Rocksolid Light

Welcome to RetroBBS

mail  files  register  newsreader  groups  login

Message-ID:  

One can't proceed from the informal to the formal by formal means.


devel / comp.protocols.kerberos / Re: 2FA with krb5

SubjectAuthor
o Re: 2FA with krb5Russ Allbery

1
Re: 2FA with krb5

<mailman.8.1633636562.13936.kerberos@mit.edu>

  copy mid

https://www.rocksolidbbs.com/devel/article-flat.php?id=168&group=comp.protocols.kerberos#168

  copy link   Newsgroups: comp.protocols.kerberos
Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!tncsrv06.tnetconsulting.net!.POSTED.pch.mit.edu!not-for-mail
From: eagle@eyrie.org (Russ Allbery)
Newsgroups: comp.protocols.kerberos
Subject: Re: 2FA with krb5
Date: Thu, 07 Oct 2021 12:55:20 -0700
Organization: The Eyrie
Lines: 20
Message-ID: <mailman.8.1633636562.13936.kerberos@mit.edu>
References: <5ee92454-ec38-d5de-5b36-4b2d87fd7f@prime.gushi.org>
<202110070127.1971R4KA032759@hedwig.cmf.nrl.navy.mil>
<87pmsgpt36.fsf@hope.eyrie.org>
<202110071914.197JEXTD007325@hedwig.cmf.nrl.navy.mil>
<380d6720b77f3e741f334afc9fda20bdf75b68f0.camel@redhat.com>
Mime-Version: 1.0
Content-Type: text/plain
Injection-Info: tncsrv06.tnetconsulting.net; posting-host="pch.mit.edu:18.7.21.50";
logging-data="17097"; mail-complaints-to="newsmaster@tnetconsulting.net"
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.1 (gnu/linux)
Cc: Ken Hornstein <kenh@cmf.nrl.navy.mil>, kerberos@mit.edu
To: Simo Sorce <simo@redhat.com>
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=aM8sHNKtPm/ob3jJaxOAN0M+r/VMKtZkunX+29CdDk76vDc2YIX/CQzvvynfoObD6oTYgdRvnJvAlG/pwOEz/Yv40B79lG5Euw1s3ldv1aKwy22AWQ5QtT/66Xi+CSVkzRg5lR8WQncOHtZMcePLhQqMzIlCtMWnFWgr5m7Oq+s2xGd0HKCTb881N0COORO3aPrJ5DOumYUL2zFH7n+5HMjdxqr7jEc6x7qGEILdjZbnKEWKKTnpPuvFVHW6/q9t9UyIC47P/SkZheUof6QDsCKdleTSG7vvaAsjyugU647xIllxxpUFKYKZqo11NZFO+syt/2hpdpY/80hCJx31LQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=8p3mdVrR2GEAKEUyjFCr3bC9I4zD7ZS4IfI6qOaOaMM=;
b=GGLAf7YFgwBGjwp2n1SrNEwn7NSEikVevN7BVza4wM+XpHs/DRdHa+j0U9w1N9pnEM5zNEFiuMY1g5q8dSomDP3XOh3Kio0K5atX0OxDmA1fSW9+1qCARijR1krIHGTrgVUTv3keFkuEy2N/ROWIE5XL/uXj8X3HYKIRqJ83hINn9s5sm1CvuJXND5NeN+q4n3XMP0pmajLE79sDAETja/w+fYQcKJpslq8XTpDwdUYt6ZUgDIExBLDL5gBD+acSI7FzjuUxRg4SimKicKDeUw47rzQAzHY7BIOeg9zivl6CA7HWCTLKHaJ2zLdgFyGtxsNona6EEpVo43LEXkSj4w==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;
dkim=none; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=mitprod.onmicrosoft.com; s=selector2-mitprod-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=8p3mdVrR2GEAKEUyjFCr3bC9I4zD7ZS4IfI6qOaOaMM=;
b=un/GKXnvI9b0g1GnllQHE3H878NRs2eRoT7iqjdPtBZ40he34H4xc6VRBHyzG6zpcvT8Cj7p5pRqo18s1Uq+JAZ4WXwl+xFLE+qiLZXaDQYHLErEr7l9C17Du9MBzJTpGZ9H1YIiGOAO1I0tDsEXK2M1SI4/jG0oF0hCUAV9C10=
Authentication-Results: spf=pass (sender IP is 166.84.7.159)
smtp.mailfrom=eyrie.org; mit.edu; dkim=none (message not signed)
header.d=none; mit.edu;
dmarc=bestguesspass action=none header.from=eyrie.org;
Received-SPF: Pass (protection.outlook.com: domain of eyrie.org designates
166.84.7.159 as permitted sender) receiver=protection.outlook.com;
client-ip=166.84.7.159; helo=haven.eyrie.org;
In-Reply-To: <380d6720b77f3e741f334afc9fda20bdf75b68f0.camel@redhat.com> (Simo
Sorce's message of "Thu, 07 Oct 2021 15:35:41 -0400")
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b:0
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 9f116e1c-8eee-42aa-a3fe-08d989cc66fa
