Versions Compared

Old Version 27

changes.mady.by.user Tony Lam

Saved on

compared with

New Version Current

changes.mady.by.user Tony Lam

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Table of Content Zone

Table of Contents
maxLevel3

Summary

Passwords alone are no longer sufficient. To address this RIT has moved to Duo's MFA service for the majority of services. Admins and developers, however, have access to large amounts of information and have privileges on servers that can cause significant damage if their credentials are compromised. Because of those risks, stronger and more efficient MFA is required for certain accounts. To achieve this, ITS has historically used OATH (One Time Passwords) for SSH and sudo access on linux Linux servers and recently started requiring either certificates + PIN or Duo for Windows logons.

OATH is deprecated and all OATH users are being moved to certificate-based authentication. ITS is issuing YubKeys YubiKeys that will be used to securely generate and store these certificates.

Requirements

Requesting a YubiKey

Considerations

  • These docs are not the only way to accomplish the goal nor are YubiKeys required the only way to accomplish password-less authentication however the further you deviate from these docs the less knowledge ITS has to assist you.
  • The OS requires a lock on the YubiKey. If using multiple computers, even if a computer is virtual, multiple devices will be needed – one device per instance of the OS.
    • A YubiKey can be passed through RDP session(s) (Windows only)
  • Each device will have a different certificate. A certificate can, however, be used for access to both Linux and Windows servers.
  • Expert mode: While a YubiKey (i.e. a Yubico device) is not required, the docs and process are built assuming a Yubikey YubiKey is being used. Any device that can securely generate and store keys in a way that can be cryptographically verified will work.


Process Overview

...

I. Certificate Enrollment
II. Submit certificate for verification
III. Configure clients to use certificates

...

IV. Next steps

I. Certificate Enrollment


Yubikey New Setup/Initialization/Re-initialization (WIP)
Expand
Include Page
Yubikey New Setup/Initialization/Re-initialization (WIP)
titleCertificate Enrollment

Include Page
I. YubiKey Certificate Enrollment
I. YubiKey Certificate Enrollment

II. Submit certificate for verification


Run the Yubikey Manager application and insert your key
Click on Applications and then click on PIV
Image Removed

  • Change PIN if Yubikey is fresh out of the box or it's been defaulted

    • Expand
    titleFirst steps with Yubikey
    Note

    skip to (Which Certificate Is Right For Me?) if Yubikey is already initialized

    1. Click on Configure PINs
      Image Removed
    2. Click Change PIN and then check Use default (if it is default).
      Choose a PIN between 6 - 8 characters.
      Finish with changing PIN by clicking on Change PIN
      Image Removed
    3. Click on Change PUK and then check Use default (if it is default).
      Choose a PUK between 6 - 8 characters.
      Finish with changing PUK by clicking on Change PUK
      Image Removed
    4. Click on Change Management Key and then check Use default (if it is default).
      Click on Generate a few times to randomly create a new management key.
      Choose AES256 as Algorithm.
      Finish with changing the key by clicking on Finish
      Image Removed

    Which Certificate Is Right For Me?

    Generate certificate

    Submit certificate for verification

    Configure clients to use certificates

    ...

    YubiKey Attestation and Submission

    Include Page
    II. YubiKey Attestation
    II. YubiKey Attestation

    III. Configure clients to use certificates

    Windows: III. YubiKey Windows SSH Client Configuration


    Mac: III. YubiKey Mac SSH Client Configuration


    Linux: III. YubiKey Linux SSH Client Configuration


    IV. Next steps

    YubiKey Duo Setup - start.rit.edu/Duo

    Other uses for certificates

    Other uses of YubiKeys

    ==OLD==

    Generating and distributing(?) certificates

    Windows

    Enroll certificates using the following Guide:

    Configure Windows to automatically load certificates from the Yubikey for SSH use:

    macOS

    Note

    If you plan on using your certificate with Windows and linux servers, you must generate the certificate using Windows. Once the certificate has been generated on Windows it can be used with any OS and with Windows and linux servers.

    Linux

    Note

    If you plan on using your certificate with Windows and linux servers, you must generate the certificate using Windows. Once the certificate has been generated on Windows it can be used with any OS and with Windows and linux servers.

    ...

    Troubleshooting