January 30th, 2016 FOSDEM’16 Enterprise desktop at home with FreeIPA and GNOME Alexander Bokovoy ( abokovoy@redhat.com )
Enterprise desktop at home with FreeIPA and GNOME 2 Enterprise?
Enterprise desktop at home with FreeIPA and GNOME 3 * almost local offjce network is not managed by a company’s IT department
Enterprise desktop at home with FreeIPA and GNOME 4 * almost company services’ hosting is cloudy there is no one cloud to rule them all
Enterprise desktop at home with FreeIPA and GNOME 5 * almost I have FEW identities: Home-bound identity to access local resources Cloud-based (social networking) identities Free Software hats to wear Certifjcates and smart cards to present myself legally Private data to protect and share I want them to be usable at the same time ▶ A corporate identity for services sign-on
Enterprise desktop at home with FreeIPA and GNOME 6 * almost I have FEW identities: Cloud-based (social networking) identities Free Software hats to wear Certifjcates and smart cards to present myself legally Private data to protect and share I want them to be usable at the same time ▶ A corporate identity for services sign-on ▶ Home-bound identity to access local resources
Enterprise desktop at home with FreeIPA and GNOME 7 * almost I have FEW identities: Free Software hats to wear Certifjcates and smart cards to present myself legally Private data to protect and share I want them to be usable at the same time ▶ A corporate identity for services sign-on ▶ Home-bound identity to access local resources ▶ Cloud-based (social networking) identities
Enterprise desktop at home with FreeIPA and GNOME 8 * almost I have FEW identities: Certifjcates and smart cards to present myself legally Private data to protect and share I want them to be usable at the same time ▶ A corporate identity for services sign-on ▶ Home-bound identity to access local resources ▶ Cloud-based (social networking) identities ▶ Free Software hats to wear
Enterprise desktop at home with FreeIPA and GNOME 9 * almost I have FEW identities: Private data to protect and share I want them to be usable at the same time ▶ A corporate identity for services sign-on ▶ Home-bound identity to access local resources ▶ Cloud-based (social networking) identities ▶ Free Software hats to wear ▶ Certifjcates and smart cards to present myself legally
Enterprise desktop at home with FreeIPA and GNOME 10 * almost I have FEW identities: I want them to be usable at the same time ▶ A corporate identity for services sign-on ▶ Home-bound identity to access local resources ▶ Cloud-based (social networking) identities ▶ Free Software hats to wear ▶ Certifjcates and smart cards to present myself legally ▶ Private data to protect and share
Enterprise desktop at home with FreeIPA and GNOME 11 I work on FreeIPA, https://www.freeipa.org Management of identities and policies: And it is available in: 2014 ▶ stored centrally ▶ applied locally ▶ Fedora ▶ Red Hat Enterprise Linux / CentOS ▶ GNU/Linux Debian and Ubuntu ▶ https://account.gnome.org/ runs FreeIPA since october
Enterprise desktop at home with FreeIPA and GNOME 12 How enterprisey are we?
Enterprise desktop at home with FreeIPA and GNOME 13 Let’s score by a password
Enterprise desktop at home with FreeIPA and GNOME 14 Let’s score by a password A typical workfmow for every laptop reboot 1. Sign into a local system account (enter a password) 2. Jump onto virtual private network (enter a password or more) 3. Obtain initial Kerberos credentials (enter a password) 4. Use corporate applications (enter a password?)
Enterprise desktop at home with FreeIPA and GNOME 15 Let’s score by a password A typical workfmow for every laptop reboot 1. Sign into a local system account (enter a password) 2. Jump onto virtual private network (enter a password or more) 3. Obtain initial Kerberos credentials (enter a password) 4. Use corporate applications (enter a password?)
Enterprise desktop at home with FreeIPA and GNOME 16 Let’s score by a password A typical workfmow for every laptop reboot 1. Sign into a local system account (enter a password) 2. Jump onto virtual private network (enter a password or more) 3. Obtain initial Kerberos credentials (enter a password) 4. Use corporate applications (enter a password?)
Enterprise desktop at home with FreeIPA and GNOME 17 Let’s score by a password A typical workfmow for every laptop reboot 1. Sign into a local system account (enter a password) 2. Jump onto virtual private network (enter a password or more) 3. Obtain initial Kerberos credentials (enter a password) 4. Use corporate applications (enter a password?)
