systemctl daemon-reload<\/code><\/pre>\ncreate the user file<\/h4>\n
Next, we create a rudimentary User database yaml file with randomly generated passwords (the users can reset them with the \u201cforgot password\u201d link):<\/p>\n
echo<\/span> \"users:\"<\/span> ><\/span> \/etc\/authelia\/.users\/users_database.yml\u2029for <\/span>user in <\/span>bob alice dave frank ;<\/span> do<\/span>\u2029 <\/span>randompassword<\/span>=<\/span>$(<\/span>tr<\/span> -cd<\/span> '[:alnum:]'<\/span> < \/dev\/urandom | fold<\/span> -w<\/span> \"64\"<\/span> | head<\/span> -n<\/span> 1 | tr<\/span> -d<\/span> '\\n'<\/span>)<\/span>\u2029 encryptedpwd<\/span>=<\/span>$(<\/span>authelia hash-password --no-confirm<\/span> --<\/span> $randompassword<\/span> | cut<\/span> -d<\/span> \" \"<\/span> -f<\/span> 2)<\/span>\u2029 (<\/span> \u2029 echo<\/span> \" <\/span>${<\/span>user<\/span>}<\/span>:\"<\/span> \u2029 echo<\/span> ' displayname: \"First Last\"'<\/span>\u2029 echo<\/span> \" password: <\/span>$encryptedpwd<\/span>\"<\/span>\u2029 echo<\/span> \" email: <\/span>${<\/span>user<\/span>}<\/span>@yourdomain.com\"<\/span>\u2029 )<\/span> >><\/span> \/etc\/authelia\/.users\/users_database.yml<\/code>\u2029done<\/code><\/span>\u2029chmod <\/span>600 -R<\/span> \/etc\/authelia\/.users\/<\/code><\/pre>\ncreate the configuration.yml<\/h3>\n
Now we need to create a configuration file for authelia in \/etc\/authelia\/configuration.yml<\/code><\/p>\ncd<\/span> \/etc\/authelia<\/code>\u2029# save the old version of the file<\/code><\/span>\u2029if<\/span> [<\/span> -e<\/span> configuration.yml ]<\/span> ;<\/span> then<\/span>\u2029 <\/span>mv <\/span>configuration.yml configuration.yml.old<\/code>\u2029fi<\/code><\/span>\u2029# Now let's use Marc's version of Florian's Template File for the new config:<\/code><\/span>\u2029wget https:\/\/raw.githubusercontent.com\/onemarcfifty\/cheat-sheets\/main\/templates\/authelia\/configuration.yml\u2029chmod <\/span>600 configuration.yml<\/code><\/pre>\nStarting Authelia for the first time<\/h3>\n
There we go – authelia should be able to run already – if you do<\/p>\n
systemctl start authelia\u2029systemctl status authelia<\/code><\/pre>\nyou should see all green and be able to browse to http:\/\/localhost:9091<\/code> and see the authelia login prompt. Even though this is an important checkpoint (in the sense that we can see if authelia will run at all), we can\u2019t really use it yet. We need to take care of the following things:<\/p>\n\n- All domain names still point to example.com<\/li>\n
- The start up checks are disabled (especially checking for an e-mail Server)<\/li>\n<\/ol>\n
You will need a real e-Mail account \/ Server for Authelia to work correctly<\/strong> (Users need this to reset their password and to register 2FA devices)<\/p>\n\n- We have no TLS enabled<\/li>\n
- The policies need to be adapted<\/li>\n
- We need to increase the security and hide Authelia behind an NGINX Server<\/li>\n
- We need to harden the server<\/li>\n
- The user accounts are not real<\/li>\n<\/ol>\n
Adapting and securing authelia<\/h3>\n
to get a first idea of how much you need to change do grep example.com \/etc\/authelia\/configuration.yml<\/code> – that shows you all the lines where we specified the example.com domain.<\/p>\nEnabling the startup checks and change the domain names<\/h3>\n
The first one is the mail server. We need to edit the configuration.yml and give it the login data of a real mail server. This is done in the notifier<\/code> section of the config:<\/p>\nnotifier<\/span>:<\/span> \u2029 disable_startup_check<\/span>:<\/span> true<\/span>\u2029 smtp<\/span>:<\/span>\u2029 host<\/span>:<\/span> smtp.domain.com<\/span>\u2029 port<\/span>:<\/span> 465<\/span>\u2029 timeout<\/span>:<\/span> 5s<\/span>\u2029 username<\/span>:<\/span> noreply@auth.example.com<\/span>\u2029 sender<\/span>:<\/span> \"<\/span>Authentication<\/span> Service<\/span> <noreply@auth.example.com>\"<\/span>\u2029 subject<\/span>:<\/span> \"<\/span>{title}\"<\/span>\u2029 startup_check_address<\/span>:<\/span> noreply@auth.example.com<\/span><\/code><\/pre>\nChange all the settings to reflect a real mailbox that you control. Once you have done that, change the disable_startup_check: true<\/code> to disable_startup_check: false<\/code> and restart authelia:<\/p>\n\n
\n
systemctl restart authelia\u2029systemctl status authelia\u2029<\/code><\/pre>\n<\/div>\n<\/div>\n