hi everyone and welcome back to another ibra corp video
thanks for tuning in with us before we get started just wanted to say a quick
thank you to everyone who's subscribed to the channel and liked our videos if you enjoy what
we're doing here please consider liking and subscribing it really helps us out
we really appreciate your time and thank you for watching as part of our ammo let's get stuck into
it
so today we're talking about orthelia so what is orthelia orthelia is a application used for
authentication and authorization you can lay on top of a web network or web addresses so you can
protect those endpoints using both two-factor authentication and some other methods as well
so there's an open source full-featured authentication server and it's available
on github if you're a user of unraid i actually created the template that lives on the unraid
app store so if you come to the app store and you type in authelia
so this is my actual repository over here and i published it out so people can use it
so this should make it a lot easier for you i also wrote a lot of instructions on my own github page
here to get it working for everyone so the purpose of today's video is we're basically
going to go through this documentation which i'll leave in the description below and we're
also going to be setting it up for use with engines proxy manager so if you haven't used
either before this will be the video today i'm showing you how to get that going so
let's scroll right up to the top and we'll leave that aside i'll put it over to the other screen
like i said description uh link will be in the description so we can leave it there for you
so the first thing you want to do is go to the app store or if you're
using docker you know follow the docker instructions to get it down off the github
and this is what you're going to see when you first start it up or when you first go to install
it there's really not many parameters that need to be mapped i've got the ip the port set to 9091
the app data folder as well as permission codes that go in there as well but it's not
set up yet with orthelia there is a little bit of configuration involved and i'll show you
what that looks like so it's over here and it's ready but let's say we just leave that for now
reading the instructions we've got there are some files that you need to modify
to get working for you you also need some dependencies installed and and working as well
you can install orthelia without some of these dependencies however i strongly recommend that
you follow this guide exactly as it's written out because installing the light version of ophelia it
may suit you if you're at home but later on if you decide to scale it up for any reason
it's not going to be possible so you might as well just start off with everything that you need it
also adds a little bit of redundancy to your setup because if you lose readers for example you lose
your sql database for example those things you know you're not going to worry about it too much
later on down the track you just have it set up and ready to go
so in the in the github page you'll find there are several files the authelia portal file
is the configuration information that you'll need to put in the engine's proxy manager
same with this one here but this will be on the endpoints that you want to protect
this is the for orthelia itself which you need to have and the user's database if you are not using
ldap so you can use ldap but you can also use a user database file if you don't want to use ldap
so we'll come down here you can see where we're at and we'll start with
basically the first step read this so you need to read this container
again not difficult to to really do i'll just move this over here
if you have docker and you have unraid you have the app store you can just install readers
straight away and um that's it once you install it it's pretty much running so as for this you
can basically keep moving on mysql database if you haven't installed mysql before or mariadb
same principle applies go to the app store click install and then i've got the instructions right
here explaining how to get the database up and running so make sure you follow those instructions
you want to follow the code and you need to replace anything with a placeholder so in my
in the top here in the references section
i explained that i've put placeholders in so so that makes it easy for you to find and replace
them so just make sure you replace those those placeholders as you go along i can't stress
enough how confusing it can be if you skipping steps so make sure you just take your time
and just follow the steps as we go along so then we have authelia so once you've got these two
sort of dependencies set up we can start working on orthelia
install the application in the app data folder that you have it in
it will create a configuration yml if it does not in the github we have that there as well
so don't stress you can just use that there there's no problem
so once you've got the configuration file it's
time to now set it up so we'll just move that over to the side here
so once you first open it up you don't really need to modify any of these settings
you've got your read your right and your path underneath you'll have your jwt secrets now
there's a website here argon2.online which allows you to create secrets really allows
you to create really high encryption passwords and i recommend that for this because i've changed all
the ones in here but you'll need to make sure that they're secure and that they're private
and most of them you won't need to remember these you use for just sessions for example
anything commented out you can use if you are using totp or you want to use that
uh the one-time pin then you can uncomment it as i've got here i don't use duo you can use it
um if you do just make sure you uncomment and edit all the information there as well
but that's not covered in my guide
an authentication backend so with ophelia you have two options you can use a user file which is in
the github repository as well or you can use ldap now originally when i set up orthelia i did use
the user file however nowadays i actually use free ipa as an ldap back end i just think it's
more secure and also i think it's better to have a central sort of point where everything connects to
so these this is what it looks like when you're setting up
an ldap again it's all in the github page scroll down a little bit further
i'm just scrolling nice and slow in case you decide to pause the video
you can do that these are the filters that i use when using free ipa so just keep that in mind
if you're using something else like um windows active directory those filters will look different
a lot of these settings will probably look different so let's keep going a little bit further
here's the file back end so if you're not going to use ldap you need to comment out
