3.2.1. PAM iptables Module

The PAM session module that inserts the firewall rules is needed to allow forwarding for the authenticated client. To set it up simply get the source and compile it by running the following commands.

     gcc -fPIC -c pam_iptables.c
     ld -x --shared -o pam_iptables.so pam_iptables.o
     

You should now have two binaries called pam_iptables.so and pam_iptables.o. Copy pam_iptables.so to /lib/security/pam_iptables.so.

     cp pam_iptables.so /lib/security/pam_iptables.so
     

Now install the firewall script to /usr/local/auth-gw.

     mkdir /usr/local/auth-gw
     cp insFwall /usr/local/auth-gw
     

The chosen authentication client for the gateway was ssh so we added the following line to /etc/pam.d/sshd.

     session    required     /lib/security/pam_iptables.so 
     

Now, when a user logs in with ssh, the firewall rule will be added.

To test if the pam_iptables module is working perform the following steps:

1. Log into the box with ssh.

2. Check to see if the rule was added with the command iptables -L -v.

3. Log out of the box to make sure the rule is removed.

3.2.2. NoCatAuth gateway

This section describes the process of setting up the NocatAuth gateway. To setup NocatAuth get the source and install with the following steps.

Make sure gpgv is installed. gpgv is a PGP signature verifier. It is part of gnupg and can be found at http://www.gnupg.org/download.html.

Unpack the NocatAuth tar file.

tar xvzf NocatAuth-x.xx.tar.gz

If you do not want NoCatAuth to be in the directory /usr/local/nocat, edit the Makefile and change INST_PATH to the directory you would like NoCatAuth to reside.

Next build the gateway.

cd NoCatAuth-x.xx make gateway

Edit the /usr/local/nocat.conf file. Please see the INSTALL documentation for details on what is required in the conf file. An example conf file looks like the following:

 
     ###### gateway.conf -- NoCatAuth Gateway Configuration.
     # 
     # Format of this file is: Directive Value, one per 
     # line. Trailing and leading whitespace is ignored. Any 
     # line beginning with a punctuation character is assumed to 
     # be a comment.
     
     Verbosity       10
     #we are behind a NAT so put the gateway in passive mode
     GatewayMode     Passive
     GatewayLog      /usr/local/nocat/nocat.log
     LoginTimeout    300
     
     ######Open Portal settings.
     HomePage        http://www.itlab.musc.edu/
     DocumentRoot    /usr/local/nocat/htdocs
     SplashForm      splash.html
     ###### Active/Passive Portal settings.
     TrustedGroups Any
     AuthServiceAddr egon.itlab.musc.edu
     AuthServiceURL  https://$AuthServiceAddr/cgi-bin/login
     LogoutURL       https://$AuthServiceAddr/forms/logout.html
     ###### Other Common Gateway Options.
     AllowedWebHosts egon.itlab.musc.edu
     ResetCmd        initialize.fw
     PermitCmd       access.fw permit $MAC $IP $Class 
     DenyCmd         access.fw deny $MAC $IP $Class 
     

Now you should be able to start the gateway. If any problems occur, please see the INSTALL documentation in the unpacked NoCatAuth directory. The following command will start the gateway:

/usr/local/nocat/bin/gateway

3.4.1. PAM LDAP

As indicated in previous sections, I've set this gateway up to use LDAP for authenticating. However, you can use any means that PAM allows for authentication. See Section 2.4 for more information.

In order to get PAM LDAP to authenticate, I installed OpenLDAP and configured it with the following in /etc/ldap.conf.

     # Your LDAP server. Must be resolvable without using LDAP.
     host itc.musc.edu

     # The distinguished name of the search base.
     base dc=musc,dc=edu
     ssl no
     

The following files were used to configure PAM to do the LDAP authentication. These files were generated by Red Hat's configuration utility.

