Re: [ovirt-users] oVirt 3.5 and FreeIpa

22 Jan 2015

      This is a multi-part message in MIME format.

------------MIME-295668495-1198010832-delim
Content-Type: text/plain;
	charset="utf-8"
Content-Transfer-Encoding: quoted-printable

On 01/22/2015 01=3A13 PM=2C Alon Bar-Lev wrote=3A
=3E
=3E ----- Original Message -----
=3E=3E From=3A =22Jorick Astrego=22 =3Cj=2Eastrego=40netbulae=2Eeu=3E
=3E=3E To=3A users=40ovirt=2Eorg
=3E=3E Sent=3A Thursday=2C January 22=2C 2015 2=3A09=3A18 PM
=3E=3E Subject=3A Re=3A =5Bovirt-users=5D oVirt 3=2E5 and FreeIpa
=3E=3E
=3E=3E
=3E=3E On 01/22/2015 12=3A59 PM=2C Alon Bar-Lev wrote=3A
=3E=3E=3E ----- Original Message -----
=3E=3E=3E=3E From=3A =22Jorick Astrego=22 =3Cj=2Eastrego=40 netbulae=2Eeu=
 =3E
=3E=3E=3E=3E To=3A users=40 ovirt=2Eorg
=3E=3E=3E=3E Sent=3A Thursday=2C January 22=2C 2015 1=3A41=3A40 PM
=3E=3E=3E=3E Subject=3A Re=3A =5Bovirt-users=5D oVirt 3=2E5 and FreeIpa
=3E=3E=3E=3E
=3E=3E=3E=3E
=3E=3E=3E=3E On 10/31/2014 02=3A47 PM=2C Marcelo Donato wrote=3A
=3E=3E=3E=3E
=3E=3E=3E=3E
=3E=3E=3E=3E
=3E=3E=3E=3E
=3E=3E=3E=3E Below the solution=2E Resolved By =22Alon Bar-Lev=22 =3C alonb=
l=40 redhat=2Ecom =3E
=3E=3E=3E=3E
=3E=3E=3E=3E
=3E=3E=3E=3E 1=2E install ovirt-engine-extension-aaa- ldap=2C it is availab=
le in
=3E=3E=3E=3E ovirt-3=2E5-snapshots repository=2E
=3E=3E=3E=3E
=3E=3E=3E=3E 2=2E create /etc/ovirt-engine/extensions=2E d/din=2Eintranet-a=
uthz=2E properties
=3E=3E=3E=3E
=3E=3E=3E=3E ovirt=2Eengine=2Eextension=2Ename =3D din-intranet-authz
=3E=3E=3E=3E ovirt=2Eengine=2Eextension=2E bindings=2Emethod =3D jbossmodul=
e
=3E=3E=3E=3E ovirt=2Eengine=2Eextension=2E binding=2Ejbossmodule=2Emodule=
 =3D
=3E=3E=3E=3E org=2Eovirt=2Eengine-extensions=2E aaa=2Eldap
=3E=3E=3E=3E ovirt=2Eengine=2Eextension=2E binding=2Ejbossmodule=2Eclass=20=
=3D
=3E=3E=3E=3E org=2Eovirt=2Eengineextensions=2E aaa=2Eldap=2EAuthzExtension=

=3E=3E=3E=3E ovirt=2Eengine=2Eextension=2E provides =3D org=2Eovirt=2Eengin=
e=2Eapi=2E
=3E=3E=3E=3E extensions=2Eaaa=2EAuthz
=3E=3E=3E=3E config=2Eprofile=2Efile=2E1 =3D /etc/ovirt-engine/aaa/din=2E i=
ntranet=2Eproperties
=3E=3E=3E=3E
=3E=3E=3E=3E 3=2E create /etc/ovirt-engine/extensions=2E d/din=2Eintranet-a=
uthn=2E properties
=3E=3E=3E=3E
=3E=3E=3E=3E ovirt=2Eengine=2Eextension=2Ename =3D din-intranet-authn
=3E=3E=3E=3E ovirt=2Eengine=2Eextension=2E bindings=2Emethod =3D jbossmodul=
e
=3E=3E=3E=3E ovirt=2Eengine=2Eextension=2E binding=2Ejbossmodule=2Emodule=
 =3D
=3E=3E=3E=3E org=2Eovirt=2Eengine-extensions=2E aaa=2Eldap
=3E=3E=3E=3E ovirt=2Eengine=2Eextension=2E binding=2Ejbossmodule=2Eclass=20=
=3D
=3E=3E=3E=3E org=2Eovirt=2Eengineextensions=2E aaa=2Eldap=2EAuthnExtension=

