Hacker-ID

During the draft phase, the following groups have been configured:

IDP admins may always step in to assist, shall any of the groups be orphaned (no active/reachable members).

Kanidm can be used as a resolve-through locally caching authentication handler, resilient to network failures and transparently allowing existing local credentials to be used as-is.

There's relatively few steps compared to some other authentication provider solutions:

1. Install the client tools repo
2. Configure ''kanidm-unixd''
   1. Edit config file /etc/kanidm/config: Set uri to https://idp.hackeriet.no
   2. Edit config file /etc/kanidm/unixd: Set pam_allowed_login_groups to hackeriet-members or other relevant groups
      1. Optional: Add group mappings, like sudo or docker rights:

         [[kanidm.map_group]]
         local = "sudo"
         with = "hackeriet-members"
         
         [[kanidm.map_group]]
         local = "docker"
         with = "hackeriet-members"

3. Tell Linux to proxy user and group lookups through ''kanidm-unixd''
4. Register the Kanidm PAM modules
   1. Debian/Ubuntu/Raspbian: This step can be skipped, although the bundled unix-chkpwd AppArmor profile on Ubuntu must be disabled/fixed
   2. Fedora/CentOS/Rocky
      1. Note: SELinux profiles are NOT included
   3. Others
5. Set kanidm as a global authorized keys command and apply additional SSH hardening

Restart kanidm-unixd service, review the unit logs, and attempt login using kanidm-unix:

# kanidm-unix status
system: online
Kanidm: online

# kanidm-unix auth-test --name d404d
Enter Unix password: [hidden]
auth success!
account success!

• Some information is publicly accessible, as required by unix/posix integrations: https://kanidm.github.io/kanidm/stable/accounts/anonymous_account.html#access
  • Anonymous access will be removed once this draft is finalized: https://kanidm.github.io/kanidm/master/developers/designs/domain_join_machine_accounts.html
• Users are allowed to change all details about their profile! NEVER consider anything but the user UUID to be user identifiable (see the sub claim or uuid claims re. OpenIDC)
  • THIS INCLUDES THE USERNAME AND EMAIL

Rough notes for the moment:

• Hosted on idp1.hackeriet.no (DNS record pending, 10.10.50.52)
• Authentication realm is idp.hackeriet.no
• Public portal and API on https://idp.hackeriet.no
• Internal services (SSH, LDAP, RADIUS etc.) will be exposed on int-idp.hackeriet.no
  • We won't be able to get LDAP certs for the right hostname on the internal interface… If this turns out to be a dealbreaker it might be better to solve this using NAT rather than moving the host entirely onto VLAN 130.
• Located in /srv/kanidm
  • One docker compose stack with Traefik (for certificate issuance as LE needs this in-line) and Kanidm
  • Communication between the two are encrypted using a self-signed certificate (Kanidm requires last-hop encryption)
  • Created user and group “kanidm” in the host, which will represent the kanidm container's resources. Rights configured according to https://kanidm.github.io/kanidm/stable/security_hardening.html#security-hardening
• Kanidm includes built-in backup solution and replication
  • No mirroring of the backups has been configured yet
• Set up kanidm-unixd for idp1.hackeriet.no
  • Installed daemon
  • Added to SSH config
  • Added to nsswitch
  • For Debian flavours incl. Ubuntu and Raspbian, installing kanidm-unixd and configuring the two config files in /etc/kanidm should be enough wrt. PAM
  • AppArmor default profiles blocks access to the service socket used, need to amend the profile with the correct paths then reload & restart