Message-ID:

It's not an optical illusion, it just looks like one. -- Phil White

devel / comp.protocols.kerberos / Re: 2FA with krb5

Re: 2FA with krb5

<mailman.4.1633633608.13936.kerberos@mit.edu>

https://www.rocksolidbbs.com/devel/article-flat.php?id=164&group=comp.protocols.kerberos#164

copy link Newsgroups: comp.protocols.kerberos

Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!tncsrv06.tnetconsulting.net!.POSTED.pch.mit.edu!not-for-mail
From: simo@redhat.com (Simo Sorce)
Newsgroups: comp.protocols.kerberos
Subject: Re: 2FA with krb5
Date: Thu, 07 Oct 2021 15:06:14 -0400
Organization: Red Hat
Lines: 40
Message-ID: <mailman.4.1633633608.13936.kerberos@mit.edu>
References: <5ee92454-ec38-d5de-5b36-4b2d87fd7f@prime.gushi.org>
<202110070127.1971R4KA032759@hedwig.cmf.nrl.navy.mil>
<87pmsgpt36.fsf@hope.eyrie.org>
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Injection-Info: tncsrv06.tnetconsulting.net; posting-host="pch.mit.edu:18.7.21.50";
logging-data="1271"; mail-complaints-to="newsmaster@tnetconsulting.net"
User-Agent: Evolution 3.40.4 (3.40.4-1.fc34)
Cc: kerberos@mit.edu
To: Russ Allbery <eagle@eyrie.org>, Ken Hornstein <kenh@cmf.nrl.navy.mil>
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=HrggCclYkUB+/qhe+rVLqG6ZkY2981qM3EQn3/fmObcBrtHcnnm2WRJ4ZAFFbAvnLVOFXUPElp1GkTCHvadge2I31Zwg3N9V5NnNhW7m15u0+zk1q/uxmzyFrW4wtsbb2jihrY0aLGJPN29XgIP1z7zzMRxAwc1X7pOiF4WAMFedjLNI+3n28QEGomvESgJqypziEOuoSzn+Gon1A+sYgjdvy9InlRcN5z+sHrTIMm9IPWJKXEvmfq3BZSuV3HCdPsmkTv0pF7xFXYvln5Kg8ER3vILuL7eT2W+8Kpj0keXkX5cUoCWyH4ebCceqAYtYzU1c+a2CzkolwK63GH53Yg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=H5KS7asnrRHF28f+FE9ErQ4GwkvXJbM8hBRV8AQWxGI=;
b=b1LpNQbHpMtDD6lRpIR8ObZNRikxc1Ah6iZ9tCJrq/Pw259PIqMoLCsjBa4FXAlG6quytcP4uC3YJpZZjlT+SF9fDQJQl4lJeaXW3PO+vPkDreZCsPc0vqxLF/3bZLMzjjozB+Xw+qCPlCf5kVCcPJuRxJ1KECM2i3PxUhYxuvs6n5eIjKyexYXCC9MmP95uaF4OnyQ0gpnLohiFrK5zZMUADf+cJk8o308RRY+J4r05kYWhvStwKHelmKiFLS1juVujjUSpocMS3KB5fKHEDZ5D1MaK1fsHVoEAG/QnIVOJmgSh2BONAe9msXYfmUpANrHXK8S2Jj/Odvj2z8povQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;
dkim=none; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=mitprod.onmicrosoft.com; s=selector2-mitprod-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=H5KS7asnrRHF28f+FE9ErQ4GwkvXJbM8hBRV8AQWxGI=;
b=MFchJNBn6z/L92puSTZYbyjpuOg9ZrfUVerunn2nD/XkM7lBHgOrYo+mxHbbhj9zPN++e9DnjIqJsfFxCcjMvKry5k3KQ5X+EHRBrpKD/xSPvVOgF2eQtD/MODyTEeZMKacuArafVsMFCXOIlJi+F+NgBXDrMp/hgwOYrMZOrHc=
Authentication-Results: spf=pass (sender IP is 170.10.129.124)
smtp.mailfrom=redhat.com; mit.edu; dkim=pass (signature was verified)
header.d=redhat.com; mit.edu;
dmarc=pass action=none header.from=redhat.com;
Received-SPF: Pass (protection.outlook.com: domain of redhat.com designates
170.10.129.124 as permitted sender) receiver=protection.outlook.com;
client-ip=170.10.129.124; helo=us-smtp-delivery-124.mimecast.com;
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;
s=mimecast20190719; t=1633633577;
h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
to:to:cc:cc:mime-version:mime-version:content-type:content-type:
content-transfer-encoding:content-transfer-encoding:
in-reply-to:in-reply-to:references:references;
bh=H5KS7asnrRHF28f+FE9ErQ4GwkvXJbM8hBRV8AQWxGI=;
b=CxqoPrNqFsUtMsJyj1Y++F0FutGNuH6aUaRXfqdeCPGyqQ7gpsjrQLYArQxPP+BikbUNou
+w6yfqSOmkweK3K1KvCmTUiDT2xMWeGXhUvDJelQy+C0Wrbwm3tAAXte/m8AShxgcsQZ20
IfDPiEssGFrzORGkzy8GpBIqQP9qqu0=
X-MC-Unique: GXgpGmy1Mtu4bEXErSFs_Q-1
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=x-gm-message-state:message-id:subject:from:to:cc:date:in-reply-to
:references:organization:user-agent:mime-version
:content-transfer-encoding;
