RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1544679 - OTP and Radius Authentication does not work in FIPS mode
Summary: OTP and Radius Authentication does not work in FIPS mode
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.4
Hardware: Unspecified
OS: Linux
high
unspecified
Target Milestone: rc
: ---
Assignee: IPA Maintainers
QA Contact: ipa-qe
URL: https://github.com/freeipa/freeipa/pu...
Whiteboard:
Depends On: 1486286
Blocks: 1564390
TreeView+ depends on / blocked
 
Reported: 2018-02-13 09:31 UTC by Martin Kosek
Modified: 2021-06-10 14:35 UTC (History)
22 users (show)

Fixed In Version: ipa-4.6.4-1.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 1486286
: 1564390 (view as bug list)
Environment:
Last Closed: 2018-10-30 10:57:12 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:3187 0 None None None 2018-10-30 10:58:18 UTC

Description Martin Kosek 2018-02-13 09:31:24 UTC 
Description of problem:

IPA(IdM) installed on RHEL 7.4 with fips mode enabled, fails to authenticate with password+OTP.  In the same setup with fips mode disabled, the password+otp authenticates successfully.

Version-Release number of selected component (if applicable):

RHEL 7.4
Kernel - 3.10.0-693.1.1.el7.x86_64 
# cat /etc/redhat-release 
Red Hat Enterprise Linux Server release 7.4 (Maipo)

FIPS  mode enabled
# cat /proc/sys/crypto/fips_enabled 
1

IPA
VERSION: 4.5.0, API_VERSION: 2.228 - ipa-server-4.5.0-21.el7.x86_64

FreeOTP version 1.5 (17)


How reproducible:


Steps to Reproduce:
1. Install RHEL7.4 and enable FIPS mode
2. Add a user and enable two factor authentication
3. Add OTP token from FreeOTP
4. Login with password+otp

Actual results:
Login fails as if wrong credentials supplied.

Expected results:
Successful authentication 

Additional info:

This Bugzilla was cloned from Bug 1486286, where the IdM was only modified to disable OTP/Radius authentication when FIPS is enabled. See also Bug 1510313 for doc fix.

This Bug is targeted to track the actual request for enabling this feature.
Comment 4 Martin Kosek 2018-02-23 08:13:51 UTC 
Short summary of the technical investigation done as part of this Bugzilla:

- We found a way how to make OTP and Radius work in FIPS mode. There is a POC upstream patch: https://github.com/freeipa/freeipa/pull/1621

- With this PR merged, we should be able to remove the code that disables OTP (and Radius maybe too) in FIPS mode as it would work, i.e. patches added in Bug 1486286

- However, note that current implementation of 2FA/OTP cannot be made truly FIPS compliant as it is based on symmetric keys (seeds) being shared between IdM and it's users' soft tokens, which is not OK from FIPS point of view. We would need to rely on other 2FA technology, that could be made FIPS compliant.
Comment 5 Martin Kosek 2018-03-09 09:06:15 UTC 
As agreed on the last meeting that we want to treat this gap as a Bug, rather an RFE (also given the findings in upstream PR development).
Comment 7 Martin Kosek 2018-03-19 08:52:54 UTC 
https://github.com/freeipa/freeipa/pull/1621 was merged, so moving to POST.
Comment 8 Rob Crittenden 2018-03-19 14:32:35 UTC 
master:
    c9c58f2 Fix OTP validation in FIPS mode
    a01a24c Increase the default token key size
    d498d72 Revert "Don't allow OTP or RADIUS in FIPS mode"
    bffcef6 Log errors from NSS during FIPS OTP key import

ipa-4-6:

    acb59fc Fix OTP validation in FIPS mode
    6d4ce79 Increase the default token key size
    1df9767 Revert "Don't allow OTP or RADIUS in FIPS mode"
    63c2d2a Log errors from NSS during FIPS OTP key import

ipa-4-5:

    52c5998 Fix OTP validation in FIPS mode
    c7d383c Increase the default token key size
    98efe7c Revert "Don't allow OTP or RADIUS in FIPS mode"
    d23003e Log errors from NSS during FIPS OTP key import
Comment 19 Mohammad Rizwan 2018-08-09 07:02:11 UTC 
version:
ipa-server-4.6.4-3.el7.x86_64
krb5-server-1.15.1-34.el7.x86_64

