You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@guacamole.apache.org by SergeyKh <ma...@gmail.com> on 2018/11/09 15:34:27 UTC
two factor auth
Hi, is there any way to configure two factor auth this way:
1. first login/password - LDAP
2. second password - RADIUS. but login is the same as the first one
?
Re: two factor auth
Posted by Nick Couchman <vn...@apache.org>.
On Mon, Nov 12, 2018 at 11:02 AM SergeyKh <ma...@gmail.com> wrote:
> oh i see. thank you very much.
> do you any have plans to make some kind of flexible authorization that
> could use one or two authorization sources like radius?
> ldap+radius or radius+radius or local-sql+radius
> ?
>
>
There are no current plans for any such functionality, aside from the ones
that are already implemented that way (TOTP and Duo). As already
mentioned, the RADIUS module handles this internally (with
challenge/response) and a RADIUS server can likely be configured to
accomplish what you're trying to do. You're welcome to take a look at the
current issues and submit a request for a new feature if you don't see one
that accomplishes what you're trying to do. Issue tracker is here:
https://issues.apache.org/jira/projects/GUACAMOLE/summary
-Nick
>
Re: two factor auth
Posted by SergeyKh <ma...@gmail.com>.
Nick i'm sorry. i'm the idiot. i replied to the wrong email....
i believe radius extension does not work well or as i mentioned earlier i'm
the idiot and i do something wrong.
it authenticates the user but cant get user to his own work space. but if i
make one and only one connection that starts automatically. i get to that
ssh/rdp session right after authorization.
if i "exit" ssh session or press "ctrl-alt-shift" i get the same error that
i've got if have no connections attached to my username.
i've tried two different radius servers to authenticate to and it is all
the same.
any thoughts?
чт, 15 нояб. 2018 г. в 14:42, SergeyKh <ma...@gmail.com>:
> chrome+f12+network shows:
>
> {"message":"Session not associated with authentication provider
> \"radius\".","translatableMessage":{"key":"Session not associated with
> authentication provider
> \"radius\".","variables":null},"statusCode":null,"expected":null,"type":"NOT_FOUND"}
>
>
>
> чт, 15 нояб. 2018 г. в 12:07, Nick Couchman <vn...@apache.org>:
>
>> On Thu, Nov 15, 2018 at 3:47 AM SergeyKh <ma...@gmail.com> wrote:
>>
>>> i've configured guacamole's radius extension to communicate with
>>> freeradius proxy as described here -
>>> https://wiki.freeradius.org/guide/2FA-Active-Directory-plus-Proxy
>>> so additional freeradius asks for login/password from my AD via LDAP
>>> and then it asks OTP from my RcDevs OTP server via radius. and it works! i
>>> can see success-auth logs everywhere
>>> and even catalina.out tells me:
>>> [http-nio-8080-exec-4] INFO o.a.g.r.auth.AuthenticationService - User
>>> "my-ad-login-name-here" successfully authenticated from my-ip-address
>>> but my browser says:
>>> An error has occurred and this action cannot be completed. If the
>>> problem persists, please notify your system administrator or check your
>>> system logs.
>>> so what system logs should i check?
>>>
>>>
>> Is there anything else in the catalina.out file around this that
>> indicates what might be going on? Also, RADIUS authentication in Guacamole
>> requires some other module to provide connections and permissions
>> management (usually SQL, but LDAP would work in your case, as well), so you
>> might try setting up one of those modules to actually store your
>> connections and see if the error goes away after that.
>>
>> -Nick
>>
>
Re: two factor auth
Posted by SergeyKh <ma...@gmail.com>.
chrome+f12+network shows:
{"message":"Session not associated with authentication provider
\"radius\".","translatableMessage":{"key":"Session not associated with
authentication provider
\"radius\".","variables":null},"statusCode":null,"expected":null,"type":"NOT_FOUND"}
чт, 15 нояб. 2018 г. в 12:07, Nick Couchman <vn...@apache.org>:
> On Thu, Nov 15, 2018 at 3:47 AM SergeyKh <ma...@gmail.com> wrote:
>
>> i've configured guacamole's radius extension to communicate with
>> freeradius proxy as described here -
>> https://wiki.freeradius.org/guide/2FA-Active-Directory-plus-Proxy
>> so additional freeradius asks for login/password from my AD via LDAP and
>> then it asks OTP from my RcDevs OTP server via radius. and it works! i can
>> see success-auth logs everywhere
>> and even catalina.out tells me:
>> [http-nio-8080-exec-4] INFO o.a.g.r.auth.AuthenticationService - User
>> "my-ad-login-name-here" successfully authenticated from my-ip-address
>> but my browser says:
>> An error has occurred and this action cannot be completed. If the problem
>> persists, please notify your system administrator or check your system logs.
