View source for Two-factor auth met Google Authenticator

Bron: [http://www.supertechguy.com/help/security/freeradius-google-auth]
=Ervaringen=
==Synology==
google-authenticator lijkt reeds aanwezig. De pam module lijkt echter te ontbreken
==Raspberry Pi==
De libpam-google-authenticator kan worden geinstalleerd uit de standaard repository. De libpam module wordt op de verkeerde plaats geinstalleerd dus er moet nog een symlink worden gemaakt:
 ln /lib/security/pam_google_authenticator.so /lib/arm-linux-gnueabihf/security/pam_google_authenticator.so
Vervolgens is de package vrij oud waardoor alleen optie 1 en 2 zijn ondersteund.

=Installatie software=
Installeer Freeradius, ntp en de google authenticator module
 apt-get install freeradius libqrencode3 ntp libpam-google-authenticator

Alleen als het package libpam-google-authenticator niet beschikbaar is zou je deze zelf moeten maken:
 apt-get install libpam0g-dev build-essential git 
 git clone https://code.google.com/p/google-authenticator/
 cd google-authenticator/libpam/
 make
 make install

=Configuratie software=
==/etc/freeradius/users==
Zoek de volgende regels op in de configuratie:

 #
 # Deny access for a group of users.
 #
 # Note that there is NO 'Fall-Through' attribute, so the user will not
 # be given any additional resources.
 #

Indien je niet alle users toegang wil geven via radius kan je onderstaande regels invoegen om een groep radius-disabled te kunnen gebruiken. Wanneer een user hier lid van is zal hij geen toegang krijgen

 DEFAULT         Group == "radius-disabled", Auth-Type := Reject
                 Reply-Message = "Your account has been disabled."

In beide gevallen dient onderstaande regel toe te worden gevoegd:

 DEFAULT        Auth-Type := PAM

==/etc/freeradius/sites-enabled/default==

Zoek de volgende tekst op in de configuratie:

 authenticate {
 [..] 
         #  Pluggable Authentication Modules.
 #       pam

Haal het #-teken weg zodat pam ook wordt ingeladen.

        #  Pluggable Authentication Modules.
        pam

==/etc/pam.d/radiusd==
Hier kan je kiezen wat je radius server moet controleren. De opties zijn:
# Linux Wachtwoord + code checken
# Alleen code checken (lokale user vereist)
# Code checken van een non-local user

Bij optie 1 moet je inloggen met [wachtwoord][code] om op die manier zowel het password als de code door te geven aan de radius server.

Indien password check op een ander systeem reeds wordt uitgevoerd kan je er ook voor kiezen om alleen de code te checken.

 # /etc/pam.d/radiusd - PAM configuration for FreeRADIUS                                                                      
 #                                                                                                                            
 
 # We fall back to the system default in /etc/pam.d/common-*                                                                  
 #                                                                                                                            
 ## Remove these:
 #@include common-auth                                                                                                        
 #@include common-account                                                                                                     
 #@include common-password                                                                                                    
 #@include common-session  
 ## Add one of these:                                                                                                   
 ## Option 1: pass+code 
 #auth requisite pam_google_authenticator.so forward_pass
 #auth required pam_unix.so use_first_pass
 ## Option 2: code
 #auth required pam_google_authenticator.so
 ## Option 3: code for non-local user
 account required pam_permit.so skip_first_pass
 auth required pam_google_authenticator.so user=freerad secret=/path/to/${USER}_google_authenticator

In het geval van optie 3 heb je de mogelijkheid om de radius server als een niet-root user te draaien (zie ook volgende paragraaf).
De files dienen 0400 ge-chmod te zijn (alleen lezen), de eigenaar moet overeenkomen met de radius user en maak je de files aan met:
 google-authenticator -s /path/to/testuser_google_authenticator
 chown [radius user]:[radius groep] /path/to/testuser_google_authenticator

==/etc/freeradius/radusd.conf==
'''Alleen''' indien in de vorige paragraaf niet is gekozen voor optie 3 zal de freeradius user aangepast moeten worden naar root. 
Anders heeft radius geen rechten om de google_authenticator file in de home-dir van alle gebruikers uit te lezen.

