/
•
This is a web feed, also known as an Atom feed. Subscribe by copying the URL from the address bar into your newsreader. Visit About Feeds to learn more and get started. It's free.
Visit website
Recent posts
Updated on $DATE
date
PWM
Andrew Wippler's Sketchpad - PWM
Ideas, blog, etc.
Zola2016-08-26T14:49:51+00:00/tags/pwm/atom.xml
Securing PWM
2016-08-26T14:49:51+00:00
2016-08-26T14:49:51+00:00
Andrew Wippler
/2016-08-26-securing-pwm/
<p>In <a class="external" href="http://andrewwippler.com/2016/08/19/password-management-portal-for-end-users/">last week's post</a> we set up PWM insecurely. In this post, we are going to secure it down and install mysql to store the reset questions. This guide assumes you have this CentOS 7 server publicly accessible with ports 80 and 443 available to the entire world. First, we will need to install mysql, set up a database, and add a user to that database. To do that, we need to edit our <code>manifest.pp</code> and append the following:</p>
<pre class="z-code"><code><span class="z-text z-plain"> class { '::mysql::server':
</span><span class="z-text z-plain"> root_password => 'My4cc0unt$$password!',
</span><span class="z-text z-plain"> remove_default_accounts => true,
</span><span class="z-text z-plain"> package_name => 'mariadb-server',
</span><span class="z-text z-plain"> package_ensure => 'installed',
</span><span class="z-text z-plain"> service_name => 'mariadb',
</span><span class="z-text z-plain"> }
</span><span class="z-text z-plain">
</span><span class="z-text z-plain"> mysql::db { 'pwm':
</span><span class="z-text z-plain"> user => 'pwm',
</span><span class="z-text z-plain"> password => 'pwm_passworD2!', # Can't do a password hash here :(
</span><span class="z-text z-plain"> }
</span><span class="z-text z-plain">
</span><span class="z-text z-plain"> class { 'mysql::bindings':
</span><span class="z-text z-plain"> java_enable => true,
</span><span class="z-text z-plain"> }
</span><span class="z-text z-plain">
</span><span class="z-text z-plain">file { '/opt/tomcat8/pwm/lib/mysql-connector-java.jar':
</span><span class="z-text z-plain"> ensure => link,
</span><span class="z-text z-plain"> target => '/usr/share/java/mysql-connector-java.jar',
</span><span class="z-text z-plain"> require => Class['mysql::bindings']
</span><span class="z-text z-plain">}
</span></code></pre>
<p>We will also need to install additional modules:</p>
<pre class="z-code"><code><span class="z-text z-plain">puppet module install puppetlabs-firewall
</span><span class="z-text z-plain">puppet module install jfryman-nginx
</span><span class="z-text z-plain">puppet module install jfryman-selinux
</span><span class="z-text z-plain">puppet module install danzilio-letsencrypt
</span></code></pre>
<p>Now we can set up our web server and directories by appending the following:</p>
<pre class="z-code"><code><span class="z-text z-plain">file {"/var/www/${::hostname}":
</span><span class="z-text z-plain"> ensure => 'directory',
</span><span class="z-text z-plain"> owner => 'nginx',
</span><span class="z-text z-plain">}
</span><span class="z-text z-plain">
</span><span class="z-text z-plain">file {"/var/www/${::hostname}/index.html":
</span><span class="z-text z-plain"> ensure => 'file',
</span><span class="z-text z-plain"> owner => 'nginx',
</span><span class="z-text z-plain"> content => '<html><head><meta http-equiv="refresh" content="0;URL=/pwm" /></head></html>',
</span><span class="z-text z-plain"> require => File["/var/www/${::hostname}"],
</span><span class="z-text z-plain">}
</span><span class="z-text z-plain">
</span><span class="z-text z-plain">firewall { '100 allow http, https access':
</span><span class="z-text z-plain"> dport => [80, 443],