>> so what system logs should i check?
>>
>>
> Is there anything else in the catalina.out file around this that indicates
> what might be going on? Also, RADIUS authentication in Guacamole requires
> some other module to provide connections and permissions management
> (usually SQL, but LDAP would work in your case, as well), so you might try
> setting up one of those modules to actually store your connections and see
> if the error goes away after that.
>
> -Nick
>
Re: two factor auth
Posted by SergeyKh <ma...@gmail.com>.
i've installed mysql and now i can log in as guacadmin.
added user with the same username as ldap user has.
but still get the same error
localhost_access_log:
[15/Nov/2018:13:56:32 +0300] "POST /guacamole/api/tokens HTTP/1.1" 200 191
[15/Nov/2018:13:56:32 +0300] "GET
/guacamole/api/patches?token=F5F94D53360FE3D543985CFC099017CA8460645442374D118731D11ADD9FBC12
HTTP/1.1" 200 352
[15/Nov/2018:13:56:32 +0300] "POST /guacamole/api/tokens HTTP/1.1" 200 191
[15/Nov/2018:13:56:32 +0300] "GET
/guacamole/api/session/data/mysql-shared/connectionGroups/ROOT/tree?token=F5F94D53360FE3D543985CFC099017CA8460645442374D118731D11ADD9FBC12
HTTP/1.1"
[15/Nov/2018:13:56:32 +0300] "GET
/guacamole/api/session/data/mysql-shared/self/permissions?token=F5F94D53360FE3D543985CFC099017CA8460645442374D118731D11ADD9FBC12
HTTP/1.1" 200 247
[15/Nov/2018:13:56:32 +0300] "GET
/guacamole/api/session/data/mysql/self/permissions?token=F5F94D53360FE3D543985CFC099017CA8460645442374D118731D11ADD9FBC12
HTTP/1.1" 200 232
[15/Nov/2018:13:56:32 +0300] "GET
/guacamole/api/session/data/mysql/connectionGroups/ROOT/tree?token=F5F94D53360FE3D543985CFC099017CA8460645442374D118731D11ADD9FBC12
HTTP/1.1" 200 108
[15/Nov/2018:13:56:32 +0300] "GET
/guacamole/api/session/data/mysql-shared/activeConnections?token=F5F94D53360FE3D543985CFC099017CA8460645442374D118731D11ADD9FBC12
HTTP/1.1" 200 12
[15/Nov/2018:13:56:32 +0300] "GET
/guacamole/api/session/data/radius/users/MY-LDAP-USERNAME-HERE?token=F5F94D53360FE3D543985CFC099017CA8460645442374D118731D11ADD9FBC12
HTTP/1.1" 404 254
[15/Nov/2018:13:56:32 +0300] "GET
/guacamole/api/session/data/mysql-shared/self/effectivePermissions?token=F5F94D53360FE3D543985CFC099017CA8460645442374D118731D11ADD9FBC12
HTTP/1.1" 2
[15/Nov/2018:13:56:32 +0300] "GET
/guacamole/api/session/data/mysql/activeConnections?token=F5F94D53360FE3D543985CFC099017CA8460645442374D118731D11ADD9FBC12
HTTP/1.1" 200 12
[15/Nov/2018:13:56:32 +0300] "GET
/guacamole/api/session/data/mysql/self/effectivePermissions?token=F5F94D53360FE3D543985CFC099017CA8460645442374D118731D11ADD9FBC12
HTTP/1.1" 200 232
so there is still 404
чт, 15 нояб. 2018 г. в 12:07, Nick Couchman <vn...@apache.org>:
> On Thu, Nov 15, 2018 at 3:47 AM SergeyKh <ma...@gmail.com> wrote:
>
>> i've configured guacamole's radius extension to communicate with
>> freeradius proxy as described here -
>> https://wiki.freeradius.org/guide/2FA-Active-Directory-plus-Proxy
>> so additional freeradius asks for login/password from my AD via LDAP and
>> then it asks OTP from my RcDevs OTP server via radius. and it works! i can
>> see success-auth logs everywhere
>> and even catalina.out tells me:
>> [http-nio-8080-exec-4] INFO o.a.g.r.auth.AuthenticationService - User
>> "my-ad-login-name-here" successfully authenticated from my-ip-address
>> but my browser says:
>> An error has occurred and this action cannot be completed. If the problem
>> persists, please notify your system administrator or check your system logs.
