Google Authenticator

Docker

The purpose of this container is to run freeradius with google authenticator pam modules loaded. Taken from a production system that runs freeradius and apache for a full featured solution allowing users to request new codes without bothering IT.

Host Prep

This is not a fully contained solution. I ran into problems with SSS and kerberose authentication into AD. The problem stems from two sides

1. The kerberos works out of the secure kernel. Which causes unprivileged containers the inability to access this.
2. Kerberos likes a stable network. Containers tend to jump around and this causes problems.

So I settled on enrolling the host into AD as those are more stable, and because I will be using EC2 instances until I learn the orchastrator in AWS.

• Make sure your DNS solution is configured to resolve the domain you want to authenticate to.

sudo yum -y upgrade
sudo yum -y install yum-cron oddjob oddjob-mkhomedir sssd samba-common-tools realmd docker
sudo realm join -U <username> <domain>

Container build

I normally work with CentOS while the FreeRadius containers are based on Debian/Ubuntu. So for this we want to build our own image using the following template. This could be made smaller if I would compile the pam module outside the container and simply add it in, but I wanted to compile it the container just for the fun of it. This makes a number of packages unnecessary.

FROM centos:7.6.1810
RUN yum -y upgrade
RUN yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
##Google Auth Steps
RUN yum install -y google-authenticator \
        git \
        autoconf \
        dh-autoreconf \
        cmake \
        automake \
        libtool.x86_64 \
        pam-devel mailx
RUN git clone https://github.com/google/google-authenticator-libpam.git
RUN cd /google-authenticator-libpam; ./bootstrap.sh
RUN cd /google-authenticator-libpam; ./configure && make; make install

##Freeradius steps
RUN yum -y install freeradius \
        freeradius-utils
RUN sed -i 's/user\ =\ radiusd/user\ =\ root/; s/group\ =\ radiusd/group\ =\ root/' /etc/raddb/radiusd.conf
RUN sed -i "s/^#\\tpam/\\tpam/" /etc/raddb/sites-enabled/default
RUN ln -s /etc/raddb/mods-available/pam /etc/raddb/mods-enabled/pam
RUN echo -e " \n\
client vcs-vdi-01 { \n\
        secret          = your_secret_here\n\
        shortname       = vcs01 \n\
        ipaddr          = 10.xxx.xxx.0 \n\
        netmask         = 23 \n\
} \n\
" >> /etc/raddb/clients.conf
RUN echo "DEFAULT Auth-Type := PAM" >> /etc/raddb/users
RUN rm -f /etc/pam.d/radiusd; echo -e "auth       required     pam_google_authenticator.so\n\
account    required     pam_nologin.so\n\
account    include      password-auth\n\
session    include      password-auth\n\
" >> /etc/pam.d/radiusd

##Kerberos config
RUN yum -y install krb5-workstation \
        openldap-clients \
        mysql \
        realmd \
        oddjob \
        oddjob-mkhomedir \
        sssd \
        samba-common-tools && yum clean all

COPY run.sh /run.sh
RUN chmod +x /run.sh
#CMD /run.sh

Build the image

sudo docker build -t googleauth -f Dockerfile .

Start Container

This is old style of binding host kerberos config to container, this is no longer needed but still works.

sudo docker run --name radtest -dit -v /var/lib/sss:/var/lib/sss -v /home/ec2-user/ga_codes/home:/home -v /home/ec2-user/ga_scripts:/ga_scripts -v /home/ec2-user/ga_web:/ga_web -p 1812:1812  googleauth2

CentOS 7

Found a site that outlines everything.

yum install -y git autoconf automake make libtool pam-devel

nano /etc/yum.repos.d/pbis.repo

[PBISO]
name=PBISO
baseurl=http://repo.pbis.beyondtrust.com/yum/pbiso/$basearch
enabled=1
gpgcheck=0

yum -y install pbis-open
git clone https://github.com/google/google-authenticator
cd google-authenticator/libpam
./bootstrap.sh
./configure
./make
./make install
ln -s /usr/local/lib/security/pam_google_authenticator.so /usr/lib64/security/pam_google_authenticator.so
yum install freeradius
ln -s /etc/raddb/mods-enabled/pam /etc/raddb/mods-available/pam
sed -i 's/user = freerad/user = root/' /etc/raddb/radiusd.conf
sed -i 's/group = freerad/group - root/' /etc/raddb/radiusd.conf
nano /etc/raddb/users

DEFAULT Group == “GG_S_GOOGLE_AUTH_DISABLED”, Auth-Type := Reject
Reply-Message = “Your account has been disabled.”
DEFAULT Auth-Type := PAM

sed -i "s/^#\\tpam/\\tpam/" /etc/raddb/sites-enabled/default

Comment out all lines in /etc/pam.d/radiusd then add the following

echo "auth requisite pam_google_authenticator.so forward_pass" >> /etc/pam.d/radiusd
echo "auth required pam_sss.so use_first_pass" >> /etc/pam.d/radiusd

Ubuntu 16.04 LTS

• UPDATE : I have little interest in finishing the Ubuntu install instructions. This is incomplete and some of the steps are wrong. I am leaving it here for reference only

sudo wget http://download.beyondtrust.com/PBISO/8.0.1/linux.deb.x64/pbis-open-8.0.1.2029.linux.x86_64.deb.sh
git clone https://github.com/google/google-authenticator
cd google-authenticator/libpam/
sudo apt install dh-autoreconf
sudo ./bootstrap.sh
./configure
sudo make
sudo make install
sudo apt install freeradius
sudo sed -i 's/^user\ =\ freerad/user\ =\ root/' /etc/freeradius/radiusd.conf
sudo sed -i 's/^group\ =\ freerad/user\ =\ root/' /etc/freeradius/radiusd.conf
sudo nano /etc/freeradius/users

#
# Deny access for a group of users.
#
# Note that there is NO 'Fall-Through' attribute, so the user will not
# be given any additional resources.
#
#DEFAULT        Group == "disabled", Auth-Type := Reject
#               Reply-Message = "Your account has been disabled."
#
DEFAULT Group == “CSP-VMWare.GoogleAuth”, Auth-Type := Reject
Reply-Message = “Your account has been disabled.”
DEFAULT Auth-Type := PAM

#

sudo sed -i 's/^#\ \ \ \ \ \ \ pam/\ \ \ \ \ \ \ \ pam/' /etc/freeradius/sites-enabled/default
sudo nano /etc/pam.d/radiusd

#
# /etc/pam.d/radiusd - PAM configuration for FreeRADIUS
#

# We fall back to the system default in /etc/pam.d/common-*
#

#@include common-auth
#@include common-account
#@include common-password
#@include common-session
auth requisite pam_google_authenticator.so forward_pass
auth required pam_lsass.so use_first_pass

sudo systemctl start freeradius
sudo nano /etc/freeradius/clients.conf

• Modify the following to match your environment

#client some.host.org {
#       secret          = testing123
#       shortname       = localhost
#}

ie

client vcs-vdi-my.domain.com {
       secret          = Imadeasecret!
       shortname       = vcs
}

sudo nano /etc/freeradius/proxy.conf

realm your.domain.com { }

sudo systemctl restart freeradius