moving everything to active or retired vs incubating and graduated

2025-04-19 18:46:40 -04:00
parent 6e393d90ee
commit ef9104c796
234 changed files with 456 additions and 244 deletions
--- a/retired/systemd_freeipa/freeipa.md
+++ b/retired/systemd_freeipa/freeipa.md
@@ -0,0 +1,391 @@
+# FreeIPA
+
+- [FreeIPA](#freeipa)
+  - [Notes](#notes)
+  - [Quickstart Debugging Setup](#quickstart-debugging-setup)
+  - [Quickstart Production Setup](#quickstart-production-setup)
+  - [Tips](#tips)
+  - [Adding a user](#adding-a-user)
+  - [PIV](#piv)
+    - [Sources](#sources)
+    - [Set up PIV Auth on the Host where you Installed FreeIPA](#set-up-piv-auth-on-the-host-where-you-installed-freeipa)
+      - [Note for VMs](#note-for-vms)
+      - [Set up PIV](#set-up-piv)
+    - [Set up PIV on Another Host](#set-up-piv-on-another-host)
+    - [PIV Smart Card (Yubikey Manual) WIP](#piv-smart-card-yubikey-manual-wip)
+    - [PIV Smart Card (Taglio) WIP](#piv-smart-card-taglio-wip)
+    - [Finding devices in sysfs WIP](#finding-devices-in-sysfs-wip)
+    - [Finding p11 devices WIP](#finding-p11-devices-wip)
+  - [Arch Client WIP](#arch-client-wip)
+
+An AD Server.
+
+This guide assumes Fedora 40+.
+
+## Notes
+
+For yubikey manager appimage extend app not responding timeout to 60 seconds
+
+```bash
+gsettings set org.gnome.mutter check-alive-timeout 0
+```
+
+## Quickstart Debugging Setup
+
+This sets up a freeipa server on RHEL 9 for debugging purposes. No DNS records required
+and mostly for local use.
+
+```bash
+# Don't forget to install tmux
+dnf install -y tmux
+```
+
+Install FreeIPA:
+
+```bash
+# Hostname needs to be an address that isn't managed by DNS (FreeIPA will check)
+# We can get away with *.name.reeselink.com because "name.reeselink.com" doesn't resolve.
+export HNAME="freeipa.reese.reeselink.com"
+export IPS=$(hostname -I)
+# Add "<ip address> freeipa.<unique_name>.reeselink.com" to the /etc/hosts
+# Example: "10.3.128.130 freeipa.reese.reeselink.com" <- note, this address *cannot* already exist.
+# This will allow us to access our AD server without DNS complication 
+for item in $IPS; do echo "$item $HNAME" >> /etc/hosts; done
+
+# FreeIPA checks for this
+hostnamectl set-hostname $HNAME --static
+hostname $HNAME
+
+# Turning off selinux isn't required, but is nice for debugging.
+setenforce 0
+sed -i 's/^SELINUX=.*/SELINUX=permissive/g' /etc/selinux/config
+
+# Install FreeIPA with the dns packages. We *could* use this server our DNS server if
+# we wanted. This will prevent DCV from talking to our auth endpoint, however, so isn't
+# recommended.
+dnf install ipa-server-dns bind-dyndb-ldap -y
+
+# IPA Server install
+# Note - select defaults for almost everything except:
+# 1. We want DNS, so say yes to that
+# 2. We don't need to scan for additional zones
+ipa-server-install --setup-dns
+
+# Install flatpak
+dnf install flatpak
+flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
+flatpak install it.mijorus.gearlever
+```
+
+1. Download the yubikey manager at <https://www.yubico.com/support/download/yubikey-manager/>
+2. Open it in Gear Lever and add to app menu
+
+```bash
+# Install pcscd
+dnf install pcsc-lite opensc
+# Start the pcscd server
+systemctl enable --now pcscd
+```
+
+Now skip to [Get PIV Working](#piv)
+
+## Quickstart Production Setup
+
+<https://www.freeipa.org/page/Quick_Start_Guide>
+
+- Set your hostname to your server's fqdn with `hostnamectl hostname freeipa.reeselink.com`
+- Ensure you have a DNS entry pointing to your host
+- Open ports:
+
+```bash
+firewall-cmd --add-service=freeipa-ldap --add-service=freeipa-ldaps
+firewall-cmd --add-service=freeipa-ldap --add-service=freeipa-ldaps --permanent
+```
+
+- Set a permanet DNS resolver: `sudo echo "nameserver 1.1.1.1" > /etc/resolv.conf`
+- Disable NetworkManager DNS management
+
+```bash
+vim /etc/NetworkManager/NetworkManager.conf
+
+[main]
+dns=none
+```
+
+Note, if installing for local use only, set /etc/hosts and reply "yes" to configure dns.
