How To Use FreeRADIUS With LinOTP 2 To Do Two Factor Authentication With One Time Passwords

This howto will guide you to set up RADIUS authentication with the LinOTP 2 Community Edition. LinOTP is a one time password backend that enables you to do two factor authentication with a broad variety of different hardware devices, software tokens and SMS.

While the Enterprise Edition comes with a C module for the FreeRADIUS Server, the Community Edition, that is licensed under the AGPLv3 does not. Nevertheless, LinOTP provides very simple WEB APIs that makes it easy to talk to LinOTP in many different ways. There is also an API to do authentication, i.e. to ask the LinOTP server if a given one time password for a certain user is valid. This is the URL

https://yourServer/validate/check?user=....&pass=....

or 

https://yourServer/validate/simplecheck?user=...&pass=...

You can take a look at the complete API here.

The simple LinOTP API and some nice module of the FreeRADIUS make it easy to hack a simple solution for OTP via RADIUS. You could use the module rlm_exec to execute an external program but I'd rather use the module rlm_perl and add my limited perl knowlege ;-)

The documentation of the rlm_perl module can be found here. It has a simple example, that we need to adapt only in the function authenticate. This is the point, where we need to talk to the LinOTP server (with the above URL) and repond according the the LinOTP feedback.

So the perl module in a pre-beta ;-) will look like this:

##  This program is free software; you can redistribute it and/or modify#  it under the terms of the GNU General Public License as published by#  the Free Software Foundation; either version 2 of the License, or#  (at your option) any later version.##  This program is distributed in the hope that it will be useful,#  but WITHOUT ANY WARRANTY; without even the implied warranty of#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the#  GNU General Public License for more details.##  You should have received a copy of the GNU General Public License#  along with this program; if not, write to the Free Software#  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA##  Copyright 2002  The FreeRADIUS server project#  Copyright 2002  Boian Jordanov #  Copyright 2011  linotp project ## Based on the Example code for use with rlm_perl##=head1 NAMEfreeradius_perl - Perl module for use with FreeRADIUS rlm_perl, to authenticate against  LinOTP  http://www.linotp.org=head1 SYNOPSIS   use with freeradius:        Configure rlm_perl to work with LinOTP:   in /etc/freeradius/users     set:     DEFAULT Auth-type := perl  in /etc/freeradius/modules/perl     point     perl {         module =   to this file  in /etc/freeradius/sites-enabled/  set  authenticate{    perl    [....]=head1 DESCRIPTIONThis module enables freeradius to authenticate using LinOTP.   TODO:      * checking of server certificate=head2 Methods   * authenticate=head1 AUTHORCornelius Koelbel (cornelius.koelbel@lsexperts.de)=head1 COPYRIGHTCopyright 2011 This library is free software; you can redistribute it under the GPLv2.=head1 SEE ALSOperl(1).=cutuse strict;use LWP 5.64;# use ...# This is very important ! Without this script will not get the filled  hashesh from main.use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK $URL);use Data::Dumper;$URL = "https://localhost/validate/simplecheck";# This is hash wich hold original request from radius#my %RAD_REQUEST;# In this hash you add values that will be returned to NAS.#my %RAD_REPLY;#This is for check items#my %RAD_CHECK;## This the remapping of return values#       use constant    RLM_MODULE_REJECT=>    0;#  /* immediately reject the request */       use constant    RLM_MODULE_FAIL=>      1;#  /* module failed, don't reply */       use constant    RLM_MODULE_OK=>        2;#  /* the module is OK, continue */       use constant    RLM_MODULE_HANDLED=>   3;#  /* the module handled the request, so stop. */       use constant    RLM_MODULE_INVALID=>   4;#  /* the module considers the request invalid. */       use constant    RLM_MODULE_USERLOCK=>  5;#  /* reject the request (user is locked out) */       use constant    RLM_MODULE_NOTFOUND=>  6;#  /* user not found */       use constant    RLM_MODULE_NOOP=>      7;#  /* module succeeded without doing anything */       use constant    RLM_MODULE_UPDATED=>   8;#  /* OK (pairs modified) */       use constant    RLM_MODULE_NUMCODES=>  9;#  /* How many return codes there are */# Function to handle authorizesub authorize {       # For debugging purposes only#       &log_request_attributes;       # Here's where your authorization code comes       # You can call another function from here:       &test_call;       return RLM_MODULE_OK;}# Function to handle authenticatesub authenticate {       # For debugging purposes only#       &log_request_attributes;        my $ua = LWP::UserAgent->new();    my $req = HTTP::Request->new(GET => $URL . "?user=" .        $RAD_REQUEST{'User-Name'} . "&pass=" .         $RAD_REQUEST{'User-Password'} );    my $response = $ua->request( $req );    die "Error at $URL\n ", $response->status_line, "\n Aborting"      unless $response->is_success;          if($response->content =~ m/:\-\)/i) {               return RLM_MODULE_OK;      } else {        $RAD_REPLY{'Reply-Message'} = "LinOTP server denied access!";               return RLM_MODULE_REJECT;    }}# Function to handle preacctsub preacct {       # For debugging purposes only#       &log_request_attributes;       return RLM_MODULE_OK;}# Function to handle accountingsub accounting {       # For debugging purposes only#       &log_request_attributes;       # You can call another subroutine from here       &test_call;       return RLM_MODULE_OK;}# Function to handle checksimulsub checksimul {       # For debugging purposes only#       &log_request_attributes;       return RLM_MODULE_OK;}# Function to handle pre_proxysub pre_proxy {       # For debugging purposes only#       &log_request_attributes;       return RLM_MODULE_OK;}# Function to handle post_proxysub post_proxy {       # For debugging purposes only#       &log_request_attributes;       return RLM_MODULE_OK;}# Function to handle post_authsub post_auth {       # For debugging purposes only#       &log_request_attributes;       return RLM_MODULE_OK;}# Function to handle xlatsub xlat {       # For debugging purposes only#       &log_request_attributes;       # Loads some external perl and evaluate it       my ($filename,$a,$b,$c,$d) = @_;       &radiusd::radlog(1, "From xlat $filename ");       &radiusd::radlog(1,"From xlat $a $b $c $d ");       local *FH;       open FH, $filename or die "open '$filename' $!";       local($/) = undef;       my $sub = ;       close FH;       my $eval = qq{ sub handler{ $sub;} };       eval $eval;       eval {main->handler;};}# Function to handle detachsub detach {       # For debugging purposes only#       &log_request_attributes;       # Do some logging.       &radiusd::radlog(0,"rlm_perl::Detaching. Reloading. Done.");} ## Some functions that can be called from other functions#sub test_call {       # Some code goes here}sub log_request_attributes {       # This shouldn't be done in production environments!       # This is only meant for debugging!       for (keys %RAD_REQUEST) {               &radiusd::radlog(1, "RAD_REQUEST: $_ = $RAD_REQUEST{$_}");       }}1;