all the ldap stuff and then uncomment from this point on or file back end
and here's the acl so all the access controls so this is where you tell orthelia basically
the default policy i want you to deny everything so if i don't know if if ophelia doesn't know who
you are deny then you can say okay for this particular address i want you to
allow anyone in the group admins which is reading that from ldap mind you
or from your file a user file
put a one factor policy on it
you can also supply two factor deny or bypass
come down a little further you've then got your session your session secrets expiration inactivity
how long to remember for example the domain that you want to protect so make sure you fix that up
the details of your readers container so it's really important that you put your readers
information in there which you can just get right from here as you can see
come down a little further so this is more about the
control of the users and what happens when they try too many times for example
your database information so make sure you fill out what we followed
what you've set up in the above step with your database this is where that would go
and you have some other settings there for smtp and emails you need to make sure that
you get this working because if you don't it's not actually going to be able to send out any emails
which is not really going to help you so i highly recommend that you set that up make sure you put
your passwords all that sort of stuff in there because if a user wants to reset their password
that's where they're going to get it from now i know i'm just sort of skimming over this but
that's really all it is the most time you're going to spend i i would say is with the access control
possibly the duo uh if you're setting up duo and ldap if you're using ldap
that's where most of your time will be spent but the rest of it's pretty easy
then you've got your injinx proxy manager part of things so once you've set up authealia and
you're happy with it and you can tell that it's working so let's start this up
so we've started up the container and it's loaded correctly we can tell it's loaded
correctly because there's no errors or it hasn't stopped you can also read the logs
and now we want to get it going so if you want to go just to the web ui here this is the local
address it's not really going to do anything because it's kind of not the point so the
next step you have to follow is to set up your injinx proxy manager so if we head to our proxy
and in my case i have a dns entry called identity.ibrachor
you can always go back to our last video with engines proxy manager to get a bit of a
better understanding about dns and using engine's proxy manager
in here you haven't got too much but you do have a custom location a custom engine's config here
now this is available again on our github at the top so if you scroll to the top you've got your
configuration.yml or thelia portal now it's explained in the instructions below but
ophelia portal is what goes in here so you need to make sure you update that to your
own details if it's your own ip address and port whatever you've set up
and then you can close that so if we go to that now and just check that
that works excellent we've typed in our username and password and we click sign in
we're authenticated now if you wanted to protect an endpoint by using that
this is what you would put in to there so let's copy this for example
so let's copy this for example and we'll come back to engineer's proxy manager so let's say
we're ready to protect an endpoint now and in this case we're going to protect our status page
in engine's proxy manager we'll go to edit advanced
and we will copy the endpoint conf information from the github page
scroll to the top and we just make sure we read it to make sure everything is is correct
so the server address is correct the port that looks correct let's go down a little further
we need to change the container name here
and in this case for us it's actually patient
so we'll change that to k [ __ ] let's go down a little further
we're going to make sure our url is correct for orthelia
and remember these have placeholders in them so you'll be able to see them in
capitals just make sure that you change them then we hit on status and we are forbidden
so you may be wondering why we're getting a 403 forbidden the reason why is because
earlier we said the default policy is to deny okay as you can see in the rules we
don't have an explicit setting for this domain so what we're going to do is set one up for it
so the safest bit is to always just copy it from above
try and remove any spaces and in here we'll say status.ibracorp.io i want the same users to be
able to access it so that's fine and also i want one factor authentication so that's fine as well
we'll hit save then you need to make sure you come back and restart your orthelia container
so that the new settings take effect so we'll just restart that give it a second
there you go now if we go to incognito just to make sure it's always a good idea to go
to incognito just to double check so this is what the workflow will now
look like so we've hit the authentication portal and now it's asking us to log in
we've said that it's a protected endpoint so that's fine
hit sign in it will then redirect you to the original site that you went to
and we're authenticated now here's some other
extra little feature that you might not know about orthelia that i really like
if you go to the portal address that you've set up you can see that we're logged in now
because i'm an administrator my name won't come up but you can set it to actually show the name
log out
and you can stay on this actual portal now it will actually allow you to reset a password
right here even if it's an ldap password which is quite cool so if you didn't want to use a
different solution you could use that in our case we actually have set up pwm as our portal solution
to manage identity but you can use that as well so you just follow the same rule and apply that to
other domains and you can have a protected setup any way you like so that's orthelia for you i hope
that was a quick explanation because i've already written instructions i didn't want to sort of
repeat myself but to help people see it visually i think is really important and i know that when
i was setting it up it took me approximately two months to get this working because there was just
such little documentation um in terms of setting it up with unraid that i had to learn it myself
so i i just wanted to share that with everyone to save you the time that it took me so i hope
that was helpful and if you need more information please let me know if you want to know more just
ask in the comments and don't forget to like and subscribe it really helps a lot thank you very
much
hmm you