LinOTP Installation Guide

• 1. Supported Operating Systems
  • 1.1. Supported Database systems
• 2. Checklist
  • 2.1. Decide which distribution you want to use
  • 2.2. Decide which token database you want to use
  • 2.3. SSL certificate
  • 2.4. LinOTP Admin
  • 2.5. User databases
  • 2.6. User tokens
  • 2.7. Authentication
  • 2.8. Location in your network
• 3. Server installation
  • 3.1. LinOTP Virtual Appliance installation
  • 3.2. Installing from APT repositories
    • 3.2.1. Debian
    • 3.2.2. Ubuntu 12.04 / 14.04
  • 3.3. Installing on RHEL or CentOS v7 (64bit)
  • 3.4. LinOTP Server Installation – the tar.gz, virtualenv and pip way
    • 3.4.1. Setup token database
    • 3.4.2. LinOTP and the Apache web server
    • 3.4.3. Further changes for RedHat and CentOS 6
    • 3.4.4. Testing LinOTP Server installation
    • 3.4.5. Creating self signed SSL certificate
  • 3.5. LinOTP on Univention Corporate Server UCS
    • 3.5.1. App Center
    • 3.5.2. Join Scripts
  • 3.6. Configuration background information
    • 3.6.1. LinOTP Server configuration
• 4. Installing Authentication Modules
  • 4.1. Enabling PAM authentication with pam_linotp
    • 4.1.1. Configure pam_linotp
  • 4.2. Enabling RADIUS authentication with rlm_linotp2
    • 4.2.1. Configuring rlm_linotp2
    • 4.2.2. Activating rlm_linotp2
    • 4.2.3. Using rlm_linotp2 and SSL
    • 4.2.4. Testing rlm_linotp2
    • 4.2.5. Fail-over configuration for RADIUS
  • 4.3. Enabling RADIUS authentication with Radiator
  • 4.4. Enabling RADIUS authentication with rlm_perl
    • 4.4.1. Configuring radius_linotp.pm
    • 4.4.2. Testing rlm_perl
  • 4.5. Enable SAML Identify Provider
• 5. Customization
  • 5.1. Templates
  • 5.2. Style Sheets
  • 5.3. Changing the Logo
• 6. Database connection
  • 6.1. Running LinOTP with DB2 on RedHat
    • 6.1.1. Overview
    • 6.1.2. Installation
    • 6.1.3. Configuration
  • 6.2. Running LinOTP with Oracle on RedHat
    • 6.2.1. Overview
    • 6.2.2. Installation
    • 6.2.3. Configuration
  • 6.3. Configure a redundant MySQL database with master-master-replication
    • 6.3.1. Introduction
    • 6.3.2. Replication user
    • 6.3.3. Configure replication
    • 6.3.4. Setup slaves
    • 6.3.5. Synching the machines
    • 6.3.6. Activate the Replication Mode in LinOTP
  • 6.4. Special parameters for database connections
    • 6.4.1. Pool recyle
    • 6.4.2. Implicit returning
• 7. Security Modules
  • 7.1. Defining Security Modules
  • 7.2. Defining SafeNet LunaSA
    • 7.2.1. Partition Password
  • 7.3. Setting up SafeNet LunaSA
    • 7.3.1. Requirements
    • 7.3.2. Network settings
    • 7.3.3. LunaSA server certificate
    • 7.3.4. Initialization of HSM
    • 7.3.5. Setting up HSM clients and assigning clients to HSM partitions
    • 7.3.6. Troubleshooting
  • 7.4. Create AES Keys
  • 7.5. Backup and restore with LunaSA
    • 7.5.1. Backup
    • 7.5.2. Restore
  • 7.6. Setting up HA and Load balancing for LunaSA
    • 7.6.1. Register LinOTP
    • 7.6.2. Creating HA group