Steps:
Steps performed on FIPS enabled machine

1) add user otpuser and nonotp

2) kinit admin

3) ipa user-mod --user-auth-type=otp otpuser

4) ipa otptoken-add  --type=otp --no-qrcode --owner=otpuser

5) use python interpreter to decode the key from step4
   $ python
   >> import base64
   >> decode = base64.b64decode('key-from-step-2')
   >> otp = base64.b32encode(decode)
   >> print otp

6) oathtool -b <otp-from-step5> --totp

7) kinit nonotp

8) klsit  and copy the keyring

9) echo Secret123<otp-from-step6> | kinit -T <keyring-from-step8> otpuser

Actual result:

[root@master ~]# ipa user-mod --user-auth-type=otp otpuser
--------------------
Modified user "otpuser"
--------------------
  User login: otpuser
  First name: None
  Last name: None
  Home directory: /home/otpuser
  Login shell: /bin/sh
  Principal name: otpuser
  Principal alias: otpuser
  Email address: otpuser
  UID: 1820200009
  GID: 1820200009
  User authentication types: otp
  Account disabled: False
  Password: True
  Member of groups: ipausers
  Kerberos keys available: True

[root@master ~]# ipa otptoken-add  --type=totp --no-qrcode --owner=otpuser
------------------
Added OTP token ""
------------------
  Unique ID: 653ca943-f1d1-47a4-96a1-214892c91c00
  Type: TOTP
  Owner: otpuser
  Key: LRrZ1gm4Wr+0gUdE3xS0yiMWzXa6PwjKoE/Q8MK220R0sC4=
  Algorithm: sha1
  Digits: 6
  Clock offset: 0
  Clock interval: 30
  URI: otpauth://totp/otpuser:653ca943-f1d1-47a4-96a1-214892c91c00?digits=6&secret=FUNNTVQJXBNL7NEBI5CN6FFUZIRRNTLWXI7QRSVAJ7IPBQVW3NCHJMBO&period=30&algorithm=SHA1&issuer=otp2%40TESTRELM.TEST
[root@master ~]# 
[root@master ~]# python
Python 2.7.5 (default, Jul 16 2018, 19:52:45) 
[GCC 4.8.5 20150623 (Red Hat 4.8.5-36)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import base64
>>> decode = base64.b64decode('LRrZ1gm4Wr+0gUdE3xS0yiMWzXa6PwjKoE/Q8MK220R0sC4=')
>>> otp = base64.b32encode(decode)
>>> print otp
FUNNTVQJXBNL7NEBI5CN6FFUZIRRNTLWXI7QRSVAJ7IPBQVW3NCHJMBO
>>> 
[root@master ~]# oathtool -b  FUNNTVQJXBNL7NEBI5CN6FFUZIRRNTLWXI7QRSVAJ7IPBQVW3NCHJMBO --totp
585338
[root@master ~]# kinit nootp
Password for nootp: 
[root@master ~]# 
[root@master ~]# klist
Ticket cache: KEYRING:persistent:0:krb_ccache_XEsgLSI
Default principal: nootp

Valid starting       Expires              Service principal
08/09/2018 02:48:15  08/10/2018 02:48:12  krbtgt/TESTRELM.TEST
[root@master ~]# 
[root@master ~]# 
[root@master ~]# echo Secret123585338 | kinit -T KEYRING:persistent:0:krb_ccache_XEsgLSI otpuser
Enter OTP Token Value: 
[root@master ~]# klist
Ticket cache: KEYRING:persistent:0:krb_ccache_PQ1xogc
Default principal: otpuser

Valid starting       Expires              Service principal
08/09/2018 02:49:02  08/10/2018 02:49:02  krbtgt/TESTRELM.TEST

Expected result:
kinit success with password+otp

Hey Robbie,

Could you change the status to ON_QA so that it can be marked as verified.
Comment 20 Mohammad Rizwan 2018-08-10 09:37:51 UTC 
Based on observations in comment#19 marking the bug as verified.
Comment 22 errata-xmlrpc 2018-10-30 10:57:12 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3187
Note You need to log in before you can comment on or make changes to this bug.