bh=H5KS7asnrRHF28f+FE9ErQ4GwkvXJbM8hBRV8AQWxGI=;
b=TQGAvSsxCOMEC9bvh8n9qk7yDZYEezaxh3eZby04zP5ee3GdngB2Prp2wu+tE5o51b
IUZ3cY8eF43/3F543izXmVROFVlrvlsdX6n/qERoUKNxU3gWH/ZZMn6YsjQLYP3olFoS
I7GaBOhmEfw2u27TeaQ4uqR6WkSE4m1tS1Y3HDfGc0er/d5kD6y8NhmEPTnbbqLr9ypT
/SXCQ4xpgz1FYmc50nsdZfDzK+/6E8d+WFXbG+nlcx20fZG65YEizAsp5jMUjJv5eQDk
6Avg9SCu+WoVjK0AKtXOeUuRZ8ZWcnAWPrEo8vCK57v/i3cSvOnJLzU2keDlK4Nl+kHS
Dqsg==
X-Gm-Message-State: AOAM531gcc/f1xUEc5Dp5T7Lcgjxj2ymdLGQoWCXVYkXYHUx2zpmcsgG
Wl3EYESTj3QQTLsPzHPwIDO8bt97oti4o5YWDHez+wr6W/A1hmsXHjN/AyWVaRVwMkkVqXRLNJg
x77F+6PVK
X-Received: by 2002:ac8:6683:: with SMTP id d3mr7099346qtp.291.1633633575871;
Thu, 07 Oct 2021 12:06:15 -0700 (PDT)
X-Google-Smtp-Source: ABdhPJy/yV8QN1PvJtcrf3WboYKZu2ny76wlMkWI8U6x+sATkTyn0aRfDW00RalQoVANg+FWxe2H1Q==
X-Received: by 2002:ac8:6683:: with SMTP id d3mr7099316qtp.291.1633633575652;
Thu, 07 Oct 2021 12:06:15 -0700 (PDT)
In-Reply-To: <87pmsgpt36.fsf@hope.eyrie.org>
Authentication-Results-Original: relay.mimecast.com; auth=pass
smtp.auth=CUSA124A263 smtp.mailfrom=simo@redhat.com
X-Mimecast-Spam-Score: 0
X-Mimecast-Originator: redhat.com
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b:0
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 2d8900cd-be48-4859-8b31-08d989c58ab9
X-MS-TrafficTypeDiagnostic: CY4PR0101MB3110:
X-LD-Processed: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b,ExtAddr
X-MS-Exchange-AtpMessageProperties: SA
X-Microsoft-Antispam-PRVS: <CY4PR0101MB31103A536E5F584F42E98E3CA3B19@CY4PR0101MB3110.prod.exchangelabs.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:10000;
X-MS-Exchange-SenderADCheck: 0
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: dzvXvGJO4MgqWfBR7KyyZOxny5AL4OZPInCnihegz0OCgd6JQ6GC8SaKTyXcWLqRwVk0bn9sxAh0l0c35u7rfE74xwZ1Lg8wmq+Bnq1QdKs8fVV1zoKHIDeuRb7rPmla+q1oNjMxZuY8gvHLbCOjP/5/aEr+fWIQ7wY1tlRLUGvMpo9uVUkgn4BUkixl4lDmo6yXQbYJDcnkKfGZKSYnohuE345spaPwlAezwAzPd7QvCY0+L63D5Pnv+7OLI33ZsoOEt16fWUpJc7jDdibAuGX/Vv70qdZMQeSIP2LehhQ9+lIew4U9z9B7gvp8pWTtG035tFKdTzrenmfbrUwSLjUIocHKt8BR3im9WWFp6lDRcaltqNQ5+/1P60RMd++Hck91Dqr8wkVsDw11ajEPkt4bNJw5V4fM49TncBqS/ZBvQACDNHVN1/6cHKA0e3MStoBy17H0VZ8qt+UXZGHeyWhsQZLwlz8lzMj0vPmTYB6emf9iScOQ/pda3gp6rqXn7OL/n/OrsHagUqac11D/QMNEvraud0ksMCK2pSEBvAKg1KOc8mNTA3++V12Ytmxd896p7gGutnpUFnQ4F8cCixNI894oSK5Yc4gFNm4ZvCE=
X-Forefront-Antispam-Report: CIP:170.10.129.124; CTRY:US; LANG:en; SCL:1; SRV:;
IPV:NLI; SFV:NSPM; H:us-smtp-delivery-124.mimecast.com;
PTR:us-smtp-delivery-124.mimecast.com; CAT:NONE;
SFS:(4636009)(83380400001)(8676002)(86362001)(356005)(2616005)(7636003)(7596003)(956004)(316002)(110136005)(36906005)(786003)(2906002)(508600001)(26005)(336012)(70586007)(68406010)(36756003)(4326008)(7696005)(5660300002)(36916002);
DIR:OUT; SFP:1102;
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-MS-Exchange-Transport-Forked: True
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Oct 2021 19:06:17.8014 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 2d8900cd-be48-4859-8b31-08d989c58ab9
X-MS-Exchange-CrossTenant-Id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-AuthSource: BN8NAM11FT048.eop-nam11.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR0101MB3110
X-OriginatorOrg: mitprod.onmicrosoft.com
X-BeenThere: kerberos@mit.edu
X-Mailman-Version: 2.1.6
Precedence: list
List-Id: The Kerberos Authentication System Mailing List <kerberos.mit.edu>
List-Unsubscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=unsubscribe>
List-Archive: <http://mailman.mit.edu/pipermail/kerberos>
List-Post: <mailto:kerberos@mit.edu>
List-Help: <mailto:kerberos-request@mit.edu?subject=help>
List-Subscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=subscribe>

