Google Authenticator - Revision history

Michael.mast at 21:08, 30 March 2022

2022-03-30T21:08:22Z

Michael.mast: /* Start Container */

2022-03-30T21:07:21Z

Start Container

Michael.mast: /* CentOS 7 */

2022-03-30T21:06:05Z

CentOS 7

Michael.mast: /* Container build */

2022-03-30T20:56:26Z

Container build

Michael.mast: /* Docker */

2022-03-30T20:30:25Z

Docker

Michael.mast: /* Docker */

2019-06-19T17:59:08Z

Docker

Michael.mast: Michael.mast moved page VMWare View - Google Authenticator to Google Authenticator without leaving a redirect: Not vmware dependent.

2019-06-19T17:54:39Z

Michael.mast moved page VMWare View - Google Authenticator to Google Authenticator without leaving a redirect: Not vmware dependent.

Michael.mast: /* CentOS 7 */

2019-06-04T19:09:55Z

CentOS 7

Michael.mast: /* Container build */

2018-11-21T18:17:21Z

Container build

Michael.mast at 15:28, 10 November 2018

2018-11-10T15:28:11Z

← Older revision		Revision as of 21:08, 30 March 2022
Line 84:		Line 84:
	sudo docker run --name radtest -dit -v /var/lib/sss:/var/lib/sss -v /home/ec2-user/ga_codes/home:/home -v /home/ec2-user/ga_scripts:/ga_scripts -v /home/ec2-user/ga_web:/ga_web -p 1812:1812 googleauth2		sudo docker run --name radtest -dit -v /var/lib/sss:/var/lib/sss -v /home/ec2-user/ga_codes/home:/home -v /home/ec2-user/ga_scripts:/ga_scripts -v /home/ec2-user/ga_web:/ga_web -p 1812:1812 googleauth2
	</pre>		</pre>
−
−	~~==CentOS 7==~~
−	~~<ref>https://www.digitalocean.com/community/tutorials/how-to-set-up-multi-factor-authentication-for-ssh-on-ubuntu-14-04</ref>~~
−	~~<ref>http://freeradius.1045715.n5.nabble.com/Defining-an-Auth-Type-based-on-a-realm-td3208012.html</ref>~~
−	~~<ref>http://stackoverflow.com/questions/19021487/freeradius-google-dual-factor-authenticator-pam</ref>~~
−	~~<ref>http://lists.freeradius.org/pipermail/freeradius-users/2010-May/046799.html</ref>~~
−	~~<ref>http://www.supertechguy.com/help/security/freeradius-google-auth</ref>~~
−	~~<ref>http://wiki.freeradius.org/guide/Basic-configuration-HOWTO</ref>~~
−	~~<br>~~
−	~~Found a site<ref>https://github.com/rharmonson/richtech/wiki/CentOS-7-Minimal-&-Two-factor-Authentication-using-FreeRADIUS-3,-SSSD-1.12,-&-Google-Authenticator</ref> that outlines everything.~~
−	~~<ref>https://www.linuxsysadmintutorials.com/setup-sudo-with-google-authenticator-for-2-factor-authentication-on-centos-7.html</ref>~~
−
−	~~yum install -y git autoconf automake make libtool pam-devel~~
−	~~<s> nano /etc/yum.repos.d/pbis.repo~~
−	~~<pre>~~
−	~~[PBISO]~~
−	~~name=PBISO~~
−	~~baseurl=http://repo.pbis.beyondtrust.com/yum/pbiso/$basearch~~
−	~~enabled=1~~
−	~~gpgcheck=0~~
−	~~</pre>~~
−	~~yum -y install pbis-open</s>~~
−	~~git clone https://github.com/google/google-authenticator~~
−	~~cd google-authenticator/libpam~~
−	~~./bootstrap.sh~~
−	~~./configure~~
−	~~./make~~
−	~~./make install~~
−	~~ln -s /usr/local/lib/security/pam_google_authenticator.so /usr/lib64/security/pam_google_authenticator.so~~
−	~~yum install freeradius~~
−	~~ln -s /etc/raddb/mods-enabled/pam /etc/raddb/mods-available/pam~~
