========================================== Step 2 -- install privacyIDEA admin ========================================== rm /usr/bin/pip cp -r /usr/bin/pip3 /usr/bin/pip pip install --upgrade pip python -m pip -V cd /usr/local/src git clone https://github.com/privacyidea/privacyideaadm.git cd privacyideaadm python -m pip install . mkdir /etc/privacyidea cat <<"eof" >authorizedkeyscommand [Default] url=https://radotp-dev.binghamton.edu admin=sshadmin@systems password=dd3fdC872ee613dB1c2c1BB81547a7c4$x nosslcheck=false hostname=eof mv authorizedkeyscommand /etc/privacyidea chmod 0640 /etc/privacyidea/authorizedkeyscommand cp scripts/privacyidea-authorizedkeys /etc/privacyidea chown root: /etc/privacyidea/privacyidea-authorizedkeys /etc/privacyidea/authorizedkeyscommand chmod 0640 /etc/privacyidea/authorizedkeyscommand chmod 0750 /etc/privacyidea/privacyidea-authorizedkeys -- test connection /etc/privacyidea/privacyidea-authorizedkeys/etc/privacyidea/privacyidea-authorizedkeys jramsay ============================================== Step 3 -- install the pam_python module ============================================== yum -y install gcc make pam pam-devel python3-devel cd /usr/local/src/ wget -O pam-python-1.0.8.tar.gz https://sourceforge.net/projects/pam-python/files/pam-python-1.0.8-1/pam-python-1.0.8.tar.gz/download tar zxf pam-python-1.0.8.tar.gz cd pam-python-1.0.8/src cat << eof > pam_python.patch --- pam_python.c.orig 2020-12-09 09:56:15.141788284 -0500 +++ pam_python.c 2020-12-09 09:53:47.823130991 -0500 @@ -28,6 +28,7 @@ #define PAM_SM_SESSION #define PAM_SM_PASSWORD +#include <Python.h> #include <security/pam_modules.h> #ifndef __APPLE__ #include <security/_pam_macros.h> eof patch -p0 < pam_python.patch if this fails add #include <Python.h> to pam_python.c make pam_python.so cp pam_python.so /usr/lib64/security/ =============================================== Step 4 -- install the pam_radius module =============================================== yum -y install pam_radius freeradius-utils cat /etc/pam.d/password-auth >/etc/pam.d/password-auth.last # -- update auth section in /etc/pam.d/password-auth file as shown auth required pam_env.so auth requisite pam_unix.so nullok try_first_pass auth sufficient pam_radius_auth.so force_prompt prompt=OTP auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth required pam_deny.so cat /etc/pam.d/system-auth >/etc/pam.d/system-auth.last # -- update auth section in /etc/pam.d/system-auth file as shown auth required pam_env.so auth sufficient pam_fprintd.so auth requisite pam_unix.so nullok try_first_pass auth sufficient pam_radius_auth.so force_prompt prompt=OTP auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth required pam_deny.so cat /etc/pam.d/sshd >/etc/pam.d/sshd.last # -- update auth section in /etc/pam.d/sshd file as shown auth required pam_sepermit.so auth required pam_env.so auth sufficient pam_radius_auth.so force_prompt prompt=OTP auth required pam_deny.so auth include postlogin # -- add to /etc/pam_radius.conf # -- comment any other servers in file # server[:port] shared_secret timeout (s) radotp-dev.binghamton.edu 6cdbee477411645c296edc416854aa82d5b2b6dbad9a0529f374e5614a208bc9 30 yum --enablerepo="ol7*" install freeradius-utils # -- test radius cat <<"eof" >radtest.shl user=$1 pin=$2 radtest ${user:="null"} ${pin:=0} \ radotp-dev.binghamton.edu:1812 10 \ 6cdbee477411645c296edc416854aa82d5b2b6dbad9a0529f374e5614a208bc9 exit 0 eof chmod +x radtest.shl ./radtest.shl <user_authorized_to_access_this_host> <token> # -- edit and update as needed in /etc/sshd_config PubkeyAuthentication yes PasswordAuthentication no ChallengeResponseAuthentication yes UsePAM yes UseDNS no AuthorizedKeysCommand /etc/privacyidea/privacyidea-authorizedkeys # -- add to /etc/sshd_config Match User root AuthenticationMethods password,publickey,keyboard-interactive PasswordAuthentication yes Match Group mfausers AuthenticationMethods publickey,keyboard-interactive PasswordAuthentication no systemctl restart sshd # -- create an account for yourself (if one does not exist) useradd -s /bin/bash levans passwd levans groupadd mfausers usermod -G mfausers levans usermod -G wheel levans # -- test from another server with an ssh key ssh levans@... ========================================= Step 5 -- completed ========================================= Allow system administrators to upload public keys to privacyIDEA ======================================= ========== FINAL UDATES =============== ======================================= # egrep -v '^#|^$' /etc/ssh/sshd_config HostKey /etc/ssh/ssh_host_rsa_key HostKey /etc/ssh/ssh_host_ecdsa_key HostKey /etc/ssh/ssh_host_ed25519_key SyslogFacility AUTHPRIV LogLevel INFO PubkeyAuthentication yes AuthorizedKeysFile .ssh/authorized_keys AuthorizedKeysCommand /etc/privacyidea/privacyidea-authorizedkeys AuthorizedKeysCommandUser root PasswordAuthentication no PermitEmptyPasswords no ChallengeResponseAuthentication yes GSSAPIAuthentication yes GSSAPICleanupCredentials no UsePAM yes X11Forwarding yes UseDNS no AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE AcceptEnv XMODIFIERS Subsystem sftp /usr/libexec/openssh/sftp-server Match Group mfausers AuthenticationMethods publickey,keyboard-interactive PasswordAuthentication no # egrep '^auth' /etc/pam.d/password-auth auth required pam_env.so auth requisite pam_unix.so nullok try_first_pass auth sufficient pam_radius_auth.so force_prompt prompt=OTP auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth required pam_deny.so # egrep '^auth' /etc/pam.d/system-auth auth required pam_env.so auth sufficient pam_fprintd.so auth requisite pam_unix.so nullok try_first_pass auth sufficient pam_radius_auth.so force_prompt prompt=OTP auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth required pam_deny.so # egrep '^auth' /etc/pam.d/sshd auth required pam_sepermit.so auth required pam_env.so auth sufficient pam_radius_auth.so force_prompt prompt=OTP auth required pam_deny.so auth include postlogin # egrep -v '^#|^$' /etc/pam_radius.conf radotp-dev.binghamton.edu 6cdbee477411645c296edc416854aa82d5b2b6dbad9a0529f374e5614a208bc9 30 # egrep -v '^#|^$' /etc/privacyidea/authorizedkeyscommand [Default] url=https://radotp-dev.binghamton.edu admin=sshadmin@systems password=dd3fdC872ee613dB1c2c1BB81547a7c4$x nosslcheck=false hostname=rhel5-5.cc.binghamton.edu