    • 7.6.3. Monitoring
  • 7.7. Managing Passwords with LunaSA
    • 7.7.1. Changing admin Password
    • 7.7.2. Changing HSM PED Password
    • 7.7.3. Changing Partition Passwords
    • 7.7.4. Resetting Partition Passwords
• 8. Integration examples
  • 8.1. OTP Authentication with an Apache web server
    • 8.1.1. Download
    • 8.1.2. Compile
    • 8.1.3. Configuration
  • 8.2. Firewall integration
  • 8.3. Authentication with third party OTP solutions
    • 8.3.1. Configure FreeRADIUS LDAP
    • 8.3.2. Configure FreeRADIUS proxy
    • 8.3.3. Configure proxy decision
  • 8.4. Restrict access to certain devices to certain users
    • 8.4.1. Install LDAP FreeRADIUS module
    • 8.4.2. Adapt the configuration
    • 8.4.3. modules/ldap
    • 8.4.4. clients.conf
    • 8.4.5. policy.conf
    • 8.4.6. site-enabled/linotp
  • 8.5. Map certain RADIUS clients to specific LinOTP realms
    • 8.5.1. Example Data
    • 8.5.2. Configuration
    • 8.5.3. Define two client networks
    • 8.5.4. Define the mapping policy
    • 8.5.5. Add the shortname to the request
    • 8.5.6. Activate policy during authentication
  • 8.6. Authenticating RADIUS clients that pass the ntdomain
  • 8.7. LinOTP and MIT Kerberos
    • 8.7.1. Setting up OTP with Kerberos
    • 8.7.2. Setting up FAST
  • 8.8. Deny access for disabled users in Active Directory
  • 8.9. Use LDAPs in UserIdResolvers
• 9. Updates
  • 9.1. Updating from LinOTP 2.6.1.1 to LinOTP 2.7
    • 9.1.1. Updating a deb install
    • 9.1.2. Updating a pip install
    • 9.1.3. Changelog
  • 9.2. Updating from LinOTP 2.6.1 to LinOTP 2.6.1.1
    • 9.2.1. Updating a deb install
    • 9.2.2. Updating a pip install
    • 9.2.3. Changelog
  • 9.3. Updating from LinOTP 2.6.0.3 to LinOTP 2.6.1
    • 9.3.1. Updating a deb install
    • 9.3.2. Updating a pip install
    • 9.3.3. Changelog
  • 9.4. Updating from LinOTP 2.6 to LinOTP 2.6.0.3
    • 9.4.1. Updating a deb install
    • 9.4.2. Updating a pip install
    • 9.4.3. Changelog
  • 9.5. Updating from LinOTP 2.6 to LinOTP 2.6.0.1
    • 9.5.1. Updating a deb install
    • 9.5.2. Updating a pip install
    • 9.5.3. Changelog
  • 9.6. Updating from LinOTP 2.5.2 to LinOTP 2.6
    • 9.6.1. Updating a deb install
    • 9.6.2. Updating a pip install
    • 9.6.3. Changelog
  • 9.7. Updating from LinOTP 2.5.1 to LinOTP 2.5.2
    • 9.7.1. Updating a deb install
    • 9.7.2. Updating a pip install
    • 9.7.3. Changelog
  • 9.8. Updating from LinOTP 2.5.0 to LinOTP 2.5.1
    • 9.8.1. Updating a deb install
    • 9.8.2. Updating a pip install
    • 9.8.3. Changelog
  • 9.9. Updating from LinOTP 2.4.4 to LinOTP 2.5.0
    • 9.9.1. Updating a deb install
    • 9.9.2. Updating a pip install
    • 9.9.3. Changelog
• 10. Migrating from LinOTP 1.3 or LinOTP 1.0
• 11. Security advisories
  • 11.1. Locked Users
  • 11.2. UserIdResolver
• 12. Troubleshooting
  • 12.1. Connecting to userstores
  • 12.2. Distribution not Found: LinOTP2
  • 12.3. SQLAlchemy error
  • 12.4. Access denied for user root@localhost