=3E=3E=3E=3E ovirt=2Eengine=2Eextension=2E provides =3D org=2Eovirt=2Eengin=
e=2Eapi=2E
=3E=3E=3E=3E extensions=2Eaaa=2EAuthn
=3E=3E=3E=3E ovirt=2Eengine=2Eaaa=2Eauthn=2Eprofile=2Ename =3D din=2Eintran=
et
=3E=3E=3E=3E ovirt=2Eengine=2Eaaa=2Eauthn=2Eauthz=2E plugin =3D din-intrane=
t-authz
=3E=3E=3E=3E config=2Eprofile=2Efile=2E1 =3D /etc/ovirt-engine/aaa/din=2E i=
ntranet=2Eproperties
=3E=3E=3E=3E
=3E=3E=3E=3E 4=2E create /etc/ovirt-engine/aaa/din=2E intranet=2Eproperties=

=3E=3E=3E=3E
=3E=3E=3E=3E include =3D =3Cipa=2Eproperties=3E
=3E=3E=3E=3E
=3E=3E=3E=3E vars=2Euser =3D uid=3Dadmin=2Ccn=3Dusers=2Ccn=3D accounts=2Cdc=
=3Ddin=2Cdc=3Dintranet
=3E=3E=3E=3E vars=2Epassword =3D 123456
=3E=3E=3E=3E vars=2Eserver =3D ipa1=2Edin=2Eintranet
=3E=3E=3E=3E
=3E=3E=3E=3E pool=2Edefault=2Eserverset=2Esingle=2E server =3D =24=7Bglobal=
=3Avars=2Eserver=7D
=3E=3E=3E=3E pool=2Edefault=2Eauth=2Esimple=2E bindDN =3D =24=7Bglobal=3Ava=
rs=2Euser=7D
=3E=3E=3E=3E pool=2Edefault=2Eauth=2Esimple=2E password =3D =24=7Bglobal=3A=
vars=2Epassword=7D
=3E=3E=3E=3E
=3E=3E=3E=3E 5=2E restart engine=2E
=3E=3E=3E=3E
=3E=3E=3E=3E
=3E=3E=3E=3E Thanks a lot Alon=2E
=3E=3E=3E=3E
=3E=3E=3E=3E
=3E=3E=3E=3E
=3E=3E=3E=3E Thanks for this=2C saved me some time!
=3E=3E=3E=3E
=3E=3E=3E=3E Just a couple of addtions=2C please hash the password with SSH=
A =28I really
=3E=3E=3E=3E hate
=3E=3E=3E=3E plain text admin passwords=2E=2E=2E=29
=3E=3E=3E=3E I tried putting an =7BSSHA=7D encoded password in =22 vars=2Ep=
assword =3D=22 =2C but it
=3E=3E=3E=3E fails to authenticate while plain text works fine=2E
=3E=3E=3E I am unsure I understand=2E
=3E=3E=3E using hash to store password hint at server side makes sense=2E=

=3E=3E=3E but using hash to store password at client side does not makes se=
ns=2C this
=3E=3E=3E means that if I get the server database I can authenticate to any=
 user
=3E=3E=3E without knowing his password=2E
=3E=3E=3E
=3E=3E=3E Also=2C please note that the user you specify within configuratio=
n should not
=3E=3E=3E have any special privilege but to query public objects within lda=
p=2E
=3E=3E I don=27t like storing plain text in textfiles=2C so I try to avoid=
 it=2E Even
=3E=3E if it is a read only user there are no =22public=22 objects that I l=
ike to
=3E=3E expose to anyone=2E I can query groups=2C group members=2C e-mail ad=
dresses=2C
=3E=3E krbPasswordExpiration=2C krbLastPwdChange etc=2E with this user=2E=

=3E=3E
=3E=3E So that=27s why I try to have the bind user password hashed in the=

=3E=3E properties file=2E
=3E as I wrote above=2C storing hash instead of password does not enhance s=
ecurity=2E
=3E it is the same as if you just set the user=27s password to the hash=2E=

Ah yes=2C silly me=2E You are absolutely right=2E It has been such a long=

habit=2E=2E=2E But it does help when people intercept the traffic=2E Does t=
he
ldap plugin send it hashed to the ldap server=3F

I think FreeIPA supports salted sha512 but I=27m not entirely sure=2E

You=27ll probably say that I need to enable TLS=2C but there have been many=

weaknesses in ssl and MITM issues=2E So more is always better in a
security perspective=2E