You will need to configure some FreeRADIUS files and also adapt the $URL in the  perl module itself.

Please note, that this is an easy and simple way, to get RADIUS running. There are some things missing, error handling logging would be nice, what about redundancy, the SSL certificate is not checked!

Nevertheless it shows how easy it is to integrate LinOTP into your environment using its simple API.

View the original article here

How To Secure Your Ubuntu 10.10 Desktop With LinOTP 2

This howto will guide you to set up a LinOTP standalone one time password authentication backend on your Linux machine. This enables you to add two factor authentication with one time passwords to your desktop login.

LinOTP is a modular OTP (one time password) solution, that supports many different OTP tokens. LinOTP is written in python, based on pylons and apache. It comes as open source licensed under the AGPLv3. Additional functionalities, maintenance and support can be licensed in an Enterprise Edition.

This howto should run on Ubuntu 10.10 and Debian Squeeze.

You can either download the necessary packages from the LinOTP website or you can add the online repository to your repositories and install them with apt-get.

This Howto will use the second way to install the software.

First you need to add the GPG key, that was used to sign the packages:

wget http://linotp.org/apt/LSE\ LinOTP2\ Packaging\ linotp2@lsexperts.de\ \(0xF86258E5\)\ pub.as
sudo apt-key add http://linotp.org/apt/LSE\ LinOTP2\ Packaging\ linotp2@lsexperts.de\ \(0xF86258E5\)\ pub.asc

Then add the repository to your system:

sudo add-apt-repository "deb http://linotp.org/apt/ubuntu lucid linotp2ce"

Now you can install the LinOTP server, the management client and the PAM module:

sudo apt-get install linotp linotpuseridresolver libpam-linotp linotpadminclientce

When installing the linotp package you are asked several questions:

Do you want to run LinOTP 2 via Apache2? -> Yes
Enter admin password for the new LinOTP admin account. -> think of one
Do you want to create a self signed ceritficate? -> Yes
What SQL database do you want to use for the token database? -> Mysql
database hostname: -> localhost
Name of Token database -> LinOTP2
database user -> linotp2
database users password: -> think of one
Enter MySQL root password
Do you want to create the tables: -> yes

During the installation the encryption key /etc/linotp2/encKey will be created. Be sure to also enter the MySQL root password, so the database will be created, too.