</span><span class="z-text z-plain"> proto => tcp,
</span><span class="z-text z-plain"> action => accept,
</span><span class="z-text z-plain">}
</span><span class="z-text z-plain">
</span><span class="z-text z-plain">selinux::fcontext {'set-httpd-context':
</span><span class="z-text z-plain"> context => "httpd_sys_content_t",
</span><span class="z-text z-plain"> pathname => "/var/www(/.*)?",
</span><span class="z-text z-plain">}
</span><span class="z-text z-plain">
</span><span class="z-text z-plain">selinux::boolean {'httpd_can_network_connect': }
</span><span class="z-text z-plain">
</span><span class="z-text z-plain">class { 'nginx': }
</span><span class="z-text z-plain">
</span><span class="z-text z-plain">nginx::resource::upstream { 'pwm':
</span><span class="z-text z-plain"> members => [ 'localhost:8080' ],
</span><span class="z-text z-plain">}
</span><span class="z-text z-plain">
</span><span class="z-text z-plain">nginx::resource::vhost { "${::hostname}.${::domain}":
</span><span class="z-text z-plain"> ensure => present,
</span><span class="z-text z-plain"> www_root => "/var/www/${::hostname}/",
</span><span class="z-text z-plain"> #ssl => true,
</span><span class="z-text z-plain"> index_files => [],
</span><span class="z-text z-plain"> try_files => ['$uri','$uri/index.html','@pwm'],
</span><span class="z-text z-plain"> #rewrite_to_https => true,
</span><span class="z-text z-plain"> #ssl_cert => "/etc/letsencrypt/live/${::fqdn}/fullchain.pem",
</span><span class="z-text z-plain"> #ssl_key => "/etc/letsencrypt/live/${::fqdn}/privkey.pem",
</span><span class="z-text z-plain">}
</span><span class="z-text z-plain">
</span><span class="z-text z-plain">nginx::resource::location{'@pwm':
</span><span class="z-text z-plain"> proxy => 'http://pwm',
</span><span class="z-text z-plain"> vhost => "${::hostname}.${::domain}",
</span><span class="z-text z-plain"> ssl => true,
</span><span class="z-text z-plain">}
</span><span class="z-text z-plain">
</span></code></pre>
<p><code>``` Leave the ssl options commented out for now. We need the web server set up before running letsencrypt. After we save the file and run another</code>puppet apply manifest.pp` we can add the letsencrypt information and uncomment the ssl information.</p>
<pre class="z-code"><code><span class="z-text z-plain">class { ::letsencrypt:
</span><span class="z-text z-plain"> email => 'andrew.wippler@example.com',
</span><span class="z-text z-plain"> require => Class['nginx'],
</span><span class="z-text z-plain">}
</span><span class="z-text z-plain">
</span><span class="z-text z-plain">letsencrypt::certonly { 'pwm cert':
</span><span class="z-text z-plain"> domains => ["${::fqdn}"],
</span><span class="z-text z-plain"> plugin => 'webroot',
</span><span class="z-text z-plain"> webroot_paths => ["/var/www/${::hostname}"],
</span><span class="z-text z-plain"> manage_cron => true,
</span><span class="z-text z-plain"> }
</span></code></pre>
<p>Apply the manifest one more time and enjoy your new instance of PWM. As a reference, my entire manifest can be seen below:</p>
<pre class="z-code"><code><span class="z-text z-plain">include git
</span><span class="z-text z-plain">include java
</span><span class="z-text z-plain">
</span><span class="z-text z-plain">tomcat::install { '/opt/tomcat8':
</span><span class="z-text z-plain"> source_url => 'https://www.apache.org/dist/tomcat/tomcat-8/v8.5.3/bin/apache-tomcat-8.5.3.tar.gz'
</span><span class="z-text z-plain">}
</span><span class="z-text z-plain">
</span><span class="z-text z-plain">tomcat::instance { 'tomcat8-pwm':
</span><span class="z-text z-plain"> catalina_home => '/opt/tomcat8',
