VDI-MFA from Proxmox - cloud-admin.pl

Today is the best day in this week so I will describe how to implement multi factor authentication to the Proxmox Virtual Server enviroment… I’m finally get it working… Multi-Factor authentication to remote server with spice client configuration.

First of all we need the computer/server with virtualization ability.

Next we must install Proxmox VE on this target machine.

To-Do List:

-> Login to the Proxmox VE with root privileges,

-> Create Virtual Machine using Create VM box with SPICE ( QXL ) display,

-> Install system on the target virtual machine using console view,

-> Create Role with only VM.Console privilege in the Proxmox -> Cluster -> Permissions,

-> Create User with VM.Console Role,

-> Next create TOTP via wizzard in the Proxmox -> Cluster -> Permissions -> Two Factor -> add TOTP, scan the qr code with Google Authenticator app because user will never login without code

-> Navigate to the VM machine that you created in second step,

-> Create user (created in fifth step) permission to access Virtual Machine ( VM -> Permissions -> add User Permission )

Now You have working VDI server with one virtual machine

Next thing is to connect to that virtual machine:

You can use this script to connect to virtual machine:

#!/bin/bash
set -e

# Set auth options
USERNAME='USERNAME_FOR_USER_CREATED_IN_5_STEP'
PASSWORD='PASSWORD_FOR_USER_CREATED_IN_5_STEP'
TOTP='$1'
# Set VM ID
VMID='VMID_OF_VIRTUAL_MACHINE_CREATED_IN_2_STEP'

# Set Node
# This must either be a DNS address or name of the node in the cluster
NODE='DNS_NAME_OF_THE_PROXMOX_SERVER_IN_THE_CLUSTER'

# Proxy equals node if node is a DNS address
# Otherwise, you need to set the IP address of the node here
PROXY="$NODE"

#The rest of the script from Proxmox
NODE="${NODE%%\.*}"
COOKIE="$(curl -f -s -S -k --data-urlencode "username=$USERNAME" --data-urlencode "password=$PASSWORD" "https://$PROXY:8006/api2/json/access/ticket"|jq -r '.data.ticket')"
DATA="$(curl -f -s -S -k --data-urlencode "username=$USERNAME" --data-urlencode "password=totp:$1" --data-urlencode "tfa-challenge=$COOKIE" "https://$PROXY:8006/api2/json/access/ticket")" 
echo "AUTH OK"

TICKET="${DATA//\"/}"
TICKET="${TICKET##*ticket:}"
TICKET="${TICKET%%,*}"
TICKET="${TICKET%%\}*}"

CSRF="${DATA//\"/}"
CSRF="${CSRF##*CSRFPreventionToken:}"
CSRF="${CSRF%%,*}"
CSRF="${CSRF%%\}*}"

curl -f -s -S -k -b "PVEAuthCookie=$TICKET" -H "CSRFPreventionToken: $CSRF" "https://$PROXY:8006/api2/spiceconfig/nodes/$NODE/qemu/$VMID/spiceproxy" -d "proxy=$PROXY" > spiceproxy

#Launch remote-viewer with spiceproxy file, in kiosk mode, quit on disconnect
#The run loop will get a new ticket and launch us again if we disconnect
exec remote-viewer spiceproxy

TO use this script you must modify USERAME,PASSWORD,VMID and NODE variables.

Next will be give execution permission to the created connection script:

chmod +x NAME_OF_SCRIPT

to connect to the VDI use following scheme:

./NAME_OF_SCRIPT CODE_FROM_GOOGLE_AUTHENTICATOR

Thats all… have a nice day.

Leave a Reply Cancel reply