Now you got two possibilities to manage the LinOTP server and OTP tokens. You can either use the command line client linotpadmin.py or the web interface located at

https://localhost/manage

Please note: If you got and "internal server error" take a look at /var/log/apache2/error.log. It could be, that the access rights of the directory /var/log/linotp are not right. Also the whole directory /etc/linotp2 needs to be owned by the user linotp.

LinOTP reads users by so called UserIdResolvers. The APGLv3 version comes with the PasswdUserIdResolver, that can be used to read users from flat files like the /etc/passwd. You can also create a new file that contains the users, as long as you stick to the passwd format.

The Enterprise Edition also provides Resolvers for users located in LDAP and SQL databases.

You may use the management web ui or the command line client to setup your LinOTP server. You need to configure a UserIdResolver and a default realm. You may do this by issuing the following commands:

linotpadm.py --url=https://localhost --admin=admin --command=setresolver --resolver=defaultPW --rtype=FILE --rf_file=/etc/passwd

That reads the users from the /etc/passwd file. You will get a JSON feedback like this:

{ u'status': True,....}

Now you need to add this resolver to your default realm:

linotpadm.py --url=https://localhost --admin=admin --command=setrealm --realm=defrealm --resolver=useridresolver.PasswdIdResolver.IdResolver.defaultPW
linotpadm.py --url=https://localhost --admin=admin --command=setdefaultrealm --realm=defrealm

You can either check it in the web ui or issue the command:

linotpadm.py --url=https://localhost --admin=admin --command=listuser

You should see the list of your users. Now you are ready to assign tokens to your user.

You may want to enroll an OTP token, now. In this example we enroll an motp token (you could also enroll an OATH Token or a Google authenticator) on our mobile phone. Download the app from http://motp.sourceforge.net and install it on your phone. You may initialize the token by entering 0000 as PIN on the phone. An init-secret will be displayed.

linotpadm.py --url=https://localhost --admin=admin --command=inittoken --user=cornelius --type=motp --otpkey=860e2e9bf9d50665 --serial=1 --otppin=1234

This means, that you generated an mOTP token that gets assigned to the user "cornelius". The otpkey is the init-secret that was displayed on your phone. You may choose a serial (serial number) as you like to. The otppin is the PIN you will enter on the phone to generate an otp value.

Optionally you may set an OTP PIN, which is a fixed password part, that you need to enter in front (depending on the parameter PrependPIN) of the OTP value:

linotpadm.py --url=https://localhost --admin=admin --command=set --pin=Password --serial=1

Alternatively you can use the management web interface, to enroll the token.

Now you are ready to generate your first OTP value! Go to the portal site:

https://localhost/auth/index

and enter your username and as password the OTP PIN you set and the otp value you generated with your phone. If you fail to authenticate, you might mistyped the init secret or the time of your phone might be out of sync.

Now we will setup PAM to enable you to authenticate to your desktop. The security module /lib/security/pam_linotp.so was installed to your system. You may now set up otp authentication. We choose to do it modular:

cp /etc/pam.d/common-auth /etc/pam.d/common-linotp

In /etc/pam.d/common-linotp change the line:

auth [success=1 default=ignore] pam_unix.so nullok_secure

to

auth [success=1 default=ignore] pam_linotp.so debug nosslhostnameverify nosslcertverify url=https://localhost/validate/simplecheck realm=defrealm resConf=defaultPW

Please note, that when using "debug" option, many many information - also the password! - will be written to the auth.log.

You may now use the common-linotp in any PAM configuration instead of common-auth, where you like to. I.e. you may change the line in /etc/pam.d/gdm:

@include common-auth

to

@include common-linotp

Now you will need to authenticate with OTP to your Gnome desktop! Note that you will also need to change /etc/pam.d/gnome-screensaver if you also want to unlock the desktop using OTP. You will not be asked for "Password" anymore but for "Your OTP".

If you fail to authenticate you may also take a look into /var/log/auth.log.

View the original article here