<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=us-ascii" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 8.00.6001.19298"></HEAD>
<BODY bgColor=#ffffff text=#000000>
<DIV dir=ltr align=left><SPAN class=036140216-03092013><FONT color=#0000ff
size=2 face=Arial>Sounds like future work and integrating with Satellite 6 when
it comes. We delete the post-install scripts before reboot at the moment,
so we're not in a bad way.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=036140216-03092013><FONT color=#0000ff
size=2 face=Arial></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=036140216-03092013><FONT color=#0000ff
size=2 face=Arial>Thanks Dmitri</FONT></SPAN></DIV><BR>
<BLOCKQUOTE
style="BORDER-LEFT: #0000ff 2px solid; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; MARGIN-RIGHT: 0px">
<DIV dir=ltr lang=en-us class=OutlookMessageHeader align=left>
<HR tabIndex=-1>
<FONT size=2 face=Tahoma><B>From:</B> freeipa-users-bounces@redhat.com
[mailto:freeipa-users-bounces@redhat.com] <B>On Behalf Of </B>Dmitri
Pal<BR><B>Sent:</B> 03 September 2013 16:50<BR><B>To:</B>
freeipa-users@redhat.com<BR><B>Subject:</B> Re: [Freeipa-users] Automated
Kickstart Enrollment<BR></FONT><BR></DIV>
<DIV></DIV>On 09/03/2013 04:21 AM, Innes, Duncan wrote:
<BLOCKQUOTE
cite=mid:56343345B145C043AE990701E3D1939501D56C0B@EXVS2.nrplc.localnet
type="cite">
<META name=GENERATOR content="MSHTML 8.00.6001.19298">
<DIV><SPAN class=220455107-03092013><FONT size=2 face=Arial>Hi
folks,</FONT></SPAN></DIV>
<DIV><SPAN class=220455107-03092013></SPAN> </DIV>
<DIV><SPAN class=220455107-03092013><FONT size=2 face=Arial>I've got a
question about kickstart enrollment with a one-time password. Namely,
is there any way that it can be done *without* the one-time password.
</FONT></SPAN><SPAN class=220455107-03092013><FONT size=2 face=Arial>We're
comfortable with the pre-creation of the host in IPA, but just wonder if
there's a way to enrol without the one-time password.
</FONT></SPAN></DIV>
<DIV> </DIV>
<DIV><FONT size=2 face=Arial><SPAN class=220455107-03092013>The estate is
Red Hat (mostly 6) and we deploy systems via kickstart from the
Satellite. Can the Satellite push out a certificate from the IPA
system that would allow client to enrol without the OTP? Our
enrollment script runs as part of the kickstart postinstall with the OTP
effectively sitting in plain text in the script. Removing the OTP
would remove the plain text authentication from this script, but I may be
opening other security holes as a result.</SPAN></FONT></DIV>
<DIV><FONT size=2 face=Arial><SPAN
class=220455107-03092013></SPAN></FONT><BR></DIV></BLOCKQUOTE>Hello,<BR><BR><BR>There
have been 3 ways about how the host can be enrolled:<BR>a) High level admin
using his credential (no need to have a pre-created host)<BR>b) Lower level
admin using his credential (requires a pre-created host)<BR>c) OTP based
(requires a pre-created host)<BR><BR>All provisioning methods that use static
kickstart files would have to have something injected into the kickstart. OTP
is the safest and if leaked can be used to only provision this specific
system. The fact that OTP was stolen can be detected easily by having a failed
enrollment of the valid system combined with IPA logs indicating that there
was a successful enrollment of the new host with the same name. The fact that
intruder was able to join a machine into IPA domain does not escalate his
privileges against other systems and since it can be easily caught it is a
risk but not a huge one.<BR><BR>The right approach of cause is not to have the
OTP stored in kickstart but rather parameterized in some way. In Satellite 6
(that we are looking at) this will be done via Foreman and its smart proxies.
The design is not polished yet but we hope that we would be able to limit the
exposure of the OTPs there. <BR><BR>Also a new provisioning method has been
added in FreeIPA 3.2 mostly for re-provisioning - ability to provision if you
already have a keytab.<BR>This method will be sort of equivalent to what you
are asking with a cert. But instead of the cert you would need to get keytab
first by creating a host and then using ipa-getkeytab command and passing
keytab to the kickstart. That can be done now and would address the issue you
are concerned about.<BR><BR><BR>HTH<BR><BR>Thanks,<BR>Dmitri<BR>
<BLOCKQUOTE
cite=mid:56343345B145C043AE990701E3D1939501D56C0B@EXVS2.nrplc.localnet
type="cite">
<DIV><FONT size=2 face=Arial><SPAN
class=220455107-03092013>Cheers</SPAN></FONT></DIV>
<DIV> </DIV>
<DIV align=left><FONT size=2 face=Arial>Duncan Innes</FONT></DIV>
<DIV> </DIV><BR clear=all>
<FIELDSET class=mimeAttachmentHeader></FIELDSET> <BR><PRE wrap="">_______________________________________________
Freeipa-users mailing list
<A class=moz-txt-link-abbreviated href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</A>
<A class=moz-txt-link-freetext href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</A></PRE></BLOCKQUOTE><BR><BR><PRE class=moz-signature cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager for IdM portfolio
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
<A class=moz-txt-link-abbreviated href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</A>
</PRE><BR clear=both>This message has been checked for viruses and spam by the
Virgin Money email scanning system powered by
Messagelabs.<BR></BLOCKQUOTE><br clear="both">
This message has been checked for viruses and spam by the Virgin Money email scanning system powered by Messagelabs.<BR>
<BR>
<BR>
<BR>
This e-mail is intended to be confidential to the recipient. If you receive a copy in error, please inform the sender and then delete this message.<BR>
<BR>
Virgin Money plc - Registered in England and Wales (Company no. 6952311). Registered office - Jubilee House, Gosforth, Newcastle upon Tyne NE3 4PL. Virgin Money plc is authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority.<BR>
<BR>
The following companies also trade as Virgin Money. They are both authorised and regulated by the Financial Conduct Authority, are registered in England and Wales and have their registered office at Discovery House, Whiting Road, Norwich NR4 6EJ: Virgin Money Personal Financial Service Limited (Company no. 3072766) and Virgin Money Unit Trust Managers Limited (Company no. 3000482).<BR>
<BR>
For further details of Virgin Money group companies please visit our website at virginmoney.com<BR>
</BODY></HTML>