Ubuntu Server 22.0.4 SSH connections

Ubuntu server MFA Integration

General Overview

This guide explains the instructions on configuring Mirket multi-factor authentication for Ubuntu server ssh login .

Configuring Ubuntu Server

Follow these steps to configure Ubuntu:

1. Enter these two command line prompts:

   $ sudo apt-get install libpam-radius-auth
   $ sudo nano /etc/ssh/sshd_config

2. Edit the following lines and remove the “#” letter if they have.

   ChallengeResponseAuthentication yes
   UsePAM yes
   KbdInteractiveAuthentication yes

3. Enter this command line:

   $ sudo nano /etc/pam.d/sshd

4. Add the following line to the start of the file.

   auth  sufficient   pam_radius_auth.so

5. Enter this command line:

   $ sudo nano /etc/pam_radius_auth.conf

6. First, you should comment on all current settings.

   

   You can even remove all lines and keep your file simple.

7. Add the RADIUS server hostname or IP address using this format:

   #server[:port]    shared_secret    timeout(s)
   IP/FQDN           MySecret         60

   where:

   IP/FQDN	The IP address or hostname for this SecureAuth Identity platform appliance.
   MySecret	The shared secret used in the appliance.radius.properties file on the SecureAuth Identity Platform appliance, under the SA RADIUS Configuration folder.
   60	The number of seconds for communication between the servers.

8. Restart the SSHD service using this command:

   $ sudo service ssh restart

9. Create accounts for the user accounts you want to connect with MFA

sudo adduser micheal --disabled-password

For troubleshooting , see the logs ;

sudo tail -f /var/log/auth.log

Configure Mirket

To enable Mirket to receive authentication requests from Ubuntu server, follow these steps:

Add a Ubuntu server as Resource in Mirket with Mirket Radius Gateway

Before starting, ensure that you have installed Mirket Radius Gateway. To add a Radius Client to the Mirket Radius Gateway, follow these steps:

• First, navigate to the directory C:\MirketRadius and open the config.json file.

• Fill in the gateway and radiusClientList fields according to the provided specifications to ensure accurate and secure network configuration.

  • samName: Enter the SAM name of the gateway. In Mirket, user identification is done using the SAM (Security Account Manager) name. This is preferred over the standard username. This username is used for authentication and access controls. Please provide your domain name, such as 'mirket'.

  • authenticationPort: Enter the authentication port value you set for the gateway. The default value is 1812.

  • accountingPort: Enter the accounting port value you specified for the gateway. The default value is 1813.

  • gatewayIp: Enter the IP address of the server where the Mirket is installed.

  • ipAddress: Enter the IP address of your firewall.

  • secretKey: Enter your secret key. This secret key is used to link your radius client and radius server, so ensure they are identical.

• Once you've made the necessary changes to the config.json file, save and close it. Note: You can add multiple RADIUS clients.

• After completing the configuration, restart the 'Mirket Radius Gateway Service'.

User and Group configuration on Mirket

To set up multifactor authentication, make sure you have at least one user group in Mirket.

If it is preferred to use a local user, first create a local group and then create a local user and make the user a member of the group.

• Create a Local Group to add users manually.

• Add local Mirket users manually.

If it is preferred to use LDAP users, the priority LDAP group is created by pulling users from Active Directory or OpenLDAP in Mirket.

• Create a LDAP group to include LDAP users.

• Sync users from an external user database.

Add a Radius Rules to Mirket

Radius Rules define user access to resources and the authentication methods available (such as SMS, Approve / Deny, OTP etc.).

First, you should follow these steps:

• Select Rules > Radius Rules.

• Click on Add New.

• Enter a rule name in the Name field.

• Enter the rule description in the Description field.

• Select the group to which the rule applies from the Group dropdown list.

• Select the provider to which the rule applies from the Provider dropdown list.

• Click on Save to confirm settings.

Related Topics

Palo Alto SSL VPN Integration

Radius Clients

Radius Rules

Local Group Configuration

Local Users Configuration

LDAP Group Configuration

LDAP Users