Met vriendelijke groet=2C With kind regards=2C

Jorick Astrego

Netbulae Virtualization Experts=20

----------------

=09Tel=3A 053 20 30 270 =09info=40netbulae=2Eeu =09Staalsteden 4-3A =09KvK=
 08198180
 =09Fax=3A 053 20 30 271 =09www=2Enetbulae=2Eeu =097547 TA Enschede =09BTW=
 NL821234584B01

----------------

------------MIME-295668495-1198010832-delim
Content-Type: text/html;
	charset="utf-8"
Content-Transfer-Encoding: quoted-printable

=3Chtml=3E
=3Cbody=3E
 
On 01/22/2015 01:13 PM, Alon Bar-Lev wrote: 
> 
> ----- Original Message ----- 
>> From: "Jorick Astrego" <j.ast=
rego@<a href=3D"mailto:netbulae.eu">netbulae.eu</a>> 
>> To: users@<a href=3D"mailto:ovirt.org">ovi=
rt.org</a> 
>> Sent: Thursday, January 22, 2015 2:09:18 P=
M 
>> Subject: Re: [ovirt-users] oVirt 3.5 and F=
reeIpa 
>> 
>> 
>> On 01/22/2015 12:59 PM, Alon Bar-Lev wrote=
: 
>>> ----- Original Message -----</fon=
t> 
>>>> From: "Jorick Astrego" &=
lt;j.astrego@ netbulae.eu > 
>>>> To: users@ ovirt.org<b=
r>
>>>> Sent: Thursday, January 22, 2015 1=
:41:40 PM 
>>>> Subject: Re: [ovirt-users] oVirt 3=
.5 and FreeIpa 
>>>> 
>>>> 
>>>> On 10/31/2014 02:47 PM, Marcelo Do=
nato wrote: 
>>>> 
>>>> 
>>>> 
>>>> 
>>>> Below the solution. Resolved By &q=
uot;Alon Bar-Lev" < alonbl@ redhat.com > 
>>>> 
>>>> 
>>>> 1. install ovirt-engine-extension-=
aaa- ldap, it is available in 
>>>> ovirt-3.5-snapshots repository.=
3; 
>>>> 
>>>> 2. create /etc/ovirt-engine/extens=
ions. d/din.intranet-authz. properties 
>>>> 
>>>> ovirt.engine.extension.name =3D di=
n-intranet-authz 
>>>> ovirt.engine.extension. bindings.m=
ethod =3D jbossmodule 
>>>> ovirt.engine.extension. binding.jb=
ossmodule.module =3D 
>>>> org.ovirt.engine-extensions. aaa.l=
dap 
>>>> ovirt.engine.extension. binding.jb=
ossmodule.class =3D 
>>>> org.ovirt.engineextensions. aaa.ld=
ap.AuthzExtension 
>>>> ovirt.engine.extension. provides =
=3D org.ovirt.engine.api. 
>>>> extensions.aaa.Authz<b=
r>
>>>> config.profile.file.1 =3D /etc/ovi=
rt-engine/aaa/din. intranet.properties 
>>>> 
>>>> 3. create /etc/ovirt-engine/extens=
ions. d/din.intranet-authn. properties 
>>>> 
>>>> ovirt.engine.extension.name =3D di=
n-intranet-authn 
>>>> ovirt.engine.extension. bindings.m=
ethod =3D jbossmodule 
>>>> ovirt.engine.extension. binding.jb=
ossmodule.module =3D 
>>>> org.ovirt.engine-extensions. aaa.l=
dap 
>>>> ovirt.engine.extension. binding.jb=
ossmodule.class =3D 
>>>> org.ovirt.engineextensions. aaa.ld=
ap.AuthnExtension 
>>>> ovirt.engine.extension. provides =
=3D org.ovirt.engine.api. 
>>>> extensions.aaa.Authn<b=
r>
>>>> ovirt.engine.aaa.authn.profile.nam=
e =3D din.intranet 
>>>> ovirt.engine.aaa.authn.authz. plug=
in =3D din-intranet-authz 
>>>> config.profile.file.1 =3D /etc/ovi=
rt-engine/aaa/din. intranet.properties 
>>>> 
>>>> 4. create /etc/ovirt-engine/aaa/di=
n. intranet.properties 
>>>> 
>>>> include =3D <ipa.properties>=
 