+
+```bash
+vim /etc/hosts
+
+192.168.122.100 freeipa.reeselink.com
+```
+
+- Restart NetworkManager: `systemctl restart NetworkManager`
+- Ensure resolv.conf hasn't been repopulated: `cat /etc/resolv.conf`
+- Install freeipa: `dnf install -y freeipa-server freeipa-server-dns`
+- Install the server (mostly choose defaults and sane options): `ipa-server-install`
+- Authenticate as admin: `kinit admin`
+
+Now skip to [Get PIV Working](#piv)
+
+## Tips
+
+```bash
+# Install gnome desktop on Fedora server
+dnf group install gnome-desktop
+systemctl enable gdm
+reboot
+
+# Install spice tools for clipboard sync
+sudo dnf install spice-vdagent
+reboot
+```
+
+## Adding a user
+
+- `ipa user-add`
+- `ipa passwd <user>`
+- `kinit <user>`
+
+## PIV
+
+### Sources
+
+Self signed piv cert generation
+<https://developers.yubico.com/yubico-piv-tool/Actions/key_generation.html>
+
+Explaing Yubikey key slots
+<https://developers.yubico.com/PIV/Introduction/Certificate_slots.html>
+
+Ultimate guide to creating a CA
+<https://checkmk.com/linux-knowledge/creating-server-certificate>
+
+CA Public directory
+<https://nextcloud.reeseapps.com/s/twRAFeWJZKJ3Qw5>
+
+Convert pem to der
+<https://knowledge.digicert.com/solution/how-to-convert-a-certificate-into-the-appropriate-format>
+
+Add smart card login to extended key use
+<https://docs.openssl.org/master/man5/x509v3_config/#key-usage>
+
+This should set up a CA and a signed cert for your yubikey.
+<https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/managing_smart_card_authentication/configuring-idm-for-smart-card-auth_managing-smart-card-authentication#conf-idm-server-for-smart-card-auth_configuring-idm-for-smart-card-auth>
+
+### Set up PIV Auth on the Host where you Installed FreeIPA
+
+#### Note for VMs
+
+"virt-manager USB redirection error: Device is in use by another application"
+
+You won't be able to pass through a smart card without stopping pcscd on the host.
+
+```bash
+systemctl stop pcscd.socket && systemctl stop pcscd
+```
+
+#### Set up PIV
+
+```bash
+# copy the CA and run the ipa-advise script that sets up smartcard auth
+cp /etc/ipa/ca.crt ca.crt
+sudo -i
+kinit admin
+ipa-advise config-server-for-smart-card-auth > config-server-for-smart-card-auth.sh
+chmod +x config-server-for-smart-card-auth.sh
+./config-server-for-smart-card-auth.sh ca.crt
+```
+
+Allow smart card auth in browser with these changes `/etc/httpd/conf.d/ssl.conf`
+
+```conf
+...
+SSLOCSPEnable off
+...
+SSLProtocol all -TLSv1 -TLSv1.1 -TLSv1.3
+...
+```
+
+And restart httpd:
+
+```bash
+systemctl restart httpd
+```
+
+Then user -> actions -> new certificate. Paste in the yubikey CSR. Download then upload cert to the yubikey.
+
+Auth with smart card
+
+```bash
+kinit -X X509_user_identity='PKCS11:opensc-pkcs11.so' idm_user
+```
+
+Or with pam
+
+```bash
+cp /etc/ipa/ca.crt /etc/sssd/pki/sssd_auth_ca_db.pem
+dnf install -y sssd-tools
+authselect enable-feature with-smartcard
+# required: authselect enable-feature with-smartcard-required
+# lock on remove: authselect enable-feature with-smartcard-lock-on-removal
+# set "pam_cert_auth = True" in [pam] section of /etc/sssd/sssd.conf
+systemctl restart sssd
+sssctl user-checks -s gdm-smartcard "ducoterra" -a auth
+```
+
+### Set up PIV on Another Host
+
+**NOTE**: Make sure, if you're joining with a host that already has a user with a username that
+exists in your freeipa server, that **you set the UID in freeipa to match the UID on
+the system**. Otherwise joining will cause all sorts of problems.
+
+```bash
+# This package is required to join a FreeIPA realm
+# I think it helps collect and save the relevant data from the FreeIPA
+# server when joining (server CA, NTP sync, SSH keys, etc.)
