Bug 1544679 - OTP and Radius Authentication does not work in FIPS mode
Summary: OTP and Radius Authentication does not work in FIPS mode
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.4
Hardware: Unspecified
OS: Linux
Target Milestone: rc
: ---
Assignee: IPA Maintainers
QA Contact: ipa-qe
URL: https://github.com/freeipa/freeipa/pu...
Depends On: 1486286
Blocks: 1564390
TreeView+ depends on / blocked
Reported: 2018-02-13 09:31 UTC by Martin Kosek
Modified: 2021-06-10 14:35 UTC (History)
22 users (show)

Fixed In Version: ipa-4.6.4-1.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 1486286
: 1564390 (view as bug list)
Last Closed: 2018-10-30 10:57:12 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:3187 0 None None None 2018-10-30 10:58:18 UTC

Description Martin Kosek 2018-02-13 09:31:24 UTC
Description of problem:

IPA(IdM) installed on RHEL 7.4 with fips mode enabled, fails to authenticate with password+OTP.  In the same setup with fips mode disabled, the password+otp authenticates successfully.

Version-Release number of selected component (if applicable):

RHEL 7.4
Kernel - 3.10.0-693.1.1.el7.x86_64 
# cat /etc/redhat-release 
Red Hat Enterprise Linux Server release 7.4 (Maipo)

FIPS  mode enabled
# cat /proc/sys/crypto/fips_enabled 

VERSION: 4.5.0, API_VERSION: 2.228 - ipa-server-4.5.0-21.el7.x86_64

FreeOTP version 1.5 (17)

How reproducible:

Steps to Reproduce:
1. Install RHEL7.4 and enable FIPS mode
2. Add a user and enable two factor authentication
3. Add OTP token from FreeOTP
4. Login with password+otp

Actual results:
Login fails as if wrong credentials supplied.

Expected results:
Successful authentication 

Additional info:

This Bugzilla was cloned from Bug 1486286, where the IdM was only modified to disable OTP/Radius authentication when FIPS is enabled. See also Bug 1510313 for doc fix.

This Bug is targeted to track the actual request for enabling this feature.

Comment 4 Martin Kosek 2018-02-23 08:13:51 UTC
Short summary of the technical investigation done as part of this Bugzilla:

- We found a way how to make OTP and Radius work in FIPS mode. There is a POC upstream patch: https://github.com/freeipa/freeipa/pull/1621

- With this PR merged, we should be able to remove the code that disables OTP (and Radius maybe too) in FIPS mode as it would work, i.e. patches added in Bug 1486286

- However, note that current implementation of 2FA/OTP cannot be made truly FIPS compliant as it is based on symmetric keys (seeds) being shared between IdM and it's users' soft tokens, which is not OK from FIPS point of view. We would need to rely on other 2FA technology, that could be made FIPS compliant.

Comment 5 Martin Kosek 2018-03-09 09:06:15 UTC
As agreed on the last meeting that we want to treat this gap as a Bug, rather an RFE (also given the findings in upstream PR development).

Comment 7 Martin Kosek 2018-03-19 08:52:54 UTC
https://github.com/freeipa/freeipa/pull/1621 was merged, so moving to POST.

Comment 8 Rob Crittenden 2018-03-19 14:32:35 UTC
    c9c58f2 Fix OTP validation in FIPS mode
    a01a24c Increase the default token key size
    d498d72 Revert "Don't allow OTP or RADIUS in FIPS mode"
    bffcef6 Log errors from NSS during FIPS OTP key import


    acb59fc Fix OTP validation in FIPS mode
    6d4ce79 Increase the default token key size
    1df9767 Revert "Don't allow OTP or RADIUS in FIPS mode"
    63c2d2a Log errors from NSS during FIPS OTP key import


    52c5998 Fix OTP validation in FIPS mode
    c7d383c Increase the default token key size
    98efe7c Revert "Don't allow OTP or RADIUS in FIPS mode"
    d23003e Log errors from NSS during FIPS OTP key import

