On 2015-01-21 21:32, Alan DeKok wrote:
On Jan 21, 2015, at 3:13 PM, the2nd@otpme.org wrote:
there is an ongoing discussion on the samba technical list if it would be possible to use OTPs with samba/windows clients and kerberos authentication for domain logins.
That sounds like a good idea.
one solution may be to use kerberos preauth data. this is some data (e.g. a timestamp) encrypted with the user password. the user/client sends this to the kerberos server which also knows the user password and thus can decrypt it. this is just the first step when doing kerberos authentication but as far as i know from the discussion it would be possible to plug into the auth process at this point to do external otp verification.
OK.
to make this possible the preauth data would be send to the external tool via a radius request. the external tool (e.g. via exec or rlm_python) would then do the verfication and send an Access-Accept response.
That should work.
the problem is that the kerberos server, by design, needs the clear-text password/OTP. this is why i'm asking about this feature as it is a bad idea to send it in clear-text.
Yes. Clear-text is bad. There are standard provisions for doing this in RADIUS. See the Tunnel-Password attribute. My suggestion would be to just re-use that. Everyone understands it, and using it requires as few changes as possible.
currently there is no code that does this and it's not clear if there is someone who is willing to implement it.
If it’s RADIUS related, I can help...
but it would be a great improvement to samba and windows security and if i'm not completely wrong with my assumptions it would be possible to use it without any windows client modifications.
Someone would need to implement RADIUS, right?
you can find the discussion here: http://samba.2283325.n4.nabble.com/Re-Samba-OTP-authentication-td4679491.htm...
currently i have not brought radius into the discussion as i first wanted to ask on this list if something like this would be possible.
If you do end up using RADIUS, *please* include me in the overall design. I can help design something that is (a) simple, (b) functional, and (c) easily implemented by everyone.
i personally would be very happy if anyone would do the job as i do not have the skill to do it. :) currently i'm learning python as my first language and i've done some progess on this but i'm far away from being an experienced dev. ;) as far as i know samba uses a fork of heimdal for kerberos authentication. Andrew Bartlett pointed me to the technical list and he was talking about some kdc plugin architecture. but he was talking about generating the OTPs from within the kdc. that's not whats we need for this. maybe it's a good idea that you join the discussion on the samba list? i guess i cannot help with anything related to samba/kerberos development. :) i can forward the latest mail to you if you want. regards the2nd
I’ve seen too many RADIUS designs where people just go implement some random thing. It’s specific to one vendor, and makes life harder for everyone else.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html