The patch below enables use of libfido2 in tsh and tctl, via dynamic linking: /usr/local/bin/tsh: Start End Type Open Ref GrpRef Name 0000000000200000 000000000a476000 exe 2 0 0 /usr/local/bin/tsh 00000002366a2000 00000002366af000 rlib 0 1 0 /usr/lib/libpthread.so.28.1 0000000226350000 0000000226384000 rlib 0 1 0 /usr/lib/libfido2.so.9.0 00000002991f1000 000000029943a000 rlib 0 2 0 /usr/lib/libcrypto.so.57.2 000000027d642000 000000027d74b000 rlib 0 1 0 /usr/lib/libc.so.104.0 0000000276598000 00000002765ad000 rlib 0 1 0 /usr/lib/libcbor.so.2.0 00000002fb7ce000 00000002fb7eb000 rlib 0 1 0 /usr/lib/libz.so.7.2 0000000264cb1000 0000000264cb1000 ld.so 0 1 0 /usr/libexec/ld.so Webauthn needs to be enabled by running 'tctl edit cap' and changing the configuartion file. Something like the following should do (the default is just "otp"): spec: type: local second_factors: ["otp", "webauthn"] webauthn: rp_id: teleport.example.com Once teleport is restarted with this config, the web UI will offer webauthn as a second factor at login. A fido key needs to be registered with 'tsh mfa add', and can then be used fo log in to the web UI, and presumably other services which teleport handles authentication for. Successfully tested with a Yubikey. See here for upstream documentation: https://goteleport.com/docs/zero-trust-access/management/security/idp-compromise/#set-up-cluster-wide-webauthn ok? enable fido2 support in net/teleport M net/teleport/Makefile | 3+ 2- M net/teleport/pkg/README | 0+ 1- 2 files changed, 3 insertions(+), 3 deletions(-) commit - 377b80dbbc947adf0daf6f581bee8f137ae408b4 commit + bec9cf396ae4d4d4acd59ad945560d623b561420 blob - 73acb2c93da5ec68fe649d274d525bf0ac9dd0ef blob + 402f2a87cea9fe9bebaa871d672ae88d17ff83ba --- net/teleport/Makefile +++ net/teleport/Makefile @@ -1,6 +1,7 @@ COMMENT = reverse-proxy with built-in authentication and auditing V = 18.11.1 +REVISION = 0 DISTNAME = teleport-${V} DISTFILES = teleport-vendored-${V}.tar.gz \ @@ -16,7 +17,7 @@ MAINTAINER = Stefan Sperling <stsp@openbsd.org> # AGPLv3 / Apache 2.0 PERMIT_PACKAGE = Yes -WANTLIB = c pthread +WANTLIB = c crypto fido2 pthread # Vendored distfile: # ftp -o teleport-${V}.tar.gz https://github.com/gravitational/teleport/archive/refs/tags/v${V}.tar.gz @@ -41,7 +42,7 @@ SITES = https://liam.stsp.name/files/distfiles/ MODULES = lang/go -MAKE_ENV = FIDO2=no \ +MAKE_ENV = FIDO2=dynamic \ RDPCLIENT_SKIP_BUILD=1 \ WEBASSETS_SKIP_BUILD=1 \ BUILDFLAGS="${MODGO_FLAGS}" blob - 855994ded6b02eb8262dec4f583d6e98bed1ac06 blob + 53a611da3809af218a9c4bdfb6126f8e44004045 --- net/teleport/pkg/README +++ net/teleport/pkg/README @@ -14,7 +14,6 @@ A quick introduction to Teleport Community Edition is Keep in mind that the OpenBSD port of ${PKGSTEM} currently lacks the following features: -- multi-factor authentication (FIDO2) - Windows Remote Desktop Protocol Usage
No comments:
Post a Comment