−	~~sed -i 's/user = freerad/user = root/' /etc/raddb/radiusd.conf~~
−	~~sed -i 's/group = freerad/group - root/' /etc/raddb/radiusd.conf~~
−	~~nano /etc/raddb/users~~
−	~~<pre>~~
−	~~DEFAULT Group == “GG_S_GOOGLE_AUTH_DISABLED”, Auth-Type := Reject~~
−	~~Reply-Message = “Your account has been disabled.”~~
−	~~DEFAULT Auth-Type := PAM~~
−	~~</pre>~~
−	~~sed -i "s/^#\\tpam/\\tpam/" /etc/raddb/sites-enabled/default~~
−	~~Comment out all lines in /etc/pam.d/radiusd then add the following~~
−	~~echo "auth requisite pam_google_authenticator.so forward_pass" >> /etc/pam.d/radiusd~~
−	~~echo "auth required pam_sss.so use_first_pass" >> /etc/pam.d/radiusd~~
−
−	~~==Ubuntu 16.04 LTS==~~
−	*<b>UPDATE :</b> I have little interest in finishing the Ubuntu install instructions. This is incomplete and some of the steps are wrong. I am leaving it here for reference only
−	~~<ref>https://community.spiceworks.com/how_to/80336-join-ubuntu-14-04lts-to-a-windows-domain-using-pbis-open</ref><br>~~
−
−	~~sudo wget http://download.beyondtrust.com/PBISO/8.0.1/linux.deb.x64/pbis-open-8.0.1.2029.linux.x86_64.deb.sh~~
−	~~git clone https://github.com/google/google-authenticator~~
−	~~cd google-authenticator/libpam/~~
−	~~sudo apt install dh-autoreconf~~
−	~~sudo ./bootstrap.sh~~
−	~~./configure~~
−	~~sudo make~~
−	~~sudo make install~~
−	~~sudo apt install freeradius~~
−	~~sudo sed -i 's/^user\ =\ freerad/user\ =\ root/' /etc/freeradius/radiusd.conf~~
−	~~sudo sed -i 's/^group\ =\ freerad/user\ =\ root/' /etc/freeradius/radiusd.conf~~
−	~~sudo nano /etc/freeradius/users~~
−	~~<pre>~~
−	#
−	~~# Deny access for a group of users.~~
−	#
−	~~# Note that there is NO 'Fall-Through' attribute, so the user will not~~
−	~~# be given any additional resources.~~
−	#
−	~~#DEFAULT Group == "disabled", Auth-Type := Reject~~
−	~~# Reply-Message = "Your account has been disabled."~~
−	#
−	~~DEFAULT Group == “CSP-VMWare.GoogleAuth”, Auth-Type := Reject~~
−	~~Reply-Message = “Your account has been disabled.”~~
−	~~DEFAULT Auth-Type := PAM~~
−
−	#
−	~~</pre>~~
−	~~sudo sed -i 's/^#\ \ \ \ \ \ \ pam/\ \ \ \ \ \ \ \ pam/' /etc/freeradius/sites-enabled/default~~
−	~~sudo nano /etc/pam.d/radiusd~~
−	~~<pre>~~
−	#
−	~~# /etc/pam.d/radiusd - PAM configuration for FreeRADIUS~~
−	#
−
−	# We fall back to the system default in /etc/pam.d/common-*
−	#
−
−	~~#@include common-auth~~
−	~~#@include common-account~~
−	~~#@include common-password~~
−	~~#@include common-session~~
−	~~auth requisite pam_google_authenticator.so forward_pass~~
−	~~auth required pam_lsass.so use_first_pass~~
−	~~</pre>~~
−	~~sudo systemctl start freeradius~~
−	~~sudo nano /etc/freeradius/clients.conf~~
−	*Modify the following to match your environment
−	~~<pre>~~
−	~~#client some.host.org {~~
−	~~# secret = testing123~~
−	~~# shortname = localhost~~
−	#}
−	~~</pre>~~
−	ie
−	~~<pre>~~
−	~~client vcs-vdi-my.domain.com {~~
−	~~secret = Imadeasecret!~~
−	~~shortname = vcs~~
−	}
−	~~</pre>~~
−	~~sudo nano /etc/freeradius/proxy.conf~~
−	~~realm your.domain.com {~~
−	}
−
−	~~sudo systemctl restart freeradius~~