>> so what system logs should i check?
>>
>>
> Is there anything else in the catalina.out file around this that indicates
> what might be going on? Also, RADIUS authentication in Guacamole requires
> some other module to provide connections and permissions management
> (usually SQL, but LDAP would work in your case, as well), so you might try
> setting up one of those modules to actually store your connections and see
> if the error goes away after that.
>
> -Nick
>
Re: two factor auth
Posted by SergeyKh <ma...@gmail.com>.
nope. catalina.out hasn't got anything else
but localhost_access_log has:
6.10 - - [15/Nov/2018:12:42:08 +0300] "GET
/guacamole/api/patches?token=F4E3D0DC6986A46CB6B33424EB8C80827BC27F7844B71C56625C3ED47B880058
HTTP/1.1" 200 12
6.10 - - [15/Nov/2018:12:42:08 +0300] "GET
/guacamole/api/languages?token=F4E3D0DC6986A46CB6B33424EB8C80827BC27F7844B71C56625C3ED47B880058
HTTP/1.1" 200 171
6.10 - - [15/Nov/2018:12:42:08 +0300] "POST /guacamole/api/tokens HTTP/1.1"
200 169
6.10 - - [15/Nov/2018:12:42:08 +0300] "GET
/guacamole/api/session/data/radius/users/my-AD-username?token=F4E3D0DC6986A46CB6B33424EB8C80827BC27F7844B71C56625C3ED47B880058
HTTP/1.1" 404 254
so there is 404. what is it that can't be found?
чт, 15 нояб. 2018 г. в 12:07, Nick Couchman <vn...@apache.org>:
> On Thu, Nov 15, 2018 at 3:47 AM SergeyKh <ma...@gmail.com> wrote:
>
>> i've configured guacamole's radius extension to communicate with
>> freeradius proxy as described here -
>> https://wiki.freeradius.org/guide/2FA-Active-Directory-plus-Proxy
>> so additional freeradius asks for login/password from my AD via LDAP and
>> then it asks OTP from my RcDevs OTP server via radius. and it works! i can
>> see success-auth logs everywhere
>> and even catalina.out tells me:
>> [http-nio-8080-exec-4] INFO o.a.g.r.auth.AuthenticationService - User
>> "my-ad-login-name-here" successfully authenticated from my-ip-address
>> but my browser says:
>> An error has occurred and this action cannot be completed. If the problem
>> persists, please notify your system administrator or check your system logs.
>> so what system logs should i check?
>>
>>
> Is there anything else in the catalina.out file around this that indicates
> what might be going on? Also, RADIUS authentication in Guacamole requires
> some other module to provide connections and permissions management
> (usually SQL, but LDAP would work in your case, as well), so you might try
> setting up one of those modules to actually store your connections and see
> if the error goes away after that.
>
> -Nick
>
--
С уважением,
Сергей Хворостяной
Re: two factor auth
Posted by Nick Couchman <vn...@apache.org>.
On Thu, Nov 15, 2018 at 3:47 AM SergeyKh <ma...@gmail.com> wrote:
> i've configured guacamole's radius extension to communicate with
> freeradius proxy as described here -
> https://wiki.freeradius.org/guide/2FA-Active-Directory-plus-Proxy
> so additional freeradius asks for login/password from my AD via LDAP and
> then it asks OTP from my RcDevs OTP server via radius. and it works! i can
> see success-auth logs everywhere
> and even catalina.out tells me:
> [http-nio-8080-exec-4] INFO o.a.g.r.auth.AuthenticationService - User
> "my-ad-login-name-here" successfully authenticated from my-ip-address
> but my browser says:
> An error has occurred and this action cannot be completed. If the problem
> persists, please notify your system administrator or check your system logs.
> so what system logs should i check?
>
>
Is there anything else in the catalina.out file around this that indicates
what might be going on? Also, RADIUS authentication in Guacamole requires
some other module to provide connections and permissions management
(usually SQL, but LDAP would work in your case, as well), so you might try
setting up one of those modules to actually store your connections and see
if the error goes away after that.
