines:
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedorap...
List Archives:
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.f...
Do not reply to spam on the list, report it:
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fpagure....