@@ Line 80: / Line 80: @@
 ===Start Container===
+This is old style of binding host kerberos config to container, this is no longer needed but still works.
 <pre>
 sudo docker run --name radtest -dit -v /var/lib/sss:/var/lib/sss -v /home/ec2-user/ga_codes/home:/home -v /home/ec2-user/ga_scripts:/ga_scripts -v /home/ec2-user/ga_web:/ga_web -p 1812:1812  googleauth2

@@ Line 93: / Line 93: @@
 <ref>http://wiki.freeradius.org/guide/Basic-configuration-HOWTO</ref>
 <br>
-*<b>UPDATE 1 :</b> Ran into an issue following VMWare's outdated instructions. Will have to go back and find out what has changed.
+Found a site<ref>https://github.com/rharmonson/richtech/wiki/CentOS-7-Minimal-&-Two-factor-Authentication-using-FreeRADIUS-3,-SSSD-1.12,-&-Google-Authenticator</ref> that outlines everything.
 <ref>https://www.linuxsysadmintutorials.com/setup-sudo-with-google-authenticator-for-2-factor-authentication-on-centos-7.html</ref>

@@ Line 46: / Line 46: @@
 RUN ln -s /etc/raddb/mods-available/pam /etc/raddb/mods-enabled/pam
 RUN echo -e " \n\
-client vcs-vdi-01.csp.titan.1sourcing.net { \n\
+client vcs-vdi-01 { \n\
          secret          = your_secret_here\n\
          shortname       = vcs01 \n\

@@ Line 20: / Line 20: @@
 ===Container build===
 I normally work with CentOS while the FreeRadius containers are based on Debian/Ubuntu. So for this we want to build our own image using the following template. This could be made smaller if I would compile the pam module outside the container and simply add it in, but I wanted to compile it the container just for the fun of it. This makes a number of packages unnecessary.<ref>https://axdlog.com/2016/using-google-authenticator-to-set-up-multi-factor-authentication-on-gnu-linux/</ref><ref>https://github.com/Elemental-IRCd/elemental-ircd/issues/100</ref>
 <br>
 <br>
 <pre>
-FROM docker.io/centos:latest
+FROM centos:7.6.1810
-RUN yum upgrade -y
+RUN yum -y upgrade
-RUN yum install -y freeradius freeradius-utils google-authenticator krb5-workstation \
+RUN yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
-openldap-clients mysql realmd oddjob oddjob-mkhomedir sssd samba-common-tools git \
+##Google Auth Steps
-autoconf dh-autoreconf cmake automake libtool.x86_64 pam-devel sendmail
+RUN yum install -y google-authenticator \
 RUN git clone https://github.com/google/google-authenticator-libpam.git
 RUN cd /google-authenticator-libpam; ./bootstrap.sh
 RUN cd /google-authenticator-libpam; ./configure && make; make install
 RUN sed -i 's/user\ =\ radiusd/user\ =\ root/; s/group\ =\ radiusd/group\ =\ root/' /etc/raddb/radiusd.conf
 RUN sed -i "s/^#\\tpam/\\tpam/" /etc/raddb/sites-enabled/default
 RUN ln -s /etc/raddb/mods-available/pam /etc/raddb/mods-enabled/pam
 RUN echo -e " \n\
-client my-client { \n\
+client vcs-vdi-01.csp.titan.1sourcing.net { \n\
-         secret          = some-secret-here \n\
+         secret          = your_secret_here\n\
-         shortname	= name \n\
+         shortname       = vcs01 \n\
-         ipv4addr        = xxx.xxx.xxx.xxx \n\
+         ipaddr          = 10.xxx.xxx.0 \n\
 } \n\
 " >> /etc/raddb/clients.conf
 RUN echo "DEFAULT Auth-Type := PAM" >> /etc/raddb/users
-RUN rm -f /etc/pam.d/radiusd; echo -e "auth	  required     pam_google_authenticator.so\n\
+RUN rm -f /etc/pam.d/radiusd; echo -e "auth       required     pam_google_authenticator.so\n\
 account    required     pam_nologin.so\n\
-account    include	password-auth\n\
+account    include      password-auth\n\
-session    include	password-auth\n\
+session    include      password-auth\n\
 " >> /etc/pam.d/radiusd
-RUN echo "set smtp=<smtp server>" >> /etc/mail.rc
-EXPOSE 1812/TCP
+##Kerberos config
-CMD radiusd -f
+RUN yum -y install krb5-workstation \
 </pre>
 Build the image