-Nick
Re: two factor auth
Posted by SergeyKh <ma...@gmail.com>.
Mike, thanks.
but now i need your help...
i've configured guacamole's radius extension to communicate with freeradius
proxy as described here -
https://wiki.freeradius.org/guide/2FA-Active-Directory-plus-Proxy
so additional freeradius asks for login/password from my AD via LDAP and
then it asks OTP from my RcDevs OTP server via radius. and it works! i can
see success-auth logs everywhere
and even catalina.out tells me:
[http-nio-8080-exec-4] INFO o.a.g.r.auth.AuthenticationService - User
"my-ad-login-name-here" successfully authenticated from my-ip-address
but my browser says:
An error has occurred and this action cannot be completed. If the problem
persists, please notify your system administrator or check your system logs.
so what system logs should i check?
ps i do not have sql server configured so i do not have any connections.
but it was not problem when i was playing with ldap-auth-extension
пн, 12 нояб. 2018 г. в 19:23, Mike Jumper <mj...@apache.org>:
> On Mon, Nov 12, 2018, 08:02 SergeyKh <mail4sergey@gmail.com wrote:
>
>> oh i see. thank you very much.
>> do you any have plans to make some kind of flexible authorization that
>> could use one or two authorization sources like radius?
>> ldap+radius or radius+radius or local-sql+radius
>> ?
>>
>
> Guacamole does already do this. Once the user has been authenticated, each
> extension is polled to authorize that user for the resources provided by
> that extension, if any. There can be only one source of identity, but all
> other extensions have the option to further verify, ignore, or veto that
> identification.
>
> Based on your past emails to this list, I don't think what you're looking
> for is multiple sources of authorization (which Guacamole does provide) or
> multiple sources of authentication (which Guacamole also provides), but
> rather allowing RADIUS to function as an additional authentication factor
> rather than the first factor.
>
> There are no current plans to modify the RADIUS support to allow it to
> function as an additional factor on top of other authentication mechanisms.
> If this truly is a standard arrangement - RADIUS serving as a
> second/third/etc. factor on top of whatever source has provided the base
> authentication, then I'm sure there will be such plans, though we'd need to
> see some documentation of that standard use. I'm not personally familiar
> enough with RADIUS to judge either way at the moment.
>
> - Mike
>
>
Re: two factor auth
Posted by Mike Jumper <mj...@apache.org>.
On Mon, Nov 12, 2018, 08:02 SergeyKh <mail4sergey@gmail.com wrote:
> oh i see. thank you very much.
> do you any have plans to make some kind of flexible authorization that
> could use one or two authorization sources like radius?
> ldap+radius or radius+radius or local-sql+radius
> ?
>
Guacamole does already do this. Once the user has been authenticated, each
extension is polled to authorize that user for the resources provided by
that extension, if any. There can be only one source of identity, but all
other extensions have the option to further verify, ignore, or veto that
identification.
Based on your past emails to this list, I don't think what you're looking
for is multiple sources of authorization (which Guacamole does provide) or
multiple sources of authentication (which Guacamole also provides), but
rather allowing RADIUS to function as an additional authentication factor
rather than the first factor.
There are no current plans to modify the RADIUS support to allow it to
function as an additional factor on top of other authentication mechanisms.
If this truly is a standard arrangement - RADIUS serving as a
second/third/etc. factor on top of whatever source has provided the base
authentication, then I'm sure there will be such plans, though we'd need to
see some documentation of that standard use. I'm not personally familiar
enough with RADIUS to judge either way at the moment.
- Mike
Re: two factor auth
Posted by SergeyKh <ma...@gmail.com>.
oh i see. thank you very much.
do you any have plans to make some kind of flexible authorization that
could use one or two authorization sources like radius?
ldap+radius or radius+radius or local-sql+radius
?
пн, 12 нояб. 2018 г. в 18:53, Mike Jumper <mj...@apache.org>:
> On Mon, Nov 12, 2018, 07:43 SergeyKh <mail4sergey@gmail.com wrote:
>
>> but isn't https://github.com/apache/guacamole-client/ the 1.0.0
>> release?
>>
>
> No, that is a git repository, the current development source. Releases are
> ultimately cut from that source and listed on the website when officially
> released:
>
> http://guacamole.apache.org/releases/
>
> Releases are also given corresponding tags in git, to mark the point in
> the source history that each release comes from:
>
> https://github.com/apache/guacamole-client/tags
> https://github.com/apache/guacamole-server/tags
> https://github.com/apache/guacamole-manual/tags
>
> An announcement is also made to the mailing lists one a release goes out.