</span><span class="z-text z-plain"> catalina_base => '/opt/tomcat8/pwm',
</span><span class="z-text z-plain">}
</span><span class="z-text z-plain">
</span><span class="z-text z-plain">tomcat::war { 'pwm.war':
</span><span class="z-text z-plain"> catalina_base => '/opt/tomcat8/pwm',
</span><span class="z-text z-plain"> war_source => '/path/to/pwm.war', # or http://domain.tld/pwm.war
</span><span class="z-text z-plain"> before => File['/opt/tomcat8/pwm/lib/mysql-connector-java.jar'],
</span><span class="z-text z-plain">}
</span><span class="z-text z-plain">
</span><span class="z-text z-plain">augeas { 'web.xml':
</span><span class="z-text z-plain"> incl => '/opt/tomcat8/pwm/webapps/pwm/WEB-INF/web.xml',
</span><span class="z-text z-plain"> context => '/files/opt/tomcat8/pwm/webapps/pwm/WEB-INF/web.xml/web-app',
</span><span class="z-text z-plain"> lens => 'Xml.lns',
</span><span class="z-text z-plain"> changes => 'set context-param[1]/param-value/#text /opt/tomcat8/pwm/webapps/pwm/WEB-INF',
</span><span class="z-text z-plain">}
</span><span class="z-text z-plain">
</span><span class="z-text z-plain">class { '::mysql::server':
</span><span class="z-text z-plain"> root_password => 'My4cc0unt$$password!',
</span><span class="z-text z-plain"> remove_default_accounts => true,
</span><span class="z-text z-plain"> package_name => 'mariadb-server',
</span><span class="z-text z-plain"> package_ensure => 'installed',
</span><span class="z-text z-plain"> service_name => 'mariadb',
</span><span class="z-text z-plain">}
</span><span class="z-text z-plain">
</span><span class="z-text z-plain">mysql::db { 'pwm':
</span><span class="z-text z-plain"> user => 'pwm',
</span><span class="z-text z-plain"> password => 'pwm_passworD2!', # Can't do a password hash here :(
</span><span class="z-text z-plain">}
</span><span class="z-text z-plain">
</span><span class="z-text z-plain">class { 'mysql::bindings':
</span><span class="z-text z-plain"> java_enable => true,
</span><span class="z-text z-plain">}
</span><span class="z-text z-plain">
</span><span class="z-text z-plain">file { '/opt/tomcat8/pwm/lib/mysql-connector-java.jar':
</span><span class="z-text z-plain"> ensure => link,
</span><span class="z-text z-plain"> target => '/usr/share/java/mysql-connector-java.jar',
</span><span class="z-text z-plain"> require => Class['mysql::bindings']
</span><span class="z-text z-plain">}
</span><span class="z-text z-plain">
</span><span class="z-text z-plain">file {"/var/www/${::hostname}":
</span><span class="z-text z-plain"> ensure => 'directory',
</span><span class="z-text z-plain"> owner => 'nginx',
</span><span class="z-text z-plain">}
</span><span class="z-text z-plain">
</span><span class="z-text z-plain">file {"/var/www/${::hostname}/index.html":
</span><span class="z-text z-plain"> ensure => 'file',
</span><span class="z-text z-plain"> owner => 'nginx',
</span><span class="z-text z-plain"> content => '<html><head><meta http-equiv="refresh" content="0;URL=/pwm" /></head></html>',
</span><span class="z-text z-plain"> require => File["/var/www/${::hostname}"],
</span><span class="z-text z-plain">}
</span><span class="z-text z-plain">
</span><span class="z-text z-plain">firewall { '100 allow http, https access':
</span><span class="z-text z-plain"> dport => [80, 443],
</span><span class="z-text z-plain"> proto => tcp,
</span><span class="z-text z-plain"> action => accept,
</span><span class="z-text z-plain"> }
</span><span class="z-text z-plain">
</span><span class="z-text z-plain">selinux::fcontext {'set-httpd-context':
</span><span class="z-text z-plain"> context => "httpd_sys_content_t",
</span><span class="z-text z-plain"> pathname => "/var/www(/.*)?",