+dnf install -y freeipa-client
+
+hostnamectl set-hostname client.reese.reeselink.com
+
+# OPTIONAL: You need to leave any existing AD realm before joining a new one
+# realm leave <some-realm>
+```
+
+Add the freeipa server to our /etc/hosts so we don't need to set up DNS
+
+```bash
+vim /etc/hosts
+
+`192.168.122.195 freeipa.reese.reeselink.com`
+
+# This should populate /etc/krb5.conf and /etc/sssd/sssd.conf
+realm join freeipa.reese.reeselink.com -v
+
+# AD should be configured to create the user's home dir, but to be safe
+export freeipa_user=ducoterra
+mkdir /home/$freeipa_user
+chown $freeipa_user:$freeipa_user /home/$freeipa_user
+
+# Check login
+su - $freeipa_user
+
+# With kinit
+kinit -X X509_user_identity='PKCS11:opensc-pkcs11.so' idm_user
+
+# With sssctl
+cp /etc/ipa/ca.crt /etc/sssd/pki/sssd_auth_ca_db.pem
+dnf install -y sssd-tools
+authselect enable-feature with-smartcard
+# required: authselect enable-feature with-smartcard-required
+# lock on remove: authselect enable-feature with-smartcard-lock-on-removal
+# set "pam_cert_auth = True" in [pam] section of /etc/sssd/sssd.conf
+systemctl restart sssd
+sssctl user-checks -s gdm-smartcard "ducoterra" -a auth
+```
+
+### PIV Smart Card (Yubikey Manual) WIP
+
+```bash
+openssl req -x509 -config openssl-ca.cnf -days 3650 -newkey rsa:4096 -sha256 -nodes -out cacert.pem -outform PEM
+touch index.txt
+echo '01' > serial.txt
+
+# Sign the csr generated in slot 9a on your yubikey
+openssl ca -config openssl-ca.cnf -policy signing_policy -extensions signing_req -out reese-crt.pem -infiles reese-csr.pem
+
+# Inspect
+openssl x509 -in reese-crt.pem -text -noout
+
+# Convert to microsoft format
+openssl x509 -outform der -in reese-crt.pem -out reese-crt-der.cer
+```
+
+OCSP Server
+
+<https://bhashineen.medium.com/create-your-own-ocsp-server-ffb212df8e63>
+
+```bash
+openssl req -new -nodes -out ocspSigning.csr -keyout ocspSigning.key
+openssl ca -keyfile rootCA.key -cert rootCA.crt -in ocspSigning.csr -out ocspSigning.crt -config validation.conf
+```
+
+### PIV Smart Card (Taglio) WIP
+
+<https://github.com/OpenSC/OpenSC/wiki/Using-pkcs11-tool-and-OpenSSL>
+
+```bash
+openssl genrsa -aes256 -out testkey.key 2048
+openssl rsa -in testkey.key -pubout -out testkey-public.key
+openssl req -new -key testkey.key -out testkey.csr
+
+# Sign with CA
+```
+
+### Finding devices in sysfs WIP
+
+```bash
+# Try this
+ls /dev/input/by-id
+udevadm info --query=all --name='/dev/input/by-id/usb-Yubico_YubiKey_OTP+FIDO+CCID-event-kbd'
+# Look for E: DEVPATH and put /sys in front of it
+# For example:
+cd /sys/devices/pci0000:00/0000:00:02.1/0000:02:00.0/usb1/1-3/1-3:1.0/0003:1050:0407.0004/input/input10/event6
+
+# Or alternatively
+find /sys -name 'removable'
+cd /sys/devices/pci0000:00/0000:00:02.1/0000:02:00.0/usb1/1-3
+```
+
+### Finding p11 devices WIP
+
+```bash
+dnf install python3-pip python3-devel gcc
+python3 -m venv venv
+source venv/bin/activate
+pip install -U pip
+pip install python-pkcs11
+export PKCS11_MODULE=/usr/lib64/p11-kit-proxy.so
+```
+
+## Arch Client WIP
+
+- Install krb5: `pacman -S krb5`
+- Edit /etc/krb5.conf to match your server
+
+```conf
+vim /etc/krb5.conf
+
+[logging]
+ default = FILE:/var/log/krb5libs.log
+ kdc = FILE:/var/log/krb5kdc.log
+ admin_server = FILE:/var/log/kadmind.log
+
+[libdefaults]
+ default_realm = REESELINK.COM
+ dns_lookup_realm = false
+ dns_lookup_kdc = true
+ rdns = false
+ ticket_lifetime = 24h
+ forwardable = true
+ udp_preference_limit = 0
+ default_ccache_name = KEYRING:persistent:%{uid}
+
+[realms]
+ REESELINK.COM = {
+  kdc = freeipa.reeselink.com:88
+  master_kdc = freeipa.reeselink.com:88
+  kpasswd_server = freeipa.reeselink.com:464
+  admin_server = freeipa.reeselink.com:749
+  default_domain = reeselink.com
+  pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
+  pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
+}
+
+[domain_realm]
+ .reeselink.com = REESELINK.COM
+ reeselink.com = REESELINK.COM
+ freeipa.reeselink.com = REESELINK.COM
+```
+
+- Log in with your user: `kinit <user>`
+- List your tickets: `klist`