>
> - Mike
>
>
--
С уважением,
Сергей Хворостяной
Re: two factor auth
Posted by Mike Jumper <mj...@apache.org>.
On Mon, Nov 12, 2018, 07:43 SergeyKh <mail4sergey@gmail.com wrote:
> but isn't https://github.com/apache/guacamole-client/ the 1.0.0
> release?
>
No, that is a git repository, the current development source. Releases are
ultimately cut from that source and listed on the website when officially
released:
http://guacamole.apache.org/releases/
Releases are also given corresponding tags in git, to mark the point in the
source history that each release comes from:
https://github.com/apache/guacamole-client/tags
https://github.com/apache/guacamole-server/tags
https://github.com/apache/guacamole-manual/tags
An announcement is also made to the mailing lists one a release goes out.
- Mike
Re: two factor auth
Posted by SergeyKh <ma...@gmail.com>.
but isn't https://github.com/apache/guacamole-client/ the 1.0.0
release?
пн, 12 нояб. 2018 г. в 18:36, Mike Jumper <mj...@apache.org>:
> On Mon, Nov 12, 2018, 07:28 SergeyKh <mail4sergey@gmail.com wrote:
>
>> Currently, in order for 2FA to work in Guacamole, either one of two
>> things needs to happen:
>> 1) A module has to specifically be written to intercept the
>> authentication process and force the second factor. The TOTP module, which
>> will be released in 1.0.0, is designed to do exactly that, as does the
>> already-released Duo module.
>> 2) The module doing the authentication has to handle some sort of
>> Challenge/Response conversation, where initial authentication is accepted
>> and additional factors are then given to the user. The RADIUS
>> authentication module is currently the only one that will handle this.
>>
>> but how can i enable those extensions? maven had built jar for the TOTP
>> but i can see no man pages how to use it. are there any?
>>
>
> Yes. As Nick notes, however, TOTP is part of 1.0.0, thus documentation
> covering that extension will not be uploaded to the website until 1.0.0 is
> released.
>
> If you're looking to test things prior to release and would like
> corresponding docs, you can build the manual yourself here:
>
> https://github.com/apache/guacamole-manual
>
> Most of the documentation updates for 1.0.0 have been completed.
>
> and no jar at all for the radius extension and also no documentation....
>> or i just could not find it....
>>
>
> RADIUS support is also part of the upcoming 1.0.0 release:
>
> https://issues.apache.org/jira/browse/GUACAMOLE-197
>
> - Mike
>
>
--
С уважением,
Сергей Хворостяной
Re: two factor auth
Posted by Mike Jumper <mj...@apache.org>.
On Mon, Nov 12, 2018, 07:28 SergeyKh <mail4sergey@gmail.com wrote:
> Currently, in order for 2FA to work in Guacamole, either one of two things
> needs to happen:
> 1) A module has to specifically be written to intercept the authentication
> process and force the second factor. The TOTP module, which will be
> released in 1.0.0, is designed to do exactly that, as does the
> already-released Duo module.
> 2) The module doing the authentication has to handle some sort of
> Challenge/Response conversation, where initial authentication is accepted
> and additional factors are then given to the user. The RADIUS
> authentication module is currently the only one that will handle this.
>
> but how can i enable those extensions? maven had built jar for the TOTP
> but i can see no man pages how to use it. are there any?
>
Yes. As Nick notes, however, TOTP is part of 1.0.0, thus documentation
covering that extension will not be uploaded to the website until 1.0.0 is
released.
If you're looking to test things prior to release and would like
corresponding docs, you can build the manual yourself here:
https://github.com/apache/guacamole-manual
Most of the documentation updates for 1.0.0 have been completed.
and no jar at all for the radius extension and also no documentation.... or
> i just could not find it....
>
RADIUS support is also part of the upcoming 1.0.0 release:
https://issues.apache.org/jira/browse/GUACAMOLE-197
- Mike
Re: two factor auth
Posted by SergeyKh <ma...@gmail.com>.
Currently, in order for 2FA to work in Guacamole, either one of two things
needs to happen:
1) A module has to specifically be written to intercept the authentication
process and force the second factor. The TOTP module, which will be
released in 1.0.0, is designed to do exactly that, as does the
already-released Duo module.