</span><span class="z-text z-plain">}
</span><span class="z-text z-plain">
</span><span class="z-text z-plain">selinux::boolean {'httpd_can_network_connect': }
</span><span class="z-text z-plain">
</span><span class="z-text z-plain">class { 'nginx': }
</span><span class="z-text z-plain">
</span><span class="z-text z-plain">nginx::resource::upstream { 'pwm':
</span><span class="z-text z-plain"> members => [ 'localhost:8080' ],
</span><span class="z-text z-plain">}
</span></code></pre>
<pre class="z-code"><code><span class="z-text z-plain">nginx::resource::vhost { "${::hostname}.${::domain}":
</span><span class="z-text z-plain"> ensure => present,
</span><span class="z-text z-plain"> index_files => [],
</span><span class="z-text z-plain"> www_root => "/var/www/${::hostname}/",
</span><span class="z-text z-plain"> ssl => true,
</span><span class="z-text z-plain"> try_files => ['$uri', '$uri/index.html', '@pwm'],
</span><span class="z-text z-plain"> rewrite_to_https => true,
</span><span class="z-text z-plain"> ssl_cert => "/etc/letsencrypt/live/${::fqdn}/fullchain.pem",
</span><span class="z-text z-plain"> ssl_key => "/etc/letsencrypt/live/${::fqdn}/privkey.pem",
</span><span class="z-text z-plain">}
</span><span class="z-text z-plain">
</span><span class="z-text z-plain">nginx::resource::location{'@pwm':
</span><span class="z-text z-plain"> proxy => 'http://pwm',
</span><span class="z-text z-plain"> vhost => "${::hostname}.${::domain}",
</span><span class="z-text z-plain"> ssl => true,
</span><span class="z-text z-plain">}
</span></code></pre>
<pre class="z-code"><code><span class="z-text z-plain">class { ::letsencrypt:
</span><span class="z-text z-plain"> email => 'andrew.wippler@example.com',
</span><span class="z-text z-plain"> require => Class['nginx'],
</span><span class="z-text z-plain">}
</span><span class="z-text z-plain">
</span><span class="z-text z-plain">letsencrypt::certonly { 'pwm cert':
</span><span class="z-text z-plain"> domains => ["${::fqdn}"],
</span><span class="z-text z-plain"> plugin => 'webroot',
</span><span class="z-text z-plain"> webroot_paths => ["/var/www/${::hostname}"],
</span><span class="z-text z-plain"> manage_cron => true,
</span><span class="z-text z-plain">}
</span></code></pre>
Password management portal for end users
2016-08-19T14:00:00+00:00
2016-08-19T14:00:00+00:00
Andrew Wippler
/2016-08-19-password-management-portal-for-end-users/
<p>We in IT have heard it often, the #1 request coming into help desk ticket systems is password resets, account lockouts, and the like. PWM is a password reset web application written in Java for use with LDAP directories. You can configure it to work with Active Directory, OpenLDAP, FreeIPA, and others. There are already a handful of good tutorials on how to set up PWM (<a class="external" href="http://www.serveradventures.com/the-adventures/installing-pwm-open-source-password-self-service-for-ldap">I think of this one in particular</a>); however, I want to demonstrate the <code>puppet apply</code> command in this tutorial.</p>
<h3 id="prerequisites">Prerequisites</h3>
<p>This guide assumes you have an Active Directory server with TLS set up (to change passwords) which is beyond the scope of this post. It also assumes you have a CentOS 7 instance which can communicate to the Active Directory server. It also assumes this is in an environment without a puppet master/server. The end manifest can be uploaded to a master and used that way.</p>
<h3 id="obtaining-pwm">Obtaining PWM</h3>
<p>PWM is available in zip format <a class="external" href="http://www.pwm-project.org/artifacts/pwm/">on their website</a> or in source format <a class="external" href="https://github.com/pwm-project/pwm">on GitHub</a>. We are going to use the war file so grab the zip from off of their website, extract it, and place it on a webserver or locally on the server.</p>