by: Simo Sorce - Thu, 7 Oct 2021 19:06 UTC

On Thu, 2021-10-07 at 11:50 -0700, Russ Allbery wrote:
> Ken Hornstein <kenh@cmf.nrl.navy.mil> writes:
>
> > I am not sure of the client coverage of the OTP FAST factor, though.
>
> For what it's worth, although my pam-krb5 module implements FAST including
> both keyed and anonymous FAST, it does not implement FAST OTP. This is
> because (a) I didn't find any documentation of what I was supposed to do
> as a client (it's been years since I looked so this quite possibly has
> changed), and (b) attempting to set up a reasonable test environment
> looked painful. In particular, there was (at the time, again haven't
> checked recently) a lot of hand-waving about exactly to set up the RADIUS
> part, since MIT Kerberos just treats it as an oracle.

It is somewhat documented, but see below.

> I haven't checked if sssd supports FAST OTP. That seems much more likely
> given that they probably have enterprise use cases that would warrant
> implementing it.

It does, and FreeIPA implements the server part, so you can look there
for examples and testing capabilities if you are so inclined.

> I'd be happy to take pull requests since I try to make pam-krb5 reasonably
> completionist as a hobby (although be aware that it's a purely hobby
> project at this point), but they would need to include changes to the ci
> directory to set up the KDC and RADIUS server appropriately so that the
> test suite could do a proper end-to-end integration test.

HTH,
Simo.

--
Simo Sorce
RHEL Crypto Team
Red Hat, Inc