[bm...@machek.systems]

Hi all,

first of all, sorry I got confused where to post this question. 

I've setup a Guacamole system in my home environment for remote access.
In order to make things secure, I thought I setup TOTP 2 factor authentication. With my own user, enrollment and authentication isn't a problem. But as I wanted to setup things for my wife, I noticed she didn't get the enrollment screen, and was able to login with her password only.
As first authentication I use LDAP against a Samba 4 AD DC.
As I do not know which further information you need, I add no log files for now. :)

Many thanks in advance.
Bastian

Re:

[Nick Couchman <vn...@apache.org>]

On Mon, Feb 4, 2019 at 7:07 AM <bm...@machek.systems> wrote:

> Hi Nick,
>
> thank you for your quick reply.
> Yes, my wife's account is also LDAP based.
>
> I gave the account of my wife the permission to change her password. That
> did the trick.
>
> Still in my understanding this is a security issue. As whenever a new LDAP
> account is created, it's not protected by TOTP.
>
>
Maybe, although a new LDAP account also will not have any access to any
connections until it is granted those privileges, so it shouldn't be that
big of a problem - when permissions are granted to the account, you can
make sure to grant permissions to change password, which should resolve the
issue.  You can also make sure you pre-create accounts within the database
module that you create in LDAP, and assign those permissions at that time.

-Nick

Re:

[bm...@machek.systems]

Hi Nick,

thank you for your quick reply.
Yes, my wife's account is also LDAP based.

I gave the account of my wife the permission to change her password. That did the trick.

Still in my understanding this is a security issue. As whenever a new LDAP account is created, it's not protected by TOTP.

Thanks again.
Bastian

3. Februar 2019 21:02, "Nick Couchman" <vnick@apache.org (mailto:vnick@apache.org?to=%22Nick%20Couchman%22%20<vn...@apache.org>)> schrieb:
 On Sun, Feb 3, 2019 at 2:17 PM <bm@machek.systems (mailto:bm@machek.systems)> wrote: 
Hi all,

first of all, sorry I got confused where to post this question. 
No worries at all! 
I've setup a Guacamole system in my home environment for remote access.
In order to make things secure, I thought I setup TOTP 2 factor authentication. With my own user, enrollment and authentication isn't a problem. But as I wanted to setup things for my wife, I noticed she didn't get the enrollment screen, and was able to login with her password only. 
For your wife's account, did you 1) create a user in the JDBC module for her (even if you're doing authentication against LDAP), and 2) does her account have permissions to modify itself? I'm not 100% certain that both those things are required, but you might give it a shot. 
As first authentication I use LDAP against a Samba 4 AD DC. 
Is this true of both your account and your wife's account? 
-Nick

Re:

[Nick Couchman <vn...@apache.org>]

On Sun, Feb 3, 2019 at 2:17 PM <bm...@machek.systems> wrote:

> Hi all,
>
> first of all, sorry I got confused where to post this question.
>

No worries at all!


>
> I've setup a Guacamole system in my home environment for remote access.
> In order to make things secure, I thought I setup TOTP 2 factor
> authentication. With my own user, enrollment and authentication isn't a
> problem. But as I wanted to setup things for my wife, I noticed she didn't
> get the enrollment screen, and was able to login with her password only.
>

For your wife's account, did you 1) create a user in the JDBC module for
her (even if you're doing authentication against LDAP), and 2) does her
account have permissions to modify itself?  I'm not 100% certain that both
those things are required, but you might give it a shot.


>
> As first authentication I use LDAP against a Samba 4 AD DC.
>

Is this true of both your account and your wife's account?

-Nick

>