DEV Community

Ashkan
Ashkan

Posted on • Edited on

Step-by-Step Guide to Setting Up 2FA with FreeIPA and LDAP for SSH and LDAP Enabled Applications

#freeipa #2fa #ldap #ssh

Introduction

In this tutorial, we'll setup FreeIPA server on Oracle Linux 9. FreeIPA is an open-source identity and authentication management system for Linux networked environments. Then we will install FreeIPA client on Ubuntu 22.04 and set up 2FA for SSH. We also create a bind user to be able to integrate LDAP enabled applications with the LDAP server.

Installing FreeIPA server

Preparing the Server

Set the hostname (FQDN):

sudo hostnamectl set-hostname ipa.example.com
Enter fullscreen mode Exit fullscreen mode

Get the IP address the server:

ip -br a
Enter fullscreen mode Exit fullscreen mode

Example output:

lo               UNKNOWN        127.0.0.1/8
ens160           UP             192.168.136.134/24

Edit the hosts file:

sudo vim /etc/hosts
Enter fullscreen mode Exit fullscreen mode

Example:

192.168.136.134 ipa.example.com

Open the required ports:

sudo firewall-cmd --permanent --add-service=freeipa-4
Enter fullscreen mode Exit fullscreen mode 
sudo firewall-cmd --reload
Enter fullscreen mode Exit fullscreen mode

Install and Configure the FreeIPA Server

Install the required packages:

sudo dnf install -y ipa-server
Enter fullscreen mode Exit fullscreen mode

Start the installation and configuration by running the following command:

sudo ipa-server-install
Enter fullscreen mode Exit fullscreen mode

Example output:

This program will set up the IPA Server.
Version 4.10.2
This includes:
  * Configure a stand-alone CA (dogtag) for certificate management
  * Configure the NTP client (chronyd)
  * Create and configure an instance of Directory Server
  * Create and configure a Kerberos Key Distribution Center (KDC)
  * Configure Apache (httpd)
  * Configure SID generation
  * Configure the KDC to enable PKINIT
To accept the default shown in brackets, press the Enter key.
...

Select the default response of no when asked to configure the integrated DNS.

Do you want to configure integrated DNS (BIND)? [no]:
Enter fullscreen mode Exit fullscreen mode

Accept the default FQDN.

Enter the fully qualified domain name of the computer
on which you're setting up server software. Using the form
<hostname>.<domainname>
Example: master.example.com


Server host name [ipa.example.com]:
Enter fullscreen mode Exit fullscreen mode

Accept the default domain name.

The domain name has been determined based on the host name.

Please confirm the domain name [example.com]:
Enter fullscreen mode Exit fullscreen mode

Accept the default realm name.

The kerberos protocol requires a Realm name to be defined.
This is typically the domain name converted to uppercase.

Please provide a realm name [EXAMPLE.COM]:
Enter fullscreen mode Exit fullscreen mode

Choose a secure password for the Directory Manager user and confirm it.

Certain directory server operations require an administrative user.
This user is referred to as the Directory Manager and has full access
to the Directory for system management tasks and will be added to the
instance of directory server created for IPA.
The password must be at least 8 characters long.

Directory Manager password:
Password (confirm):
Enter fullscreen mode Exit fullscreen mode

Choose a secure password for the admin user and confirm it.

The IPA server requires an administrative user, named 'admin'.
This user is a regular system account used for IPA server administration.

IPA admin password:
Password (confirm):
Enter fullscreen mode Exit fullscreen mode

Accept the default NETBIOS domain name.

Trust is configured but no NetBIOS domain name found, setting it now.
Enter the NetBIOS name for the IPA domain.
Only up to 15 uppercase ASCII letters, digits and dashes are allowed.
Example: EXAMPLE.


NetBIOS domain name [EXAMPLE]:
Enter fullscreen mode Exit fullscreen mode

Accept the default response of no for configuring chrony.

Do you want to configure chrony with NTP server or pool address? [no]:
Enter fullscreen mode Exit fullscreen mode

Finally the script displays a summary of the configuration. To proceed with the installation enter yes.

The IPA Master Server will be configured with:
Hostname:       ipa.example.com
IP address(es): 192.168.136.134
Domain name:    example.com
Realm name:     EXAMPLE.COM

The CA will be configured with:
Subject DN:   CN=Certificate Authority,O=EXAMPLE.COM
Subject base: O=EXAMPLE.COM
Chaining:     self-signed

Continue to configure the system with these values? [no]:
Enter fullscreen mode Exit fullscreen mode

The script needs several minutes to configure the server. Upon completion, it displays some information including a file containing a list of records to add to the DNS system.

Please add records in this file to your DNS system: /tmp/ipa.system.records.7hnslqjy.db
==============================================================================
Setup complete

Next steps:
        1. You must make sure these network ports are open:
                TCP Ports:
                  * 80, 443: HTTP/HTTPS
                  * 389, 636: LDAP/LDAPS
                  * 88, 464: kerberos
                UDP Ports:
                  * 88, 464: kerberos
                  * 123: ntp

        2. You can now obtain a kerberos ticket using the command: 'kinit admin'
           This ticket will allow you to use the IPA tools (e.g., ipa user-add)
           and the web user interface.

