Red Hat Security: Identity Management and Authentication

Instructions

1. Install the Key Recovery Authority (KRA) component on the idm machine.

   1. Log in to the idm machine as student and become the root user:

      [student@workstation ~]$ ssh idm
      [student@idm ~]$ sudo -i
      [sudo] password for student: student

   2. Install the KRA component:

      Note

      If you have already installed the KRA component on the idm machine, then the command fails with the KRA already installed message.

      [root@idm ~]# ipa-kra-install
      Directory Manager password: RedHat123^
      
      ===================================================================
      This program will setup Dogtag KRA for the IPA Server.
      
      Configuring KRA server (pki-tomcatd). Estimated time: 2 minutes
        [1/9]: configuring KRA instance
        [2/9]: create KRA agent
        [3/9]: enabling ephemeral requests
        [4/9]: restarting KRA
        [5/9]: configure certmonger for renewals
        [6/9]: configure certificate renewals
        [7/9]: add vault container
        [8/9]: apply LDAP updates
        [9/9]: enabling KRA instance
      Done configuring KRA server (pki-tomcatd).
      Restarting the directory server
      The ipa-kra-install command was successful

   Hide Solution

2. On the client machine, create the prod-files standard vault and store the /home/student/database.kdbx file as a secret.

   1. Open a new terminal tab and log in to the client machine as the student user. Authenticate to IdM as the idmuser01 user:

      [student@workstation ~]$ ssh client
      [student@client ~]$ kinit idmuser01
      Password for idmuser01@LAB.EXAMPLE.COM: RedHat123^

   2. Review the details of the /home/student/database.kdbx file. Notice specifically the access and modification dates:

      [student@client ~]$ stat database.kdbx
        File: database.kdbx
        Size: 65536     	Blocks: 128        IO Block: 4096   regular file
      Device: fc04h/64516d	Inode: 8497822     Links: 1
      Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
      Context: unconfined_u:object_r:user_home_t:s0
      Access: 2023-06-28 17:32:32.849982303 -0400
      Modify: 2023-06-28 17:32:32.849982303 -0400
      Change: 2023-06-28 17:32:32.849982303 -0400
       Birth: 2023-06-28 17:32:32.849982303 -0400

   3. Create the prod-files standard vault:

      [student@client ~]$ ipa vault-add prod-files --type standard
      ----------------------
      Added vault "prod-files"
      ----------------------
        Vault name: prod-files
        Type: standard
        Owner users: idmuser01
        Vault user: idmuser01

   4. Store the /home/student/database.kdbx file:

      [student@client ~]$ ipa vault-archive prod-files --in ~/database.kdbx
      -----------------------------------
      Archived data into vault "prod-files"
      -----------------------------------

   Hide Solution

3. On the idm machine, retrieve the secret stored in the prod-files vault.

   1. Switch to the first terminal tab and log out of the root user. Authenticate to IdM as the idmuser01 user:

      [root@idm ~]# logout
      [student@idm ~]$ kinit idmuser01
      Password for idmuser01@LAB.EXAMPLE.COM: RedHat123^

   2. Retrieve the secret stored in the prod-files vault:

      [student@idm ~]$ ipa vault-retrieve prod-files --out ~/database.kdbx
      ------------------------------------
      Retrieved data from vault "prod-files"
      ------------------------------------

   3. Review the details for the /home/student/database.kdbx file.

      Note that the size matches the original file, but the modification time is the time that the secret was retrieved. Only the content of the file is stored in the vault, not the file itself:

      [student@idm ~]$ stat database.kdbx
        File: database.kdbx
        Size: 65536     	Blocks: 128        IO Block: 4096   regular file
      Device: fc04h/64516d	Inode: 8498112     Links: 1
      Access: (0644/-rw-r--r--)  Uid: ( 1000/ student)   Gid: ( 1000/ student)
      Context: unconfined_u:object_r:user_home_t:s0
      Access: 2023-06-28 17:46:07.347438594 -0400
      Modify: 2023-06-28 17:46:07.347438594 -0400
      Change: 2023-06-28 17:46:07.347438594 -0400
       Birth: 2023-06-28 17:46:07.347438594 -0400

   Hide Solution

4. Authenticate to IdM as the admin user, and configure two-factor authentication for the idmuser05 user.

   1. Authenticate as the admin user:

      [student@idm ~]$ kinit admin
      Password for admin@LAB.EXAMPLE.COM: RedHat123^

   2. Configure two-factor authentication for the idmuser05 user:

      [student@idm ~]$ ipa user-mod idmuser05 --user-auth-type=otp
      -------------------------
      Modified user "idmuser05"
      -------------------------
        User login: idmuser05
        First name: idmuser05
        Last name: idm
        Home directory: /home/idmuser05
        Login shell: /bin/sh
        Principal name: idmuser05@LAB.EXAMPLE.COM
        Principal alias: idmuser05@LAB.EXAMPLE.COM
        Email address: idmuser05@example.com
        UID: 739000013
        GID: 739000013
        User authentication types: otp
        Account disabled: False
        Password: True
        Member of groups: ipausers
        Kerberos keys available: True

   Hide Solution

5. On your mobile device, search for and install the FreeOTP Authenticator application.

   If you choose not to install FreeOTP on your mobile devices, an alternative method using any QR code scanner is provided.

6. On the idm machine, create a user-managed software token. Set otp as the description and set idmuser05 as the user.

   [student@idm ~]$ ipa otptoken-add --desc=otp --owner=idmuser05

   Hide Solution

7. Scan the displayed QR code with FreeOTP to provision the token to the mobile device.

   As an alternative, use a QR code scanner to scan the QR code.

8. On the workstation machine, open a web browser and navigate to https://idm.lab.example.com. If you are automatically logged in to the IdM web UI, log out of the dashboard.

9. In the IdM web UI, log in as the idmuser05 user. For the password, enter the user password followed by a FreeOTP passcode.

   1. For the first part, enter RedHat123^. For the second part, use FreeOTP to generate a passcode. The two items combined form the one-time password (OTP).

      Click Login. The passcode is only valid for brief period of time, so if authentication fails, try generating a new passcode.

      Note

      If you used the QR scanner, use the oathtool --base32 --totp command to generate the required passcode. In the URI displayed on your mobile device, find the secret= value and use that string as the argument for the --totp option. Run the following command on the workstation machine:

      [student@workstation ~]$ oathtool --base32 \
        --totp CODE
      350759

      Enter the generated passcode at the end of the password, and then click Login.

   Hide Solution

10. Log out of the web UI and exit the SSH session to the client and idm machines.

    1. Exit the client machine and close the second terminal tab.

       [student@client ~]$ exit
       logout
       Connection to client closed.

    2. Exit the idm machine.

       [student@idm ~]$ exit
       logout
       Connection to idm closed.

    Hide Solution