Author: raymond

Just adding authentication user identification functionallity on selfhosted webportal based on local active directory

BY NO MEANS SECURE, no input is sanitized…

ref: https://wp.12p.no/2022/05/13/alternative-to-captive-webportal/

First thing that is needed. php-ldap. I noticed it was not supported by php7, so i change php version to 8.x.

# a2dismod php7.x.x

# a2enmod php8.x.x

then

# apt install php-ldap

#service apache2 restart

then created a local website in my apache folder

index.php:

Then create an auth file:

The syslogip points to the syslog recieving interface of paloalto

domain points to the domain name

replace: ad.placebodome.local with your ADs FQDN.

The php-ldap function then tries to bind to the domain using the userprovided username and password. If binding fails the user is not authenticated.

If the binding is successfull a logger command is run to send a syslog message to the Paloalto firewall with username of user and the ipaddress for the requester/user.

As the previouse example: https://wp.12p.no/2022/05/13/alternative-to-captive-webportal/ using the syslog parser:

Voila, the user is populated in the same way as the original

The idiotic way to implement user identification when everything else fails.

You need:

GPO to push automaticly run powershell

A webserver, for example Apache

A syslog forwarder, for example rsyslog

And setup the Paloalto firewall as a User ID agent with syslog listener.

Plain and simple. Absolutely not secure, but until I bother with integrating user certificates as authentication for the requests this will do.

Powershell which runs every hour or minute on the clients

The webserver, a simple apache server hosted on an ubuntu box without any content

Install rsyslog if not installed

put the following in /etc/rsyslog.d/02-apache2.conf

Validate the config:

systemctl restart rsyslogd

On the paloalto, enable user-id syslog on the interface and lock the permitted address to the webserver sending the syslogs

add the uid profile to the interface:

Add the following syslog parser:

Setup the server monitor:

and the syslog parser profile.

And you’re good to go. Not secure, but it works as a simple solution

Tok en tur til Herdla og så på nordlyset med en kompis. Dette ble resultatet:

Took a sponatious trip to Bølgekraftverket located in Toft, Rong. https://www.google.com/maps/place/B%C3%B8lgekraftverket/@60.4699557,4.9247579,15z/data=!4m2!3m1!1s0x0:0x9092354b5b6cc1c0?sa=X&ved=2ahUKEwiG3YrHms_xAhXql4sKHTVsDIYQ_BIwGHoECEAQBQ

Took a few photos. Fun to take photos again.

• 

• 

• 

• 

• 

• 

• 

Pictures taken 5th of january 2021

Setup the client certificate deployment by following this guide : https://www.virtuallyboring.com/setup-microsoft-active-directory-certificate-services-ad-cs/

Start of by exporting the CA certificate:

Install the certificate on you Palo Alto Firewall:

the certificate should look something like this:

Create a Certificate profile:

Add this profile to your Authentication settings on the GlobalProtect gateway:

Now you can access your globalprotect vpn with the required client certificate.

If you get disconnected right away you can check the debug logs undre Troubleshooting, look for this message:

Went for a walk in the mountains today… took some pictures

TL;DR : Enable free 2FA using an Ubuntu server, Google authenticator and FreeRadius on service supporting radius authentication.

So, I’ve been messing around with this for a while, and I decided I’d create a post showing how to do it.

Basicly i have a small Ubuntu Server, with Free radius, and Google authenticator module. Using the users defined on the Ubuntu server as allowed-users.

Step1: Start installing the needed tools on the Ubuntu server running this command

This will install the applications and tools you need. There are different ways of setting up free-radius in terms of the user running the service, but since I hate services running as root I used the freerad user account with lower privlegdes.

Step 2: edit the /etc/freeradius/users file, and add the following:

Step3: edit the /etc/freeradius/sites-enabled/default and remove # before PAM

Step4: edit the file /etc/freeradius/clients.conf. Add these lines to the end. Change the ip-adress allowed andradius secret to whatever you need it to be, I recommend using a password generator…

Then Restart the service: sudo service freeradius restart

Step 5: Then edit the /etc/pam.d/radiusd file to define the google authenticator:

Step 6: For each user you need to create a google authenticator token. running the command google_authenticator as each user will guide you trough the process.

A file named .google_authenticator will be created in each users homefolder. We need to move this file in to the freeradius folder under /etc/freeradius/*USERNAME*

Step 6.1: Since we dont use the root user we need to allow the freerad user to access the google authenticator file for the user (the user is named TEST here):

Step 7: Test the setup using radtest:

If the test is successfull you should see this line:

Step 8: Configure the Palo Alto firewall to use the radius server with 2FA for Global Protect VPN:

Go to Device, then Server Profiles, and select Radius. Create new radius profile:

To test the settings, commit and from CLI to the firewall type:

For more troubleshooting if this does not work.

tail -f /var/log/auth.log

or

tail -f /var/log/freeradius/freeradius.log

Step 9: Go to authentication profile, and add a new

Add this profile to the portal config:

Step 10: Test the config

Commit the config, visit the Globalprotect portal externally. Type in username, and in the passwordfield, type thepassword + the google authenticator code.

Step 12: Testing the authentication in the GlobalProtect client

Download and install the client, if you havent done it yet. Add the portal address, your username and password+googleauthenticator:

Remember to change password at next logon. I use this settings aswell:

LATER: I will do a turitorial on LDAP integration aswell later.

So I’ve been thinking of creating a post of how to block ips when they try to do something bad to your system, for example a exploit related to a wordpress plugin on your dmz-webserver. It’s quite easy and extremely effective. Just setup a profile that will automaticly block the ip when it tries to do bad things.

So first of all, create a TAG. Name it something related to blocked-ips

Create a Dynamic type Address Group for this TAG:

Then create a LogForwarding profile:

The result should be something like this:

You now have a setup that matches the severity Cirtical of the logtype Threat, that adds the sourceip of the traffic-log to the BLOCKED-HOSTS tag.

Now you can use your own incomming rule and add this log-forwarding profile to it. (BE SURE that you have a threat profile active on the rule)

To block these IP’s you need to create a Rule above the inbound rule to block these IPs:

And you are good to go. Get rid of those idiots (for a selected time atleast)