Be sure to back up the CA certificates stored in /root/cacert.p12
These files are required to create replicas. The password for these
files is the Directory Manager password
The ipa-server-install command was successful
Enter fullscreen mode Exit fullscreen mode

Here are the contents of the /tmp/ipa.system.records.7hnslqjy.db file generated at the end of this installation:

_kerberos-master._tcp.example.com. 3600 IN SRV 0 100 88 ipa.example.com.
_kerberos-master._udp.example.com. 3600 IN SRV 0 100 88 ipa.example.com.
_kerberos._tcp.example.com. 3600 IN SRV 0 100 88 ipa.example.com.
_kerberos._udp.example.com. 3600 IN SRV 0 100 88 ipa.example.com.
_kerberos.example.com. 3600 IN TXT "EXAMPLE.COM"
_kerberos.example.com. 3600 IN URI 0 100 "krb5srv:m:tcp:ipa.example.com."
_kerberos.example.com. 3600 IN URI 0 100 "krb5srv:m:udp:ipa.example.com."
_kpasswd._tcp.example.com. 3600 IN SRV 0 100 464 ipa.example.com.
_kpasswd._udp.example.com. 3600 IN SRV 0 100 464 ipa.example.com.
_kpasswd.example.com. 3600 IN URI 0 100 "krb5srv:m:tcp:ipa.example.com."
_kpasswd.example.com. 3600 IN URI 0 100 "krb5srv:m:udp:ipa.example.com."
_ldap._tcp.example.com. 3600 IN SRV 0 100 389 ipa.example.com.
ipa-ca.example.com. 3600 IN A 192.168.136.134
Enter fullscreen mode Exit fullscreen mode

Test the Server

Authenticate as the admin user. The kinit command obtains and caches a Kerberos ticket-granting ticket.

kinit admin
Enter fullscreen mode Exit fullscreen mode

You can list the ticket's information with:

klist
Enter fullscreen mode Exit fullscreen mode

Example output:

Ticket cache: KCM:1000
Default principal: admin@EXAMPLE.COM
Valid starting       Expires              Service principal
11/17/2023 13:37:44  11/18/2023 12:41:14  krbtgt/EXAMPLE.COM@EXAMPLE.COM

Get a list of the users with:

ipa user-find
Enter fullscreen mode Exit fullscreen mode

Example output:

--------------
1 user matched
--------------
  User login: admin
  Last name: Administrator
  Home directory: /home/admin
  Login shell: /bin/bash
  Principal alias: admin@EXAMPLE.COM, root@EXAMPLE.COM
  UID: 487800000
  GID: 487800000
  Account disabled: False
----------------------------
Number of entries returned 1

Disable anonymous binds

Create a file containing the required configuration:

cat > ~/disable.ldif <<EOF
dn: cn=config
changetype: modify
replace: nsslapd-allow-anonymous-access
nsslapd-allow-anonymous-access: rootdse
EOF
Enter fullscreen mode Exit fullscreen mode

Apply the changes.

ldapmodify -x -D "cn=Directory Manager" -W -h ipa.example.com -p 389 -f ~/disable.ldif
Enter fullscreen mode Exit fullscreen mode

Restart the 389 Directory Server instance.

sudo systemctl restart dirsrv.target
Enter fullscreen mode Exit fullscreen mode

Verify the modification.

ldapsearch -x -D "cn=Directory Manager" -b cn=config -W -h ipa.example.com  -p 389 nsslapd-allow-anonymous-access | grep nsslapd-allow-anonymous-access
Enter fullscreen mode Exit fullscreen mode

Expected output:

Enter LDAP Password:
# requesting: nsslapd-allow-anonymous-access
nsslapd-allow-anonymous-access: rootdse

Creating a Bind User

We need to create a read-only on our LDAP server. Other applications use this user to query the LDAP server. We can use Apache Directory Studio to create the user. First we need to connect to the server using the admin account.

LDAP connection

Now we need to create a new entry:

Image description

Configure a uid:

Configuring uid

Add a userPassword attribute.

userPassword

And set a plain text password (pre-hashed passwords are not valid).

Plain text password

Click finish. You can use the readonly_user to integrate LDAP enabled application with the LDAP server.

Installing FreeIPA client

Set the hostname (FQDN):

sudo hostnamectl set-hostname client.example.com
Enter fullscreen mode Exit fullscreen mode

Modify the hosts file.

sudo vim /etc/hosts
Enter fullscreen mode Exit fullscreen mode

Example:

192.168.136.134 ipa.example.com ipa
192.168.136.135 client.example.com client

Install the required packages.

sudo apt install freeipa-client
Enter fullscreen mode Exit fullscreen mode

During installation you'll be prompted with several times. When asked to enter default Kerberos realm, accept the default EXAMPLE.COM.

Kerberos realm prompt

When asked to enter Kerberos servers for your realm, hit Ok to skip.

Kerberos servers prompt

When asked to enter administrative server for your Kerberos realm, hit Ok to skip.

Kerberos administrative server prompt

Hit Ok again to finish the installation.