<pre class="z-code"><code><span class="z-text z-plain">yum install wget unzip -y
</span><span class="z-text z-plain">wget http://www.pwm-project.org/artifacts/pwm/pwm-1.8.0-SNAPSHOT-2016-05-23T22%3A36%3A58Z-pwm-bundle.zip
</span><span class="z-text z-plain">unzip pwm*.zip
</span></code></pre>
<h3 id="installing-puppet-and-puppet-modules">Installing puppet and puppet modules</h3>
<p>Our next step is to get puppet and relevant puppet modules</p>
<pre class="z-code"><code><span class="z-text z-plain">rpm -ivh http://yum.puppetlabs.com/puppetlabs-release-pc1-el-7.noarch.rpm
</span><span class="z-text z-plain">yum install puppet -y
</span><span class="z-text z-plain">source /etc/profile
</span><span class="z-text z-plain">puppet module install puppetlabs-mysql
</span><span class="z-text z-plain">puppet module install puppetlabs-java
</span><span class="z-text z-plain">puppet module install puppetlabs-git
</span><span class="z-text z-plain">puppet module install puppetlabs-concat
</span><span class="z-text z-plain">puppet module install puppetlabs-tomcat --ignore-dependencies
</span><span class="z-text z-plain">
</span></code></pre>
<p>We are <code>--ignore-dependencies</code> because there is a conflicting staging module that the <code>mysql</code> module already installed.</p>
<pre class="z-code"><code><span class="z-text z-plain">vim manifest.pp
</span></code></pre>
<p>The contents of this file are as below:</p>
<pre class="z-code"><code><span class="z-text z-plain">include git
</span><span class="z-text z-plain">include java
</span><span class="z-text z-plain">
</span><span class="z-text z-plain">tomcat::install { '/opt/tomcat8':
</span><span class="z-text z-plain"> source_url => 'https://www.apache.org/dist/tomcat/tomcat-8/v8.5.3/bin/apache-tomcat-8.5.3.tar.gz'
</span><span class="z-text z-plain">}
</span><span class="z-text z-plain">
</span><span class="z-text z-plain">tomcat::instance { 'tomcat8-pwm':
</span><span class="z-text z-plain"> catalina_home => '/opt/tomcat8',
</span><span class="z-text z-plain"> catalina_base => '/opt/tomcat8/pwm',
</span><span class="z-text z-plain">}
</span><span class="z-text z-plain">
</span><span class="z-text z-plain">tomcat::war { 'pwm.war':
</span><span class="z-text z-plain"> catalina_base => '/opt/tomcat8/pwm',
</span><span class="z-text z-plain"> war_source => '/path/to/pwm.war', # or http://domain.tld/pwm.war
</span><span class="z-text z-plain">}
</span><span class="z-text z-plain">
</span><span class="z-text z-plain">augeas {'web.xml':
</span><span class="z-text z-plain"> incl => '/opt/tomcat8/pwm/webapps/pwm/WEB-INF/web.xml',
</span><span class="z-text z-plain"> context => '/files/opt/tomcat8/pwm/webapps/pwm/WEB-INF/web.xml/web-app',
</span><span class="z-text z-plain"> lens => 'Xml.lns',
</span><span class="z-text z-plain"> changes => 'set context-param[1]/param-value/#text /opt/tomcat8/pwm/webapps/pwm/WEB-INF',
</span><span class="z-text z-plain">}
</span><span class="z-text z-plain">
</span></code></pre>
<p>We can now enforce the environment by issuing a <code>puppet apply manifest.pp</code>. This will install PWM (insecurely), java, git, and tomcat. PWM is insecure in this state as passwords can be intercepted before they hit the web server. <a class="external" href="http://andrewwippler.com/2016/08/26/securing-pwm/">In a follow-up tutorial next week</a>, I will explain how to install mysql (to store the password reset questions) as well as placing nginx in front of tomcat to offer SSL and http to https redirection.</p>