[Freeipa-users] verified certificates both sides of a TLS channel

[Fraser Tweedale]

On Fri, Mar 06, 2015 at 10:32:16AM +0100, Martin Kosek wrote:
> On 03/06/2015 09:34 AM, Andrew Holway wrote:
> >Hi,
> >
> >Were using rabbitmq to shunt bits of data around various systems to provide
> >better security we would like all of our acmq connections to be authenticated
> >and encrypted.
> >
> >I'm looking for appropriate documentation or some friendly guidance of how
> >server to server SSL authentication is done with freeipa and if indeed this is
> >the best way to ensure privacy in such scenarios.
> 
> These are the best documentation sources I could find:
> 
> Creating certs for FreeIPA hosts: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/host-certificates.html
> 
> Creating certs for FreeIPA hosts: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/service-certificates.html
> 
Service certificates issued as per above are usable for TLS client
certificate authentication.  If communications are between two
host/service principals, then TLS client authentication is possible
as long as the server and client software support it.

It would appear that RabbitMQ supports TLS client certificate
authentication: http://www.rabbitmq.com/ssl.html

TLS is the best way to ensure privacy for these connections, and it
also achieves authentication.  Whether it is the *best* way to
authenticate clients depends on what other options there are, how
easy client and server are to configure the methods for, and whether
it also accomplishes authorization (certificate authentication does
not, at least not directly).

> With these certificates, you would need to manually configure SSL-based
> authentication with mod_ssl/mod_nss. Partially related user howto is
> http://www.freeipa.org/page/Apache_SNI_With_Kerberos
> 
> I wonder if RabbitMQ has GSSAPI support, that would be more easy to
> configure with FreeIPA than SSL certs.
> 
There seems to be some unofficial Kerberos (not GSSAPI) support:
http://comments.gmane.org/gmane.comp.networking.rabbitmq.general/23249
Maybe there is good support for GSSAPI but I did not see it in my
quick search.

> Btw FreeIPA 4.2 plans to have much better support for different cert
> profiles or sub-CAs that you may later use for purposes like this one.
> 
This is highly desirable, and it is coming.  FreeIPA currently
issues all certificates directly from a single CA, and any
certificate issued by the CA will be considered valid (as long as it
is not expired, revoked, etc).  At this time, application- or TLS
termination-layer logic is needed to make authorisation decisions.

> Ticket:
> https://fedorahosted.org/freeipa/ticket/57
> 
> CCing Fraser from Dogtag team for reference.
> 
> Martin