Rocksolid Light

Welcome to novaBBS (click a section below)

mail  files  register  newsreader  groups  login

Message-ID:  

Never trust an operating system you don't have sources for. ;-) -- Unknown source


devel / comp.protocols.kerberos / Re: 2FA with krb5

SubjectAuthor
o Re: 2FA with krb5Jochen Kellner

1
Re: 2FA with krb5

<mailman.9.1633641055.13936.kerberos@mit.edu>

  copy mid

https://www.novabbs.com/devel/article-flat.php?id=169&group=comp.protocols.kerberos#169

  copy link   Newsgroups: comp.protocols.kerberos
Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!tncsrv06.tnetconsulting.net!.POSTED.pch.mit.edu!not-for-mail
From: joc...@jochen.org (Jochen Kellner)
Newsgroups: comp.protocols.kerberos
Subject: Re: 2FA with krb5
Date: Thu, 07 Oct 2021 21:29:57 +0200
Organization: TNet Consulting
Lines: 25
Message-ID: <mailman.9.1633641055.13936.kerberos@mit.edu>
References: <5ee92454-ec38-d5de-5b36-4b2d87fd7f@prime.gushi.org>
<202110070127.1971R4KA032759@hedwig.cmf.nrl.navy.mil>
<835yu8agao.fsf@jochen.org>
<202110071835.197IZZDh007055@hedwig.cmf.nrl.navy.mil>
Mime-Version: 1.0
Content-Type: text/plain
Injection-Info: tncsrv06.tnetconsulting.net; posting-host="pch.mit.edu:18.7.21.50";
logging-data="605"; mail-complaints-to="newsmaster@tnetconsulting.net"
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.1 (gnu/linux)
Cc: kerberos@mit.edu
To: Ken Hornstein <kenh@cmf.nrl.navy.mil>
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=GUJcTN03ps5dpaN6Wu9yIPTC2SO7h/EqTnjFRLzfvOtpIiz3T0oOUFSq/nKtbX4y/aKv0MoulmYlImgY77+hJNYH+p9Kxchcp/dFjcznO4HCZka/q2rm4GlW0LJc8zJpNBiOSTma8ZfiKxsqkyue3cHSIVx5LyhQYn/BIpTb2ogr6RXg2/FLqk9DjaiCpjz17zU+RgxaMHq6XVA4g8nnCo3x7cG8sVKR2Jr0IkvNwdKP6xLsSjKK4uTnByy+3mXgpOB/O6eecIU2YalXqxQmmAG/kuiVKkdeOnh/bxSC31531U+LjaU0tmfcvmp1cx5BrfNaKGldZUK0dL1LiPoGJw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=PbQpj/EQAhqaq7ZVD1FUiGCEDzdFgjvU2lxfto2E3hs=;
b=YT5rEek8rNuOG0KCnZiWFBuk2UTLC9AiXJNeG0KlwKXdI4hAhVVWkGbh8Rsb8WuiB1zDvWwO03nuEB42XKeOFIDdmJD6q/nICa6kNORBfDGEwQBDAXlcLKr4ixm6g+6YGX36I+TF24L1c3mhs2BfBZw5h97HWTowFjtKvU/PA/0wqopoz2JAeYhopSyWOX/rgTow93J1g9fhHoTzZ1BJSq4MZEtxNv5LMrxmDa5V215EHiQtWzy2qiJwHFBJTAh5ViUHjY4OwJWfxfdGHH343BmwnEDW0mIFUEl5h4L+JODIGvPb7TZ6aWi+CRfXAnqsUYCBs1uSmP3+yUqOP0oGXQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;
dkim=none; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=mitprod.onmicrosoft.com; s=selector2-mitprod-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=PbQpj/EQAhqaq7ZVD1FUiGCEDzdFgjvU2lxfto2E3hs=;
b=uqkwpU3GRjtVWUw9wsu/ZasisyalqYINc4w0eUX8E0K8T8nh+8DFcIIuHWUJI6fALtnBw+irzflJeopdLp74Zg/p3Mguno3cZ9K5ht6Fs9zEmrI8PK+vVyb90c3iF8mElP0T3DzvknjXpLTAZ8JRsiImawZW94jCxL1794ITqqs=
Authentication-Results: spf=none (sender IP is 89.1.8.212)
smtp.mailfrom=jochen.org; mit.edu; dkim=none (message not signed)
header.d=none;mit.edu; dmarc=none action=none header.from=jochen.org;
Received-SPF: None (protection.outlook.com: jochen.org does not designate
permitted sender hosts)
In-Reply-To: <202110071835.197IZZDh007055@hedwig.cmf.nrl.navy.mil> (Ken
Hornstein's message of "Thu, 07 Oct 2021 14:35:35 -0400")
X-NetCologne-Spam: L
X-Rspamd-Queue-Id: AB2CE11D76
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b:0
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 346d458a-cc01-459f-a2d1-08d989c8df26
X-MS-TrafficTypeDiagnostic: CO1PR01MB7290:
X-LD-Processed: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b,ExtAddr
X-MS-Exchange-AtpMessageProperties: SA