Vervang
 user = freerad
 group = freerad
door
 user = root
 group = root

=User Configuratie=
==Optie 3 gekozen?==
We hebben geen lokale user nodig, we moeten wel een google_authenticator file aanmaken voor de nieuwe 'radius' user.
 test@FreeDualFactor:~$ google-authenticator -s /path/to/testuser_google_authenticator
 
 Do you want authentication tokens to be time-based (y/n) y
 https://www.google.com/chart?chs=200x200&chld=[..]
                                                                        
 Your new secret key is: XQH7L6A7W6OK3JYS
 Your verification code is 158428
 Your emergency scratch codes are:
   60469537
   95985887
   80580778
   52386153
   52951956 
 
 Do you want me to update your "/path/to/testuser_google_authenticator" file (y/n) y
 
 Do you want to disallow multiple uses of the same authentication
 token? This restricts you to one login about every 30s, but it increases
 your chances to notice or even prevent man-in-the-middle attacks (y/n) y
 
 By default, tokens are good for 30 seconds and in order to compensate for
 possible time-skew between the client and the server, we allow an extra
 token before and after the current time. If you experience problems with poor
 time synchronization, you can increase the window from its default
 size of 1:30min to about 4min. Do you want to do so (y/n) n  
 
 If the computer that you are logging into isn't hardened against brute-force
 login attempts, you can enable rate-limiting for the authentication module.
 By default, this limits attackers to no more than 3 login attempts every 30s.
 Do you want to enable rate-limiting (y/n) y 

De QR code die je daarna krijgt importeer je op je google authenticator app.

De file moet nog worden aangepast zodat hij de juiste rechten heeft:
 chmod 0400 /path/to/testuser_google_authenticator
 chown freerad:freerad /path/to/testuser_google_authenticator

Herstart radius
 service freeradius restart

Nu willen we het geheel gaan testen. In de clients.conf van /etc/freeradius staat standaard localhost als radius client geconfigureerd. Hier wil je straks ook je radius clients toevoegen. Nu gebruiken we even de default instellingen om lokaal te testen of het geheel werkt:
 radtest testuser 696720 localhost 123 testing123

En als alles goed gaat:
 root@FreeDualFactor:~# radtest testuser 696720 localhost 123 testing123
 Sending Access-Request of id 154 to 127.0.0.1 port 1812
 User-Name = "testuser"
 User-Password = "696720"
 NAS-IP-Address = 127.0.1.1
 NAS-Port = 123
 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=154, length=20 

==Optie 1 of 2 gekozen?==
Setup a local test user
 adduser test

choose a easy password to remember, for this example I used "test123"

 cd /home/test/
 su test
 google-authenticator

If everything worked right you should see something that looks like this:

 test@FreeDualFactor:~$ google-authenticator 
 
 Do you want authentication tokens to be time-based (y/n) y
 https://www.google.com/chart?chs=200x200&chld=[..]
                                                                        
 Your new secret key is: XQH7L6A7W6OK3JYS
 Your verification code is 158428
 Your emergency scratch codes are:
   60469537
   95985887
   80580778
   52386153
   52951956 
 
 Do you want me to update your "/home/test/.google_authenticator" file (y/n) y
 
 Do you want to disallow multiple uses of the same authentication
 token? This restricts you to one login about every 30s, but it increases
 your chances to notice or even prevent man-in-the-middle attacks (y/n) y
 
 By default, tokens are good for 30 seconds and in order to compensate for
 possible time-skew between the client and the server, we allow an extra
 token before and after the current time. If you experience problems with poor
 time synchronization, you can increase the window from its default
 size of 1:30min to about 4min. Do you want to do so (y/n) n 
 
 If the computer that you are logging into isn't hardened against brute-force
 login attempts, you can enable rate-limiting for the authentication module.
 By default, this limits attackers to no more than 3 login attempts every 30s.
 Do you want to enable rate-limiting (y/n) y 
 
You can configure yours how you see fit.

Scan once you get your custom QR Code, scan it in to your Google Authenticator App.

The App should generate a rotating code that you can use for your dual factor authentication. 

Test your Configuration
 service freeradius restart
 
You will want to use a command called "radtest" to test your configuration.

 radtest <username> <unix_password><google_auth> localhost 18120 testing123

testing123 is a default secret for the localhost client, used for testing purposes.  You can find this in /etc/freeradius/clients.conf

so since my password is "test123" and the current google authenticator key is "696720" my test looks like this:

 radtest test test123696720 localhost 18120 testing123

If it works right, you should get something like this:

 root@FreeDualFactor:~# radtest test test123696720 localhost 18120 testing123
 Sending Access-Request of id 154 to 127.0.0.1 port 1812
 User-Name = "test"
 User-Password = "test123696720"
 NAS-IP-Address = 127.0.1.1
 NAS-Port = 18120
 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=154, length=20 

Debugging

if for some strange reason it doesn't work.  You can stop freeradius and start it up in debugging mode like this:

 service freeradius stop
 freeradius -XXX