{"id":307,"date":"2020-01-28T09:19:07","date_gmt":"2020-01-28T08:19:07","guid":{"rendered":"http:\/\/wp.12p.no\/?p=307"},"modified":"2020-01-28T09:19:07","modified_gmt":"2020-01-28T08:19:07","slug":"setting-up-2fa-with-palo-alto-using-google-authenticator","status":"publish","type":"post","link":"https:\/\/12p.no\/wp\/?p=307","title":{"rendered":"Setting up Palo Alto GlobalProtect VPN 2fa-authentication using Google Authenticator"},"content":{"rendered":"\n

TL;DR : Enable free 2FA using an Ubuntu server, Google authenticator and FreeRadius on service supporting radius authentication.<\/em><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

So, I’ve been messing around with this for a while, and I decided I’d create a post showing how to do it. <\/p>\n\n\n\n

Basicly i have a small Ubuntu Server, with Free radius, and Google authenticator module. Using the users defined on the Ubuntu server as allowed-users.<\/p>\n\n\n\n

Step1: Start installing the needed tools on the Ubuntu server running this command<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

This will install the applications and tools you need. There are different ways of setting up free-radius in terms of the user running the service, but since I hate services running as root I used the freerad user account with lower privlegdes. <\/p>\n\n\n\n

Step 2: edit the \/etc\/freeradius\/users file, and add the following:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Step3: edit the \/etc\/freeradius\/sites-enabled\/default and remove # before PAM<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Step4: edit the file \/etc\/freeradius\/clients.conf. Add these lines to the end. Change the ip-adress allowed andradius secret to whatever you need it to be, I recommend using a password generator…<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

<\/p>\n\n\n\n

<\/p>\n\n\n\n

Then Restart the service: sudo service freeradius restart<\/p>\n\n\n\n

Step 5: Then edit the \/etc\/pam.d\/radiusd file to define the google authenticator:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Step 6: For each user you need to create a google authenticator token. running the command google_authenticator as each user will guide you trough the process. <\/p>\n\n\n\n

\"\"
You can scan the QR-code in the google authenticator app, and ofcourse keep the backupcodes of later use (you can access these keys by viewing .google_authenticator file)<\/figcaption><\/figure>\n\n\n\n

A file named .google_authenticator will be created in each users homefolder. We need to move this file in to the freeradius folder under \/etc\/freeradius\/*USERNAME*<\/p>\n\n\n\n

Step 6.1: Since we dont use the root user we need to allow the freerad user to access the google authenticator file for the user (the user is named TEST here):<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Step 7: Test the setup using radtest:<\/p>\n\n\n\n

\"\"
Yellow is the google authenticator code

<\/figcaption><\/figure>\n\n\n\n

If the test is successfull you should see this line:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Step 8: Configure the Palo Alto firewall to use the radius server with 2FA for Global Protect VPN:<\/p>\n\n\n\n

Go to Device, then Server Profiles, and select Radius. Create new radius profile:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

To test the settings, commit and from CLI to the firewall type:<\/p>\n\n\n\n

\"\"
Ofcourse you need to change the profilename and username to what it needs to be.
At the passwordprompt type YourPassword+GoogleAuthenticatorCode
<\/figcaption><\/figure>\n\n\n\n
\"\"
Result should look something like this. <\/figcaption><\/figure>\n\n\n\n

For more troubleshooting if this does not work. <\/p>\n\n\n\n

tail -f \/var\/log\/auth.log <\/p>\n\n\n\n

or <\/p>\n\n\n\n

tail -f \/var\/log\/freeradius\/freeradius.log<\/p>\n\n\n\n

\"\"
Troubleshooting from cli (yes, i use Tmux.)<\/figcaption><\/figure>\n\n\n\n

Step 9: Go to authentication profile, and add a new<\/p>\n\n\n\n

\"\"

<\/figcaption><\/figure>\n\n\n\n

Add this profile to the portal config: <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Step 10: Test the config<\/p>\n\n\n\n

Commit the config, visit the Globalprotect portal externally. Type in username, and in the passwordfield, type thepassword + the google authenticator code. <\/p>\n\n\n\n

\"\"
So if your password is MyPassword and google authenticator code is 123 456 the password you type in would be “MyPassword123456”<\/figcaption><\/figure>\n\n\n\n

Step 12: Testing the authentication in the GlobalProtect client<\/p>\n\n\n\n

Download and install the client, if you havent done it yet. Add the portal address, your username and password+googleauthenticator:<\/p>\n\n\n\n

\"\"

And you’re logged in<\/figcaption><\/figure>\n\n\n\n

Remember to change password at next logon. I use this settings aswell:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

LATER: I will do a turitorial on LDAP integration aswell later.<\/p>\n","protected":false},"excerpt":{"rendered":"

TL;DR : Enable free 2FA using an Ubuntu server, Google authenticator and FreeRadius on service supporting radius authentication. So, I’ve been messing around with this for a while, and I decided I’d create a post showing how to do it. Basicly i have a small Ubuntu Server, with Free radius, and Google authenticator module. Using […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-307","post","type-post","status-publish","format-standard","hentry","category-it-security"],"_links":{"self":[{"href":"https:\/\/12p.no\/wp\/index.php?rest_route=\/wp\/v2\/posts\/307","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/12p.no\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/12p.no\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/12p.no\/wp\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/12p.no\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=307"}],"version-history":[{"count":0,"href":"https:\/\/12p.no\/wp\/index.php?rest_route=\/wp\/v2\/posts\/307\/revisions"}],"wp:attachment":[{"href":"https:\/\/12p.no\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=307"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/12p.no\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=307"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/12p.no\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=307"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}