X-Microsoft-Antispam-PRVS: <CO1PR01MB7290A1645DB73C3CE887A011AEB19@CO1PR01MB7290.prod.exchangelabs.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:9508;
X-MS-Exchange-SenderADCheck: 2
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: UBwmSMOlzPKiyrDVJQ/LME4fS36lvOClGsX0JsaE50sW+VXeiKIb7rSFuI7kSC46SQnRw4WursS1NH+3BcjGjccCBb3lvebBsOiRT88i5QHE2CiUTjXniVYV+m23OqDR/y/+zjYzvwijEO5IVxCEGecwNalNClfW3PQl/KePu845KhlrVPAhWN05kCFvEJUHBL/H0Hp4AbvIWLryVeO/HlqLjvBW63m3mJouS206npNxBDXC6oUjd8m+4RFJLalUrBbaEqzdylDfQqM0DxpD0BpGZnkNMjGslc3sPVkhyCpOeDiutTva0ffs0Z9XTM8Yt2GVrX/xDWSfrfWGhenQex8v44ysK/G/hDAbVC82YPlijLEG9Afjsb1uaTFg/8Yv3W1Fq3ERE5xu26jSzJh+Z3H7oOtaHyXO5v9zGqptADMvwqjXr8+hjbOLhBHDQfgmNhKeP10yJURa+K4/7io3+0YRhLD2SonKmnzZ+Ra1b7XnzgDmYAyeJUUjhTIwlD3AwOMJmTRBTsmDA9bDqNKw397ZeJndY70vpBQ1G1Q2wxLDrWWDYHFHbLjkKsdWioanzKgq6diMHk3h2I+8xMj0rIPDIpqeHU1Ved3guYHm9cMPJh9V1LyO/u14SrLA0cxKVVV1MzbA/TLs4ASICLSHT0nAgWK6uT+XfHRnTIbtfaiG1DsUrn+6JnaNtD9AarUOEMkMVD1oys3nEWya/TgZRA==
X-Forefront-Antispam-Report: CIP:89.1.8.212; CTRY:DE; LANG:en; SCL:1; SRV:;
IPV:NLI; SFV:NSPM; H:cc-smtpout2.netcologne.de;
PTR:cc-smtpout2.netcologne.de; CAT:NONE;
SFS:(4636009)(966005)(68406010)(70586007)(86362001)(83380400001)(7596003)(7636003)(8676002)(4744005)(4326008)(6266002)(2160300002)(336012)(2616005)(508600001)(356005)(26005)(426003)(2906002)(5660300002)(786003)(316002)(7696005)(6966003)(36756003)(6862004);
DIR:OUT; SFP:1102;
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-MS-Exchange-Transport-Forked: True
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Oct 2021 19:30:07.6883 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 346d458a-cc01-459f-a2d1-08d989c8df26
X-MS-Exchange-CrossTenant-Id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-AuthSource: CO1NAM11FT019.eop-nam11.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO1PR01MB7290
X-OriginatorOrg: mitprod.onmicrosoft.com
X-Mailman-Approved-At: Thu, 07 Oct 2021 17:10:54 -0400
X-BeenThere: kerberos@mit.edu
X-Mailman-Version: 2.1.6
Precedence: list
List-Id: The Kerberos Authentication System Mailing List <kerberos.mit.edu>
List-Unsubscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=unsubscribe>
List-Archive: <http://mailman.mit.edu/pipermail/kerberos>
List-Post: <mailto:kerberos@mit.edu>
List-Help: <mailto:kerberos-request@mit.edu?subject=help>
List-Subscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=subscribe>
 by: Jochen Kellner - Thu, 7 Oct 2021 19:29 UTC

Ken Hornstein <kenh@cmf.nrl.navy.mil> writes:

>>I've been running Privacyidea (https://www.privacyidea.org/) for some
>>time to manage the tokens. Exposed the Application with RADIUS and told
>>FreeIPA to authenticate against RADIUS. Had some rough edges, but was
>>usable for me and is able to manage many kinds of tokens.
>
> So what's the _client_ look like? Specifically, are you doing FAST-OTP?
> If so, what client software are you using? Does this only work on
> systems with host keys, or do you do anonymous PKINIT?

I mostly use sssd and kinit. I'm not sure what sssd uses, but I remember
traces from kinit using PKINIT. These two clients worked well for me.

Other clients (java applications) had problems with OTP. See
https://lists.jboss.org/pipermail/keycloak-user/2018-January/012759.html
for the analysis we did there.

As you said - with the "right" clients it might work. Otherwise you
might be stuck.

Jochen

--
This space is intentionally left blank.


devel / comp.protocols.kerberos / Re: 2FA with krb5

1
server_pubkey.txt

rocksolid light 0.9.81
clearnet tor