Comment 19 Mohammad Rizwan 2018-08-09 07:02:11 UTC

Steps performed on FIPS enabled machine

1) add user otpuser and nonotp

2) kinit admin

3) ipa user-mod --user-auth-type=otp otpuser

4) ipa otptoken-add  --type=otp --no-qrcode --owner=otpuser

5) use python interpreter to decode the key from step4
   $ python
   >> import base64
   >> decode = base64.b64decode('key-from-step-2')
   >> otp = base64.b32encode(decode)
   >> print otp

6) oathtool -b <otp-from-step5> --totp

7) kinit nonotp

8) klsit  and copy the keyring

9) echo Secret123<otp-from-step6> | kinit -T <keyring-from-step8> otpuser

Actual result:

[root@master ~]# ipa user-mod --user-auth-type=otp otpuser
Modified user "otpuser"
  User login: otpuser
  First name: None
  Last name: None
  Home directory: /home/otpuser
  Login shell: /bin/sh
  Principal name: otpuser@TESTRELM.TEST
  Principal alias: otpuser@TESTRELM.TEST
  Email address: otpuser@testrelm.test
  UID: 1820200009
  GID: 1820200009
  User authentication types: otp
  Account disabled: False
  Password: True
  Member of groups: ipausers
  Kerberos keys available: True

[root@master ~]# ipa otptoken-add  --type=totp --no-qrcode --owner=otpuser
Added OTP token ""
  Unique ID: 653ca943-f1d1-47a4-96a1-214892c91c00
  Type: TOTP
  Owner: otpuser
  Key: LRrZ1gm4Wr+0gUdE3xS0yiMWzXa6PwjKoE/Q8MK220R0sC4=
  Algorithm: sha1
  Digits: 6
  Clock offset: 0
  Clock interval: 30
  URI: otpauth://totp/otpuser@TESTRELM.TEST:653ca943-f1d1-47a4-96a1-214892c91c00?digits=6&secret=FUNNTVQJXBNL7NEBI5CN6FFUZIRRNTLWXI7QRSVAJ7IPBQVW3NCHJMBO&period=30&algorithm=SHA1&issuer=otp2%40TESTRELM.TEST
[root@master ~]# 
[root@master ~]# python
Python 2.7.5 (default, Jul 16 2018, 19:52:45) 
[GCC 4.8.5 20150623 (Red Hat 4.8.5-36)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import base64
>>> decode = base64.b64decode('LRrZ1gm4Wr+0gUdE3xS0yiMWzXa6PwjKoE/Q8MK220R0sC4=')
>>> otp = base64.b32encode(decode)
>>> print otp
[root@master ~]# kinit nootp
Password for nootp@TESTRELM.TEST: 
[root@master ~]# 
[root@master ~]# klist
Ticket cache: KEYRING:persistent:0:krb_ccache_XEsgLSI
Default principal: nootp@TESTRELM.TEST

Valid starting       Expires              Service principal
08/09/2018 02:48:15  08/10/2018 02:48:12  krbtgt/TESTRELM.TEST@TESTRELM.TEST
[root@master ~]# 
[root@master ~]# 
[root@master ~]# echo Secret123585338 | kinit -T KEYRING:persistent:0:krb_ccache_XEsgLSI otpuser
Enter OTP Token Value: 
[root@master ~]# klist
Ticket cache: KEYRING:persistent:0:krb_ccache_PQ1xogc
Default principal: otpuser@TESTRELM.TEST

Valid starting       Expires              Service principal
08/09/2018 02:49:02  08/10/2018 02:49:02  krbtgt/TESTRELM.TEST@TESTRELM.TEST

Expected result:
kinit success with password+otp

Hey Robbie,

Could you change the status to ON_QA so that it can be marked as verified.

Comment 20 Mohammad Rizwan 2018-08-10 09:37:51 UTC
Based on observations in comment#19 marking the bug as verified.

Comment 22 errata-xmlrpc 2018-10-30 10:57:12 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.