X-MS-TrafficTypeDiagnostic: DM6PR01MB4841:
X-LD-Processed: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b,ExtAddr
X-MS-Exchange-AtpMessageProperties: SA
X-Microsoft-Antispam-PRVS: <DM6PR01MB484164B2F0A4830FF0AED29FA6B19@DM6PR01MB4841.prod.exchangelabs.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:6790;
X-MS-Exchange-SenderADCheck: 0
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: v2gUvlqTOR4JRIiBkmFNm5cst3/Ybw2shmz/L2cuXYP1cjFQKAZooGvt/x7kdn/njL7XUIjBRSKySMIBQU1xRzRmNL0q1HT2AYEcnSwaLI/mcgoeeeyh1OcK8NTQN6EuwYwRPBu1f+vhJ+ojrQ1jAuAWZ7TeWoXOeoYv3Tc8TWA76a8iRRCII9wnlUNuwvU93t1s+cTgS0DuoeyCA6fZr5gAF1VL7S+rMJ1eQdYOUkSB4pJKmUWuZ5MXadihUbqY6wZbBaz7os2eyBVKVhCyUpjg2SKMznS6QuUmZAa16OAvBvCCYlNpFrDnwobXBnNTzxEaHny0/Y8T26Nwc1SMneu+z1AWGZ5YJOuMBuaEbRnwIOPn7F7fKUA24iht+2KQtc/LAdai9ODJZ5RLtBaN4O4veV1HiXHchR9ldYHLgsOBKshKor8xbg0g6/QOT3ImjRb3zNQiQ1MX+BVA0OlLHKhrJgLsfJABGZexhmghD20ieI2tF2G5FPuJZk8SE5qx/G1cLkZ7ULew4jI0CZOiQboE0ldgYxcKkwbNGUM09uKJvNLV2TvuVw+pj+x5I2wxF6od6dN4Hl6LtUv0VOLy4p0SMjevyZI8PLvlQ8s0S/RCLZlxS+8TsuAekfbWtcnfJAx2x/R5Gy+VssVeIPfWY63gS7QkIpjP5trKvXTgNznHcc0JMChf5DRgOw8LhJrubBacTZ1pxbank7uijKmf3g==
X-Forefront-Antispam-Report: CIP:166.84.7.159; CTRY:US; LANG:en; SCL:1; SRV:;
IPV:NLI; SFV:NSPM; H:haven.eyrie.org; PTR:haven.eyrie.org;
CAT:NONE;
SFS:(4636009)(508600001)(26005)(2160300002)(786003)(316002)(42186006)(6266002)(36916002)(4326008)(86362001)(7596003)(7636003)(68406010)(5660300002)(4744005)(966005)(8676002)(426003)(70586007)(6862004)(83380400001)(2906002)(336012)(356005);
DIR:OUT; SFP:1102;
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-MS-Exchange-Transport-Forked: True
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Oct 2021 19:55:24.1542 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 9f116e1c-8eee-42aa-a3fe-08d989cc66fa
X-MS-Exchange-CrossTenant-Id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-AuthSource: CO1NAM11FT065.eop-nam11.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR01MB4841
X-OriginatorOrg: mitprod.onmicrosoft.com
X-BeenThere: kerberos@mit.edu
X-Mailman-Version: 2.1.6
Precedence: list
List-Id: The Kerberos Authentication System Mailing List <kerberos.mit.edu>
List-Unsubscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=unsubscribe>
List-Archive: <http://mailman.mit.edu/pipermail/kerberos>
List-Post: <mailto:kerberos@mit.edu>
List-Help: <mailto:kerberos-request@mit.edu?subject=help>
List-Subscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=subscribe>
 by: Russ Allbery - Thu, 7 Oct 2021 19:55 UTC

Simo Sorce <simo@redhat.com> writes:

> Starting an ad-hoc kdc is pretty easy, I have it done in the make check
> phase in many small projects, including starting an ldap server, I
> haven't tried radius, but hopefully starting a freeradius server is not
> exceedingly hard either.

Yeah, for the record it was just the RADIUS bit that I didn't already have
working. If anyone is curious:

https://github.com/rra/pam-krb5/tree/master/ci

contains scripts that will set up either an MIT Kerberos KDC or a Heimdal
KDC with PKINIT configured and a variety of keytabs and whatnot premade.
They are used via GitHub Actions here:

https://github.com/rra/pam-krb5/blob/master/.github/workflows/build.yaml

--
Russ Allbery (eagle@eyrie.org) <https://www.eyrie.org/~eagle/>


devel / comp.protocols.kerberos / Re: 2FA with krb5

1
server_pubkey.txt

rocksolid light 0.9.81
clearnet tor