2) The module doing the authentication has to handle some sort of
Challenge/Response conversation, where initial authentication is accepted
and additional factors are then given to the user. The RADIUS
authentication module is currently the only one that will handle this.
but how can i enable those extensions? maven had built jar for the TOTP but
i can see no man pages how to use it. are there any?
and no jar at all for the radius extension and also no documentation.... or
i just could not find it....
сб, 10 нояб. 2018 г. в 16:33, Nick Couchman <vn...@apache.org>:
> On Sat, Nov 10, 2018 at 2:43 AM SergeyKh <ma...@gmail.com> wrote:
>
>> i've already got several otp servers that can be accessed by radius and
>> i've got AD(ldap) that also can be accessed by radius. The question was how
>> to enable 2fa in guacamole so it could ask two passwords for one login from
>> two different radius services.
>>
>
> Sure, I understand, but trying to authentication Guacamole from two
> different RADIUS services is currently not possible. The way to accomplish
> this at this point in time is to have RADIUS handle the entire
> authentication process for you, including the challenge/response (second
> factor).
>
> If might be possible to set up FreeRADIUS to front the other two RADIUS
> services (almost like a proxy) and handle the initial authentication to AD
> and then challenge/response to your 2FA RADIUS, but I've never tried to do
> that, so I can't comment on the difficulty of that configuration.
>
>
>>
>> I think that is the perfect way to have authorization process. Cisco asa,
>> citrix netscaler, vmware horizon connection server can do it this way and
>> so on. I know it's all enterprise products that costs a lot but the logic
>> is simple and it works very well so it would be just wonderful if there is
>> the way to do it in guacamole because guacamole is just unbelievable good.
>>
>
> Currently, in order for 2FA to work in Guacamole, either one of two things
> needs to happen:
> 1) A module has to specifically be written to intercept the authentication
> process and force the second factor. The TOTP module, which will be
> released in 1.0.0, is designed to do exactly that, as does the
> already-released Duo module.
> 2) The module doing the authentication has to handle some sort of
> Challenge/Response conversation, where initial authentication is accepted
> and additional factors are then given to the user. The RADIUS
> authentication module is currently the only one that will handle this.
>
>
>>
>> By the way linotp does not have easy radius integration. Rcdevs (free for
>> 40 users) does and works well and it's got push to it's own mobile app.
>>
>>
> Actually, from experience, configuring RADIUS to authenticate from LinOTP
> is relatively easy. I've set it up three separate times, including once in
> a 500-employee production environment, and, while I will admin it isn't
> without its gotchas, it isn't all that difficult. Furthermore, LinOTP +
> FreeRADIUS is completely open source and free for as many users as you'd
> like. LinOTP also has appliance-type options you can purchase from them
> that have all of that functionality integrated if you aren't up to doing it
> yourself. I'm not familiar at all with Rcdevs, so I cannot comment on
> that, but I have read-world experience with LinOTP + FreeRADIUS and it
> didn't take very much work to get it going.
>
> However, I do understand if you already have your existing RADIUS
> environment configured that ripping and replacing may not be an option. I
> was just offering an alternative that I have personally implemented and
> know works well.
>
> -Nick
>
>>
Re: two factor auth
Posted by Nick Couchman <vn...@apache.org>.
On Sat, Nov 10, 2018 at 2:43 AM SergeyKh <ma...@gmail.com> wrote:
> i've already got several otp servers that can be accessed by radius and
> i've got AD(ldap) that also can be accessed by radius. The question was how
> to enable 2fa in guacamole so it could ask two passwords for one login from
> two different radius services.
>
Sure, I understand, but trying to authentication Guacamole from two
different RADIUS services is currently not possible. The way to accomplish
this at this point in time is to have RADIUS handle the entire
authentication process for you, including the challenge/response (second
factor).
If might be possible to set up FreeRADIUS to front the other two RADIUS
services (almost like a proxy) and handle the initial authentication to AD
and then challenge/response to your 2FA RADIUS, but I've never tried to do
that, so I can't comment on the difficulty of that configuration.
>
> I think that is the perfect way to have authorization process. Cisco asa,
> citrix netscaler, vmware horizon connection server can do it this way and
> so on. I know it's all enterprise products that costs a lot but the logic
> is simple and it works very well so it would be just wonderful if there is
> the way to do it in guacamole because guacamole is just unbelievable good.
