starred/the-bastion

Fork 0

mirror of https://github.com/ovh/the-bastion.git synced 2026-05-09 08:25:27 +02:00

[GH-ISSUE #33] PIV verification status communicated to remote realms #12

New issue

Closed

opened 2026-05-07 00:17:21 +02:00 by BreizhHardware · 6 comments

BreizhHardware commented

2026-05-07 00:17:21 +02:00

Owner

Originally created by @vmalguy on GitHub (Nov 5, 2020).
Original GitHub issue: https://github.com/ovh/the-bastion/issues/33

In a multi-realm deployment infra, remote realm should send PIV informations to the local bastion.
This could be use to enforce local Multi-Factor Authentication policies even for realm users.

Originally created by @vmalguy on GitHub (Nov 5, 2020). Original GitHub issue: https://github.com/ovh/the-bastion/issues/33 In a multi-realm deployment infra, remote realm should send [PIV informations](https://developers.yubico.com/yubico-piv-tool/YubiKey_PIV_introduction.html) to the local bastion. This could be use to enforce local Multi-Factor Authentication policies even for realm users.

BreizhHardware

2026-05-07 00:17:21 +02:00

closed this issue
added the
feature
label

BreizhHardware commented

2026-05-07 00:17:22 +02:00

Author

Owner

@Alkorin commented on GitHub (Nov 5, 2020):

PIV doesn't mean MFA. It only proves that the private key is stored in a secure physical device.

Do you need MFA aswell ?

@Alkorin commented on GitHub (Nov 5, 2020): PIV doesn't mean MFA. It only proves that the private key is stored in a secure physical device. Do you need MFA aswell ?

BreizhHardware commented

2026-05-07 00:17:22 +02:00

Author

Owner

@speed47 commented on GitHub (Nov 5, 2020):

Interesting use case. I think the remote bastion can also pass some more information to the local one, such as:

Was MFA enabled for this user?
Is it a PIV-enforced user ?

Then on the local bastion, you might be able to specify some policies that will be enforced, something along the lines of:

realmModify --realm eu --piv-policy enforce

... which would deny any remote user not having PIV enforced on his local bastion

@speed47 commented on GitHub (Nov 5, 2020): Interesting use case. I think the remote bastion can also pass some more information to the local one, such as: - Was MFA enabled for this user? - Is it a PIV-enforced user ? Then on the local bastion, you might be able to specify some policies that will be enforced, something along the lines of: ``` realmModify --realm eu --piv-policy enforce ``` ... which would deny any remote user not having PIV enforced on his local bastion

BreizhHardware commented

2026-05-07 00:17:23 +02:00

Author

Owner

@vmalguy commented on GitHub (Nov 5, 2020):

PIV doesn't mean MFA. It only proves that the private key is stored in a secure physical device.

Do you need MFA aswell ?

anything that could help enforce access policies

Interesting use case. I think the remote bastion can also pass some more information to the local one, such as:

Was MFA enabled for this user?

Is it a PIV-enforced user ?

Then on the local bastion, you might be able to specify some policies that will be enforced, something along the lines of:
realmModify --realm eu --piv-policy enforce
... which would deny any remote user not having PIV enforced on his local bastion

When it come to PIV, I like some flexibility.
Per realm is good but how about also per group or host or user ?

@vmalguy commented on GitHub (Nov 5, 2020): > PIV doesn't mean MFA. It only proves that the private key is stored in a secure physical device. > > Do you need MFA aswell ? anything that could help enforce access policies > Interesting use case. I think the remote bastion can also pass some more information to the local one, such as: > > * Was MFA enabled for this user? > * Is it a PIV-enforced user ? > > Then on the local bastion, you might be able to specify some policies that will be enforced, something along the lines of: > > ``` > realmModify --realm eu --piv-policy enforce > ``` > > ... which would deny any remote user not having PIV enforced on his local bastion When it come to PIV, I like some flexibility. Per realm is good but how about also per group or host or user ?

BreizhHardware commented

2026-05-07 00:17:23 +02:00

Author

Owner

@Alkorin commented on GitHub (Nov 5, 2020):

Per realm is good but how about also per group or host or user ?

The main goal of realm is to not have the notion of user in the local bastion. Authentication is delegated to the distant bastion.
But we could have this check on groups so that a distant user can't use the group if he didn't used its PIV key to connect to the distant bastion.

@Alkorin commented on GitHub (Nov 5, 2020): > Per realm is good but how about also per group or host or user ? The main goal of realm is to not have the notion of user in the local bastion. Authentication is delegated to the distant bastion. But we could have this check on groups so that a distant user can't use the group if he didn't used its PIV key to connect to the distant bastion.

BreizhHardware commented

2026-05-07 00:17:24 +02:00

Author

Owner

@speed47 commented on GitHub (Nov 5, 2020):

Could be done too, even if it would be a bit more complex:

realm-wide setting:

realmModify --realm eu --piv-policy none|enforce

group-wide setting:

groupModify --group blah --piv-policy none|enforce

per-host: not really doable, because nobody has the authority over a given host, from the point of view of the bastion: a host can be in 2 distinct groups for that matter, with 2 distinct owners. Or a group can be 0.0.0.0/0 and have all the possible hosts in it.

But then, you might also want to grant an account the right to bypass the realm-wide policy, because this account might be a robot and doesn't have the required hand to click on his PIV key...

This is what has been done for password MFA and TOTP MFA:

accountModify --account joe --mfa-totp-required yes|no|bypass
accountModify --account joe --mfa-password-required yes|no|bypass

@speed47 commented on GitHub (Nov 5, 2020): Could be done too, even if it would be a bit more complex: realm-wide setting: ``` realmModify --realm eu --piv-policy none|enforce ``` group-wide setting: ``` groupModify --group blah --piv-policy none|enforce ``` per-host: not really doable, because nobody has the authority over a given host, from the point of view of the bastion: a host can be in 2 distinct groups for that matter, with 2 distinct owners. Or a group can be 0.0.0.0/0 and have all the possible hosts in it. But then, you might also want to grant an account the right to bypass the realm-wide policy, because this account might be a robot and doesn't have the required hand to click on his PIV key... This is what has been done for password MFA and TOTP MFA: ``` accountModify --account joe --mfa-totp-required yes|no|bypass accountModify --account joe --mfa-password-required yes|no|bypass ```

BreizhHardware commented

2026-05-07 00:17:24 +02:00

Author

Owner

@speed47 commented on GitHub (Nov 5, 2020):

In any case @Alkorin we'll need yubico-piv-checker ;)

@speed47 commented on GitHub (Nov 5, 2020): In any case @Alkorin we'll need `yubico-piv-checker` ;)