>>>> 
>>>> vars.user =3D uid=3Dadmin,cn=3Duse=
rs,cn=3D accounts,dc=3Ddin,dc=3Dintranet 
>>>> vars.password =3D 123456</fon=
t> 
>>>> vars.server =3D ipa1.din.intranet&=
#13; 
>>>> 
>>>> pool.default.serverset.single. ser=
ver =3D ${global:vars.server} 
>>>> pool.default.auth.simple. bindDN =
=3D ${global:vars.user} 
>>>> pool.default.auth.simple. password=
 =3D ${global:vars.password} 
>>>> 
>>>> 5. restart engine. 
>>>> 
>>>> 
>>>> Thanks a lot Alon. 
>>>> 
>>>> 
>>>> 
>>>> Thanks for this, saved me some tim=
e! 
>>>> 
>>>> Just a couple of addtions, please =
hash the password with SSHA (I really 
>>>> hate 
>>>> plain text admin passwords...)=
; 
>>>> I tried putting an {SSHA} encoded =
password in " vars.password =3D" , but it 
>>>> fails to authenticate while plain =
text works fine. 
>>> I am unsure I understand.<=
br>
>>> using hash to store password hint at s=
erver side makes sense. 
>>> but using hash to store password at cl=
ient side does not makes sens, this 
>>> means that if I get the server databas=
e I can authenticate to any user 
>>> without knowing his password.</fo=
nt> 
>>> 
>>> Also, please note that the user you sp=
ecify within configuration should not 
>>> have any special privilege but to quer=
y public objects within ldap. 
>> I don't like storing plain text in textfil=
es, so I try to avoid it. Even 
>> if it is a read only user there are no &qu=
ot;public" objects that I like to 
>> expose to anyone. I can query groups, grou=
p members, e-mail addresses, 
>> krbPasswordExpiration, krbLastPwdChange et=
c. with this user. 
>> 
>> So that's why I try to have the bind user =
password hashed in the 
>> properties file. 
> as I wrote above, storing hash instead of pass=
word does not enhance security. 
> it is the same as if you just set the user's p=
assword to the hash. 
 
Ah yes, silly me. You are absolutely 
right. It has been such a long 
habit... But it does help when people intercept the traffic. Does the<=
br>
ldap plugin send it hashed to the ldap server? 
 
I think FreeIPA supports salted sha512 but I'm not entirely sure. 
 
You'll probably say that I need to enable TLS, but there have been many=
; 
weaknesses in ssl and MITM issues. So more is always better in a 
security perspective. 
 
 
 
=

=3CBR /=3E
=3CBR /=3E
=3Cb style=3D=22color=3A=23604c78=22=3E=3C/b=3E=3Cbr=3E=3Cspan style=3D=22c=
olor=3A=23604c78=3B=22=3E=3Cfont color=3D=22000000=22=3E=3Cspan style=3D=22=
mso-fareast-language=3Aen-gb=3B=22 lang=3D=22NL=22=3EMet vriendelijke groet=
=2C With kind regards=2C=3Cbr=3E=3Cbr=3E=3C/span=3EJorick Astrego=3C/font=
=3E=3C/span=3E=3Cb style=3D=22color=3A=23604c78=22=3E=3Cbr=3E=3Cbr=3ENetbul=
ae Virtualization Experts =3C/b=3E=3Cbr=3E=3Chr style=3D=22border=3Anone=3B=
border-top=3A1px solid =23ccc=3B=22=3E=3Ctable style=3D=22width=3A 522px=22=
=3E=3Ctbody=3E=3Ctr=3E=3Ctd style=3D=22width=3A 130px=3Bfont-size=3A 10px=
=22=3ETel=3A  053 20 30 270=3C/td=3E    =3Ctd style=3D=22width=3A 130px=3Bf=
ont-size=3A 10px=22=3Einfo=40netbulae=2Eeu=3C/td=3E    =3Ctd style=3D=22wid=
th=3A 130px=3Bfont-size=3A 10px=22=3EStaalsteden 4-3A=3C/td=3E    =3Ctd sty=
le=3D=22width=3A 130px=3Bfont-size=3A 10px=22=3EKvK 08198180=3C/td=3E=3C/tr=
=3E=3Ctr=3E    =3Ctd style=3D=22width=3A 130px=3Bfont-size=3A 10px=22=3EFax=
=3A 053 20 30 271=3C/td=3E    =3Ctd style=3D=22width=3A 130px=3Bfont-size=
=3A 10px=22=3Ewww=2Enetbulae=2Eeu=3C/td=3E    =3Ctd style=3D=22width=3A 130=
px=3Bfont-size=3A 10px=22=3E7547 TA Enschede=3C/td=3E    =3Ctd style=3D=22w=
idth=3A 130px=3Bfont-size=3A 10px=22=3EBTW NL821234584B01=3C/td=3E=3C/tr=3E=
=3C/tbody=3E=3C/table=3E=3Cbr=3E=3Chr style=3D=22border=3Anone=3Bborder-top=
=3A1px solid =23ccc=3B=22=3E=3CBR /=3E
=3C/body=3E
=3C/html=3E

------------MIME-295668495-1198010832-delim--