Colors of Noise

Using Kerberos for single sign on is a nice thing but one feels uncomfortable that only a password grants access to all services. One can use smart cards and public key cryptography to achieve Two factor authenticaton which makes things considerably safer. In Kerberos terms this is called pkinit. To get there, several steps are necessary:

1. Creating the PKI
2. Setting up the KDC
3. Setting up the user part
4. Putting things on the smart card

The step below assume you already have a working Heimdal Kerberos setup in a realm named MS20.NIX and are using Debian.

Creating the PKI

If you don't already have certificates hxtool is the simplest thing to create them:

Create the Certificate Authority (CA):

$ hxtool issue-certificate --self-signed --issue-ca --generate-key=rsa --subject="CN=CA,DC=ms20,DC=nix" --lifetime=10years --certificate="FILE:ca.pem"

Create the KDCs certificate:

$ hxtool issue-certificate --ca-certificate=FILE:ca.pem --generate-key=rsa --type="pkinit-kdc" --pk-init-principal="krbtgt/MS20.NIX@MS20.NIX" --subject="uid=kdc,DC=ms20,DC=nix" --certificate="FILE:kdc.pem"

Create the Certificate for a User agx@MS20.NIX:

$ hxtool issue-certificate --ca-certificate=FILE:ca.pem --generate-key=rsa --type="pkinit-client" --pk-init-principal="agx@MS20.NIX" --subject="uid=agx,DC=ms20,DC=nix" --certificate="FILE:user.pem"

In the above setup, hxtool puts the certificate and the private key into one file, so extract the lines between:

-----BEGIN RSA PRIVATE KEY-----
...
-----END RSA PRIVATE KEY-----

from ca.pem, store it away in ca.key ant put it at a save location, remove these lines from ca.pem then. Don't put ca.key on the KDC - you only need it to create new certificates. The resulting ca.pem is the save to copy around.

Note: unfortunately hxtool is currently missing from the heimdal-clients Debian package. You can aplly the patch from #487119 and rebuild the package.

Setting up the KDC

You need to enable pkinit in /etc/heimdal-kdc/kdc.conf and tell the KDC where to find it's own identity (pkinit_identity) as well as the trust anchors (pkinit_anchors). For simplicity we use our new CA as the only trust anchor so only certificates signed by this ca are valid for the KDC:

enable-pkinit = yes
pkinit_identity = FILE:/etc/heimdal-kdc/pkinit/kdc.pem
pkinit_anchors = FILE:/etc/heimdal-kdc/pkinit/ca.pem
# don't allow proxy certificates
pkinit_allow_proxy_certificate = false
pkinit_win2k_require_binding = yes

Copy ca.pem and kdc.pem to the above locations. Make sure kdc.pem is only readable by root since it contains a private key.

Setting up the user part

The client needs to know about our CA too since it needs to identify the KDC. This is setup in /etc/krb5.conf:

[libdefaults]
pkinit_anchors = FILE:/etc/ssl/certs/ca.pem

Copy ca.pem to the above location. Also copy user.pem to ~ and split out the private key part into a separate file user.key (the steps are the same as explained for the CA above). You can the test your installation with:

 $ cd ~
 $ kinit -C FILE:user.pem,user.key agx@MS20.NIX
 $ klist

 Credentials cache: FILE:/tmp/krb5cc_0
    Principal: agx@MS20.NIX

   Issued           Expires          Principal
 Jun 20 14:52:27  Jun 21 00:52:27  krbtgt/MS20.NIX@MS20.NIX

Putting things onto the smart card:

First Install opensc and make sure your smart card is recognized:

 $ opensc-tool -n
 CardOS M4 

I used an empty Aladdin eToken Pro which I wiped completely before adding the keys:

 $ pkcs15-init -E
 $ pkcs15-init -C -p pkcs15+onepin
 $ pkcs15-init --store-private-key user.key --auth-id 01 
 $ pkcs15-init --store-certificate user.pem --auth-id 01 
 # Lets see if it worked:
 $ kinit -C PKCS11:/usr/lib/opensc/opensc-pkcs11.so agx@MS20.NIX

 Credentials cache: FILE:/tmp/krb5cc_0
    Principal: agx@MS20.NIX

   Issued           Expires          Principal
 Jun 20 14:52:27  Jun 21 00:52:27  krbtgt/MS20.NIX@MS20.NIX

That's it. The steps above are quiet terse but this should get you started. Libpam-krb5 has pkinit support so you can use this during logon.