3.4.2. NoCatAuth Service

It is recommended to install the NoCatAuth Service on another server besides the gateway. A seperate server was used in my examples. In order to setup a NoCatAuth Service, you will need the following software:

1. An SSL enabled webserver, preferably with a registered SSL cert. I used Apache + mod_ssl.

2. Perl 5 (5.6 or better recommended)

3. Net::LDAP, Digest::MD5, DBI, and DBD::MySQL perl modules (get them from CPAN) The module you need depends on what authentication source you are going to use. In my example Net::LDAP is used as the authentication means.

4. Gnu Privacy Guard (gnupg 1.0.6 or better), available at http://www.gnupg.org/download.html

To install unpack the tar file.

$ tar zvxf NoCatAuth-x.xx.tar.gz

If you would like to change the path that NoCatAuth resides , edit the Makefile and change INST_PATH to the desired directory.

Next run the command: make authserv This installs everything in /usr/local/nocat or what you changed INST_PATH to.

Then run make pgpkey The defaults should be fine for most purposes. IMPORTANT: do NOT enter a passphrase! Otherwise, you will get strange messages when the auth service attempts to encrypt messages, and tries to read your passphrase from a non-existent tty

Edit /usr/local/nocat/nocat.conf to fit your situation. Here is an example:

###### authserv.conf -- NoCatAuth Authentication Service Configuration. # # Format of this file is: Directive Value, one per # line. Trailing and leading whitespace is ignored. Any # line beginning with a punctuation character is assumed to # be a comment. Verbosity 10 HomePage http://www.itlab.musc.edu/ DocumentRoot /usr/local/nocat/htdocs # LDAP source DataSource LDAP LDAPHost authldap.musc.edu LDAPBase dc=musc,dc=edu UserTable Member UserIDField User UserPasswdField Pass UserAuthField Status UserStampField Created GroupTable Network GroupIDField Network GroupAdminField Admin MinPasswdLength 8 # LocalGateway -- If you run auth service on the same subnet # (or host) as the gateway you need to specify the hostname # of the gateway. Otherwise omit it. (Requires Net::Netmask) # # LocalGateway 192.168.1.7 LoginForm login.html LoginOKForm login_ok.html FatalForm fatal.html ExpiredForm expired.html RenewForm renew.html PassiveRenewForm renew_pasv.html RegisterForm register.html RegisterOKForm register_ok.html RegisterFields Name URL Description UpdateForm update.html UpdateFields URL Description ###### Auth service user messages. Should be self-explanatory. # LoginGreeting Greetings! Welcome to the Medical University of SC's Network. LoginMissing Please fill in all fields! LoginBadUser That e-mail address is unknown. Please try again. LoginBadPass That e-mail and password do not match. Please try again. LoginBadStatus Sorry, you are not a registered co-op member. RegisterGreeting Welcome! Please enter the following information to register.RegisterMissing Name, E-mail, and password fields must be filled in. RegisterUserExists Sorry, that e-mail address is already taken. Are you already registered? RegisterBadUser The e-mail address provided appears to be invalid. Did you spell it correctly? RegisterInvalidPass All passwords must be at least six characters long. RegisterPassNoMatch The passwords you provided do not match. Please try again. RegisterSuccess Congratulations, you have successfully registered. UpdateGreeting Enter your E-mail and password to update your info. UpdateBadUser That e-mail address is unknown. Please try again. UpdateBadPass That e-mail and password do not match. Please try again. UpdateInvalidPass New passwords must be at least eight characters long. UpdatePassNoMatch The new passwords you provided do not match. Please try again. UpdateSuccess Congratulations, you have successfully updated your account.

Make sure /usr/local/nocat/pgp is owned by the web server user. (ie..nobody or www-data)

Add etc/authserv.conf to your apache httpd.conf file.

Include /usr/local/nocat/etc/authserv.conf

Copy your /usr/local/nocat/trustedkeys.pgp to the gateway. Restart apache and try it out. Please see the NoCatAuth documentation for more information. It can be found in docs/ in the unpacked NoCatAuth directory.