Service restart prompt

Configure the IPA client.

sudo ipa-client-install --hostname=$(hostname -f) --mkhomedir --server=ipa.example.com --domain example.com --realm EXAMPLE.COM
Enter fullscreen mode Exit fullscreen mode

The script is interactive and uses several prompts. When asked about no DNS discovery, choose yes.

Autodiscovery of servers for failover cannot work with this configuration.
If you proceed with the installation, services will be configured to always access the discovered server for all operations and will not fail over to other servers in case of failure.
Proceed with fixed values and no DNS discovery? [no]: yes
Enter fullscreen mode Exit fullscreen mode

Enter yes if you want to configure chrony with NTP server.

Do you want to configure chrony with NTP server or pool address? [no]: yes
Enter fullscreen mode Exit fullscreen mode

Enter a NTP server address, if you have entered yes in the previous step.

Enter NTP source server addresses separated by comma, or press Enter to skip: time.cloudflare.com
Enter fullscreen mode Exit fullscreen mode

Press enter whenever you have provided all the servers you want to proceed to the next step.

Enter a NTP source pool address, or press Enter to skip:
Enter fullscreen mode Exit fullscreen mode

At this point the script displays a summary of the configuration. Enter yes if you want to continue with the displayed configuration.

Client hostname: client.example.com
Realm: EXAMPLE.COM
DNS Domain: example.com
IPA Server: ipa.example.com
BaseDN: dc=example,dc=com
NTP server: time.cloudflare.com

Continue to configure the system with these values? [no]: yes
Enter fullscreen mode Exit fullscreen mode

The script continues to configure the client.

Synchronizing time
Configuration of chrony was changed by installer.
Attempting to sync time with chronyc.
Time synchronization was successful.
User authorized to enroll computers: admin
Password for admin@EXAMPLE.COM:
Successfully retrieved CA cert
    Subject:     CN=Certificate Authority,O=EXAMPLE.COM
    Issuer:      CN=Certificate Authority,O=EXAMPLE.COM
    Valid From:  2023-11-17 13:23:41
    Valid Until: 2043-11-17 13:23:41

Enrolled in IPA realm EXAMPLE.COM
Created /etc/ipa/default.conf
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm EXAMPLE.COM
Systemwide CA database updated.
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub
Adding SSH public key from /etc/ssh/ssh_host_dsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub
Could not update DNS SSHFP records.
SSSD enabled
Configured /etc/openldap/ldap.conf
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config.d/04-ipa.conf
Configuring example.com as NIS domain.
Client configuration complete.
The ipa-client-install command was successful
Enter fullscreen mode Exit fullscreen mode

On Ubuntu user's home directory won't be created automatically. To fix that, open /usr/share/pam-configs/mkhomedir file for editing.

sudo vim /usr/share/pam-configs/mkhomedir
Enter fullscreen mode Exit fullscreen mode

And replace its contents by the following:

Name: Create home directory on login - FreeIPA
Default: yes
Priority: 900
Session-Type: Additional
Session:
    required pam_mkhomedir.so umask=0027 skel=/etc/skel
Enter fullscreen mode Exit fullscreen mode

Now run the following command.

sudo pam-auth-update
Enter fullscreen mode Exit fullscreen mode

When prompted to select PAM profiles, make sure Create home directory on login - FreeIPA is selected and then hit Ok.

Pam profiles to be enabled prompt

Now on the FreeIPA server, add the client to the hosts file.

sudo bash -c 'echo 192.168.136.135 client.example.com client >> /etc/hosts'
Enter fullscreen mode Exit fullscreen mode

Adding a User

We will use the web UI to add a new user. The UI is accessible through https://ipa.example.com/ipa/ui/ address. Log in as admin user.

Administration web UI

Click on Add button.

List of users

Fill in the required fields and press Add button.

User attributes

After adding the user, you'll see a list of active users. Click on the new user's login name.

List of users

To enable 2FA, select Two factor authentication (password + OTP) and then click the Save button.

Enabling 2FA

Setting up 2FA

Now the newly added user is able to use the web UI and create a TOTP token for herself.

Web UI login

At first login the user must change the password provided by the administrator.

First login

To generate the OTP token, the user must navigate to OTP Tokens tab.

User's info

Here the user needs to click on the Add button.

Add OTP token

The user must select the type of the token.

Add OTP Token

A QR code will be displayed. The user should scan the code using an application like Google Authenticator.

QR code

At the end the list of all the tokens will be displyed.

Token list

Now, Jane Doe can log in to client.example.com via SSH. When prompted to enter the password, she should enter the password she selected earlier, followed by the one-time password displayed by the authenticator app.

SSH login

References and Further Reading

Top comments (0)

Read next

eugene-zimin profile image

Access to Google Cloud Virtual Machine through SSH

Eugene Zimin -

bachhuynh profile image

Accessing Remote Databases Without VPN Using SSH Tunnels

Bach Huynh V. VN.Danang -

michalbryxi profile image

Unlocking your SSH key through OSX keychain

Michal Bryxí -

xinitd profile image

Increase Debian based Linux VPS server’s security

Shakhzhakhan Maxudbek -