Bug 1544679

Summary:	OTP and Radius Authentication does not work in FIPS mode
Product:	Red Hat Enterprise Linux 7	Reporter:	Martin Kosek <mkosek>
Component:	ipa	Assignee:	IPA Maintainers <ipa-maint>
Status:	CLOSED ERRATA	QA Contact:	ipa-qe <ipa-qe>
Severity:	unspecified	Docs Contact:
Priority:	high
Version:	7.4	CC:	akasurde, amore, davdunc, godfrey.watama, ipa-maint, ipa-qe, ksiddiqu, mkosek, mvarun, myusuf, ndehadra, npmccallum, pasik, pvoborni, rcritten, rharwood, rpage, slaznick, ssekidde, toneata, tscherf, xdong
Target Milestone:	rc	Keywords:	ZStream
Target Release:	---
Hardware:	Unspecified
OS:	Linux
URL:	https://github.com/freeipa/freeipa/pull/1621
Whiteboard:
Fixed In Version:	ipa-4.6.4-1.el7	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:	1486286
Clones:	1564390 (view as bug list)		Environment:
Last Closed:	2018-10-30 10:57:12 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1486286
Bug Blocks:	1564390

Description Martin Kosek 2018-02-13 09:31:24 UTC

Description of problem:

IPA(IdM) installed on RHEL 7.4 with fips mode enabled, fails to authenticate with password+OTP.  In the same setup with fips mode disabled, the password+otp authenticates successfully.

Version-Release number of selected component (if applicable):

RHEL 7.4
Kernel - 3.10.0-693.1.1.el7.x86_64 
# cat /etc/redhat-release 
Red Hat Enterprise Linux Server release 7.4 (Maipo)

FIPS  mode enabled
# cat /proc/sys/crypto/fips_enabled 
1

IPA
VERSION: 4.5.0, API_VERSION: 2.228 - ipa-server-4.5.0-21.el7.x86_64

FreeOTP version 1.5 (17)


How reproducible:


Steps to Reproduce:
1. Install RHEL7.4 and enable FIPS mode
2. Add a user and enable two factor authentication
3. Add OTP token from FreeOTP
4. Login with password+otp

Actual results:
Login fails as if wrong credentials supplied.

Expected results:
Successful authentication 

Additional info:

This Bugzilla was cloned from Bug 1486286, where the IdM was only modified to disable OTP/Radius authentication when FIPS is enabled. See also Bug 1510313 for doc fix.

This Bug is targeted to track the actual request for enabling this feature.

Comment 4 Martin Kosek 2018-02-23 08:13:51 UTC

Short summary of the technical investigation done as part of this Bugzilla:

- We found a way how to make OTP and Radius work in FIPS mode. There is a POC upstream patch: https://github.com/freeipa/freeipa/pull/1621

- With this PR merged, we should be able to remove the code that disables OTP (and Radius maybe too) in FIPS mode as it would work, i.e. patches added in Bug 1486286

- However, note that current implementation of 2FA/OTP cannot be made truly FIPS compliant as it is based on symmetric keys (seeds) being shared between IdM and it's users' soft tokens, which is not OK from FIPS point of view. We would need to rely on other 2FA technology, that could be made FIPS compliant.

Comment 5 Martin Kosek 2018-03-09 09:06:15 UTC

As agreed on the last meeting that we want to treat this gap as a Bug, rather an RFE (also given the findings in upstream PR development).

Comment 7 Martin Kosek 2018-03-19 08:52:54 UTC

https://github.com/freeipa/freeipa/pull/1621 was merged, so moving to POST.

Comment 8 Rob Crittenden 2018-03-19 14:32:35 UTC

master:
    c9c58f2 Fix OTP validation in FIPS mode
    a01a24c Increase the default token key size
    d498d72 Revert "Don't allow OTP or RADIUS in FIPS mode"
    bffcef6 Log errors from NSS during FIPS OTP key import

ipa-4-6:

    acb59fc Fix OTP validation in FIPS mode
    6d4ce79 Increase the default token key size
    1df9767 Revert "Don't allow OTP or RADIUS in FIPS mode"
    63c2d2a Log errors from NSS during FIPS OTP key import

ipa-4-5:

    52c5998 Fix OTP validation in FIPS mode
    c7d383c Increase the default token key size
    98efe7c Revert "Don't allow OTP or RADIUS in FIPS mode"
    d23003e Log errors from NSS during FIPS OTP key import