>
Currently, in order for 2FA to work in Guacamole, either one of two things
needs to happen:
1) A module has to specifically be written to intercept the authentication
process and force the second factor. The TOTP module, which will be
released in 1.0.0, is designed to do exactly that, as does the
already-released Duo module.
2) The module doing the authentication has to handle some sort of
Challenge/Response conversation, where initial authentication is accepted
and additional factors are then given to the user. The RADIUS
authentication module is currently the only one that will handle this.
>
> By the way linotp does not have easy radius integration. Rcdevs (free for
> 40 users) does and works well and it's got push to it's own mobile app.
>
>
Actually, from experience, configuring RADIUS to authenticate from LinOTP
is relatively easy. I've set it up three separate times, including once in
a 500-employee production environment, and, while I will admin it isn't
without its gotchas, it isn't all that difficult. Furthermore, LinOTP +
FreeRADIUS is completely open source and free for as many users as you'd
like. LinOTP also has appliance-type options you can purchase from them
that have all of that functionality integrated if you aren't up to doing it
yourself. I'm not familiar at all with Rcdevs, so I cannot comment on
that, but I have read-world experience with LinOTP + FreeRADIUS and it
didn't take very much work to get it going.
However, I do understand if you already have your existing RADIUS
environment configured that ripping and replacing may not be an option. I
was just offering an alternative that I have personally implemented and
know works well.
-Nick
>
Re: two factor auth
Posted by SergeyKh <ma...@gmail.com>.
i've already got several otp servers that can be accessed by radius and
i've got AD(ldap) that also can be accessed by radius. The question was how
to enable 2fa in guacamole so it could ask two passwords for one login from
two different radius services.
I think that is the perfect way to have authorization process. Cisco asa,
citrix netscaler, vmware horizon connection server can do it this way and
so on. I know it's all enterprise products that costs a lot but the logic
is simple and it works very well so it would be just wonderful if there is
the way to do it in guacamole because guacamole is just unbelievable good.
By the way linotp does not have easy radius integration. Rcdevs (free for
40 users) does and works well and it's got push to it's own mobile app.
сб, 10 нояб. 2018 г., 0:33 Nick Couchman vnick@apache.org:
> On Fri, Nov 9, 2018 at 11:23 SergeyKh <ma...@gmail.com> wrote:
>
>> That would be nice too. Is there any manual how can i do it?
>>
>>>
> I'd suggest you check out LinOTP - It integrates LDAP with 2FA, and has
> relatively easy integration with FreeRADIUS. I'm sure there are other
> instructions out there for configuring various RADIUS servers to talk to
> various LDAP implementations if you don't want to go the LinOTP route.
>
> -Nick
>
>>
Re: two factor auth
Posted by Nick Couchman <vn...@apache.org>.
On Fri, Nov 9, 2018 at 11:23 SergeyKh <ma...@gmail.com> wrote:
> That would be nice too. Is there any manual how can i do it?
>
>>
I'd suggest you check out LinOTP - It integrates LDAP with 2FA, and has
relatively easy integration with FreeRADIUS. I'm sure there are other
instructions out there for configuring various RADIUS servers to talk to
various LDAP implementations if you don't want to go the LinOTP route.
-Nick
>
Re: two factor auth
Posted by SergeyKh <ma...@gmail.com>.
That would be nice too. Is there any manual how can i do it?
пт, 9 нояб. 2018 г., 19:13 Nick Couchman vnick@apache.org:
> On Fri, Nov 9, 2018 at 10:34 AM SergeyKh <ma...@gmail.com> wrote:
>
>>
>>
>> Hi, is there any way to configure two factor auth this way:
>> 1. first login/password - LDAP
>> 2. second password - RADIUS. but login is the same as the first one
>>
>>
> I do not believe this is possible, no, at least not the way the modules
> are currently written. If you're going to go this route, why not just have
> RADIUS do both legs of the authentication - first, against LDAP, then with
> the second factor?
>
> -Nick
>
>>
Re: two factor auth
Posted by Nick Couchman <vn...@apache.org>.
On Fri, Nov 9, 2018 at 10:34 AM SergeyKh <ma...@gmail.com> wrote:
>
>
> Hi, is there any way to configure two factor auth this way:
> 1. first login/password - LDAP
> 2. second password - RADIUS. but login is the same as the first one
>
>
I do not believe this is possible, no, at least not the way the modules are
currently written. If you're going to go this route, why not just have
RADIUS do both legs of the authentication - first, against LDAP, then with
the second factor?
-Nick
>