CAC AND KERBEROS FROM VISION TO REALITY

Size: px

Start display at page:

Download "CAC AND KERBEROS FROM VISION TO REALITY"

Cory Higgins
8 years ago
Views:

1 CAC AND KERBEROS FROM VISION TO REALITY Mil OSS Conference 2011 Dmitri Pal Sr. Engineering Manager Red Hat Inc. Aug 31, 2011

2 Outline Setting up context... Card authentication now Open issues Pieces of the puzzle Perfect picture Call for action

3 Context Linux based system (RHEL, Fedora) CAC card is used for a system login LDAP server is used to provide identities

4 Card Authentication Now Authentication uses pam_pkcs11 User is prompted for PIN Card is unlocked Pam module checks either local user or if LDAP is configured tries to match the certificate to a certificate in the corresponding user entry in LDAP Pam_krb5 can be configured to acquire a Kerberos ticket User is logged in

tries to match the certificate to a certificate in the corresponding user entry

5 Open Issues How to make PAM configuration less fragile? Bad configuration may destroy the card or lock the account. How to overcome an authentication failure if client is offline? How to prevent yet another LDAP configuration and another connection that needs to be secure? How to provide SSO that would allow access to other resources without additional prompting for authentication?

How to overcome an authentication failure if client is offline?

6 Current Pieces of the Puzzle Card pam_pkcs11 pam_krb5 krb5-auth-dialog KDC Some certificate server LDAP server Components can be made work together but solution is complex, custom and fragile

7 Suggested Pieces of the Puzzle Card Card is the only thing that is given! SSSD System Security Services Daemon IPA Identity Policy Audit Server Dogtag Certificate Server

8 SSSD Manages communication with centralized identity and authentication stores Provides robust, predictable caching for network accounts Can cache authentication credentials locally Can handle multiple domains of user data and authentication Available in RHEL, Fedora, SUSE, Ubuntu, Debian

cache authentication credentials locally Can handle multiple domains of

9 SSSD Use Cases Corporate Laptop Traditional problem: users maintain a separate local account on the laptop to log into when out of the office With SSSD providing cached credentials, the user can keep the same account (UID and all) when logging in remotely Datacenter Datacenters that require highly-available authentication can take advantage of SSSD s caching to ride out temporary internal service outages (such as an LDAP or Kerberos server outage)

and all) when logging in remotely Datacenter Datacenters that require highly-available authentication can take

10 Traditional Authentication NSS PAM Directory 1 Auth 1 Client Request Directory 2... Auth 2... Directory N Auth N

11 Lookups with SSSD Client NSS Responder Identity Identity Server Client Cache SSSD Domain Network Boundary Client PAM Responder Auth Authentication Server

12 SSSD Data s Network Boundary Identity Server Auth Server Client Client Client SSSD NSS Responder PAM Responder Auth Cache Domain 2 Identity Domain 1 Auth Identity Domain N Auth Identity Domain... Auth Identity Identity Server Auth Server Identity Server Auth Server Identity Server Auth Server

Domain 1 Auth Identity Domain N Auth Identity Domain.

13 IPA IPA is a domain controller for Linux/UNIX environment Think Active Directory but for Linux Central server that stores identity information, policies related to identities and performs authentication

Central server that stores identity information,

14 IPA High Level Architecture Unix/Linux PKI KDC DNS LDAP CLI/GUI Admin

15 Dogtag Certificate System User and device certificate management Certificate provisioning and card enrollment Certificate revocation Key and card recovery

16 Perfect Picture User inserts the card and gets a ticket that can be used to access different resources No re-authentication required If there is AD behind those resources Kerberos trusts can be leveraged If credential is expired the user is prompted for the right credential If the user authenticated offline and then joined the network the ticket is renewed automatically Policies are passed around between certificate and Kerberos ticket And all of this is an end-to-end off shelf solution based on the OSS projects

the right credential If the user authenticated offline and then joined the network the ticket is renewed automatically Policies

17 What should be done? Add a smart card support to SSSD Solves pam stack problems Solves offline problem Solves connection problem Teach SSSD to do PKINIT using cert from the card We could acquire a Kerberos ticket for SSO Further Integrate IPA with Dogtag and add policies to pass around Would allow PKINIT to work on the server side Integrate SSSD with desktop and auth dialog Would allow better user experience at logon and credential renewal

Teach SSSD to do PKINIT using cert from the card We could acquire a Kerberos ticket for SSO Further Integrate

18 What should be done? We know what should be done! BUT...

19 What is the problem? We would love to do it but we are really thinly stretched trying to juggle this work with other requirements and priorities Nobody is asking for this (probably because there are already custom and complex solutions built) so this is a low priority Nobody is helping us to get there on any of the mentioned projects

work with other requirements and priorities Nobody is asking for this (probably

20 Can YOU help? Talk to us, us, IRC us... Explain your use cases... Share your vision... Define your priorities... Help to formulate standards... Try what we are building... Contribute developing or in any other way you can...

21 We are here... SSSD (Freenode #sssd) FreeIPA (Freenode #freeipa) Dogtag (Freenode #dogtag-pki)

22 Questions are welcome!

System Security Services Daemon

System Security Services Daemon System Security Services Daemon Manages communication with centralized identity and authentication stores Provides robust, predictable caching for network accounts Can cache