@@ Line 1: / Line 1: @@
 ==Docker==
 <ref>https://github.com/rharmonson/richtech/wiki/Two-Factor-Authentication-using-FreeRADIUS-with-SSSD-(FreeIPA-or-Active-Directory)-and-Google-Authenticator-on-CentOS-7</ref>
-I do not understand the relationship between FreeRADIUS, PAM, Google Authenticator, and SSS as much as I should. This took me several days trying to work this out until I found the referenced instructions on GitHub. Thankfully I was able to get a test container working, so now I just need to PROPERLY record the steps I took. Gong back to what I had in 2016 was not sufficient.
+The purpose of this container is to run freeradius with google authenticator pam modules loaded. Taken from a production system that runs freeradius and apache for a full featured solution allowing users to request new codes without bothering IT.
 ===Host Prep===
 This is not a fully contained solution. I ran into problems with SSS and kerberose authentication into AD. The problem stems from two sides
@@ Line 65: / Line 65: @@
 <pre>
-sudo docker run --name radtest -dit -v /var/lib/sss:/var/lib/sss -v /home/ec2-user/ga_codes/home:/home -v /home/ec2-user/ga_scripts:/ga_scripts -v /home/ec2-user/ga_web:/ga_web  googleauth2
+sudo docker run --name radtest -dit -v /var/lib/sss:/var/lib/sss -v /home/ec2-user/ga_codes/home:/home -v /home/ec2-user/ga_scripts:/ga_scripts -v /home/ec2-user/ga_web:/ga_web -p 1812:1812  googleauth2
 </pre>

← Older revision	Revision as of 17:54, 19 June 2019
(No difference)

@@ Line 77: / Line 77: @@
 <br>
 *<b>UPDATE 1 :</b> Ran into an issue following VMWare's outdated instructions. Will have to go back and find out what has changed.
-*<b>UPDATE 2 :</b> I believe I have found the problem, and it would be the use of the pam_lsass.so module. It was starring me straight in the face and I missed it. I have not given up on this but I did quickly realize that I would be the only one in the company that would know how any of this works. <s>Not worth it.</s>
+*<b>UPDATE 2 :</b> I believe I have found the problem, and it would be the use of the pam_lsass.so module. It was starring me straight in the face and I missed it.
 *<b>UPDATE 3 :</b> This is still a live project and will be completed in the next week or two. Have to deal with other projects first.
 *<b>UPDATE 4:</b> When I did decided to go back and make the required changes I found a site<ref>https://github.com/rharmonson/richtech/wiki/CentOS-7-Minimal-&-Two-factor-Authentication-using-FreeRADIUS-3,-SSSD-1.12,-&-Google-Authenticator</ref> that outlines everything I had debugged. It also showed I was right about the PAM modules. At least I know I learned something correctly. Next step is to go back over the steps and create an installation script.

← Older revision		Revision as of 15:28, 10 November 2018
Line 1:		Line 1:
−	~~==Purpose==~~
−
	==Docker==		==Docker==
	<ref>https://github.com/rharmonson/richtech/wiki/Two-Factor-Authentication-using-FreeRADIUS-with-SSSD-(FreeIPA-or-Active-Directory)-and-Google-Authenticator-on-CentOS-7</ref>		<ref>https://github.com/rharmonson/richtech/wiki/Two-Factor-Authentication-using-FreeRADIUS-with-SSSD-(FreeIPA-or-Active-Directory)-and-Google-Authenticator-on-CentOS-7</ref>