Comment 19 Mohammad Rizwan 2018-08-09 07:02:11 UTC

version:
ipa-server-4.6.4-3.el7.x86_64
krb5-server-1.15.1-34.el7.x86_64

Steps:
Steps performed on FIPS enabled machine

1) add user otpuser and nonotp

2) kinit admin

3) ipa user-mod --user-auth-type=otp otpuser

4) ipa otptoken-add  --type=otp --no-qrcode --owner=otpuser

5) use python interpreter to decode the key from step4
   $ python
   >> import base64
   >> decode = base64.b64decode('key-from-step-2')
   >> otp = base64.b32encode(decode)
   >> print otp

6) oathtool -b <otp-from-step5> --totp

7) kinit nonotp

8) klsit  and copy the keyring

9) echo Secret123<otp-from-step6> | kinit -T <keyring-from-step8> otpuser

Actual result:

[root@master ~]# ipa user-mod --user-auth-type=otp otpuser
--------------------
Modified user "otpuser"
--------------------
  User login: otpuser
  First name: None
  Last name: None
  Home directory: /home/otpuser
  Login shell: /bin/sh
  Principal name: otpuser
  Principal alias: otpuser
  Email address: otpuser
  UID: 1820200009
  GID: 1820200009
  User authentication types: otp
  Account disabled: False
  Password: True
  Member of groups: ipausers
  Kerberos keys available: True

[root@master ~]# ipa otptoken-add  --type=totp --no-qrcode --owner=otpuser
------------------
Added OTP token ""
------------------
  Unique ID: 653ca943-f1d1-47a4-96a1-214892c91c00
  Type: TOTP
  Owner: otpuser
  Key: LRrZ1gm4Wr+0gUdE3xS0yiMWzXa6PwjKoE/Q8MK220R0sC4=
  Algorithm: sha1
  Digits: 6
  Clock offset: 0
  Clock interval: 30
  URI: otpauth://totp/otpuser:653ca943-f1d1-47a4-96a1-214892c91c00?digits=6&secret=FUNNTVQJXBNL7NEBI5CN6FFUZIRRNTLWXI7QRSVAJ7IPBQVW3NCHJMBO&period=30&algorithm=SHA1&issuer=otp2%40TESTRELM.TEST
[root@master ~]# 
[root@master ~]# python
Python 2.7.5 (default, Jul 16 2018, 19:52:45) 
[GCC 4.8.5 20150623 (Red Hat 4.8.5-36)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import base64
>>> decode = base64.b64decode('LRrZ1gm4Wr+0gUdE3xS0yiMWzXa6PwjKoE/Q8MK220R0sC4=')
>>> otp = base64.b32encode(decode)
>>> print otp
FUNNTVQJXBNL7NEBI5CN6FFUZIRRNTLWXI7QRSVAJ7IPBQVW3NCHJMBO
>>> 
[root@master ~]# oathtool -b  FUNNTVQJXBNL7NEBI5CN6FFUZIRRNTLWXI7QRSVAJ7IPBQVW3NCHJMBO --totp
585338
[root@master ~]# kinit nootp
Password for nootp: 
[root@master ~]# 
[root@master ~]# klist
Ticket cache: KEYRING:persistent:0:krb_ccache_XEsgLSI
Default principal: nootp

Valid starting       Expires              Service principal
08/09/2018 02:48:15  08/10/2018 02:48:12  krbtgt/TESTRELM.TEST
[root@master ~]# 
[root@master ~]# 
[root@master ~]# echo Secret123585338 | kinit -T KEYRING:persistent:0:krb_ccache_XEsgLSI otpuser
Enter OTP Token Value: 
[root@master ~]# klist
Ticket cache: KEYRING:persistent:0:krb_ccache_PQ1xogc
Default principal: otpuser

Valid starting       Expires              Service principal
08/09/2018 02:49:02  08/10/2018 02:49:02  krbtgt/TESTRELM.TEST

Expected result:
kinit success with password+otp

Hey Robbie,

Could you change the status to ON_QA so that it can be marked as verified.

Comment 20 Mohammad Rizwan 2018-08-10 09:37:51 UTC

Based on observations in comment#19 marking the bug as verified.

Comment 22 errata-xmlrpc 2018-10-30 10:57:12 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3187