Enterprise desktop at home with FreeIPA and GNOME 18 Can we do better than this? how far are we from ? ▶ Sign into a corporate environment ▶ Use corporate applications
Enterprise desktop at home with FreeIPA and GNOME 19 Let’s try to login! Demo of interactive logon
Enterprise desktop at home with FreeIPA and GNOME 20 What was that? SSSD handles login and Kerberos keys Login to the system is verifjed over public network using a proxy for Kerberos protocol Established VPN connection based on Kerberos ticket Credentials were entered only once ▶ The system is confjgured to be a client for FreeIPA
Enterprise desktop at home with FreeIPA and GNOME 21 What was that? Login to the system is verifjed over public network using a proxy for Kerberos protocol Established VPN connection based on Kerberos ticket Credentials were entered only once ▶ The system is confjgured to be a client for FreeIPA ▶ SSSD handles login and Kerberos keys
Enterprise desktop at home with FreeIPA and GNOME 22 What was that? proxy for Kerberos protocol Established VPN connection based on Kerberos ticket Credentials were entered only once ▶ The system is confjgured to be a client for FreeIPA ▶ SSSD handles login and Kerberos keys ▶ Login to the system is verifjed over public network using a
Enterprise desktop at home with FreeIPA and GNOME 23 What was that? proxy for Kerberos protocol Credentials were entered only once ▶ The system is confjgured to be a client for FreeIPA ▶ SSSD handles login and Kerberos keys ▶ Login to the system is verifjed over public network using a ▶ Established VPN connection based on Kerberos ticket
Enterprise desktop at home with FreeIPA and GNOME 24 What was that? proxy for Kerberos protocol ▶ The system is confjgured to be a client for FreeIPA ▶ SSSD handles login and Kerberos keys ▶ Login to the system is verifjed over public network using a ▶ Established VPN connection based on Kerberos ticket ▶ Credentials were entered only once
Enterprise desktop at home with FreeIPA and GNOME 25 Kerberos proxy Available on the client side with Microsoft Active Directory and MIT Kerberos 1.13 Kerberos proxy is implemented by FreeIPA 4.2, OpenConnect Server 7.05, and as a standalone server very easy to use (one line change on the client) https://account.gnome.org to allow use of Kerberos credentials for SSH accounts for GNOME developers ▶ protocol is called MS-KKDCP ▶ transparent for Kerberos library users ▶ Requires HTTPS connection, set up by default in FreeIPA 4.2, ▶ Allows to obtain tickets from anywhere ▶ SSSD 1.12+ ▶ GNOME project has enabled KDC proxy support in
Enterprise desktop at home with FreeIPA and GNOME 26 VPN and Kerberos OpenConnect client supports GSSAPI negotiation OpenVPN does not support GSSAPI negotiation Could we enforce stronger authentication at a VPN edge? ▶ Fedora 22+ works out of the box ▶ to do since 2005 ▶ yes, we are be able to do so with Kerberos 1.14 ▶ no practical implementation in FreeIPA yet
Enterprise desktop at home with FreeIPA and GNOME 27 Two-factor authentication FreeIPA 4.x supports 2FA natively HOTP/TOTP compatible software and hardware ▶ Yubikey, FreeOTP client for Android and iOS, any ▶ Two-factor authentication is enforced on Kerberos level ▶ Performs pre-authentication before issuing a ticket ▶ Authentication Indicators are in Kerberos 1.14 ▶ Pre-authentication modules can say how tickets were issued
Enterprise desktop at home with FreeIPA and GNOME 28 FreeOTP client for Android and iOS Figure 1:
Enterprise desktop at home with FreeIPA and GNOME 29 Demo of interactive logon with 2FA Let’s create a token for a user and logon with 2FA via Yubikey
Enterprise desktop at home with FreeIPA and GNOME 30 What was that? added for the user in FreeIPA 2. SSSD handles login and notices OTP pre-authentication support in Kerberos conversation 3. Login to the system is verifjed over public network using a proxy for Kerberos protocol 4. Kerberos ticket is obtained, fjrst factor is provided by SSSD to GDM for unlocking GNOME passwords and keys storage (SeaHorse) 5. Credentials were entered only once 1. One time password token was programmed to Yubikey and
Recommend
More recommend
