Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 38 Next »

This document is in progress!

Summary

Passwords alone are no longer sufficient. To address this RIT has moved to Duo's MFA service for the majority of services. Admins and developers, however, have access to large amounts of information and have privileges on servers that can cause significant damage if their credentials are compromised. Because of those risks, stronger and more efficient MFA is required for certain accounts. To achieve this, ITS has historically used OATH (One Time Passwords) for SSH and sudo access on linux servers and recently started requiring either certificates + PIN or Duo for Windows logons.

OATH is deprecated and all OATH users are being moved to certificate-based authentication. ITS is issuing YubKeys that will be used to securely generate and store these certificates.

Requirements

Considerations

  • These docs are not the only way to accomplish the goal nor are YubiKeys required however the further you deviate from these docs the less knowledge ITS has to assist you.
  • The OS requires a lock on the YubiKey. If using multiple computers, even if a computer is virtual, multiple devices will be needed – one device per instance of the OS.
    • A YubiKey can be passed through RDP session(s) (Windows only)
  • Each device will have a different certificate. A certificate can, however, be used for access to both Linux and Windows servers.
  • Expert mode: While a YubiKey (i.e. a Yubico device) is not required the docs and process are built assuming a Yubikey is being used. Any device that can securely generate and store keys in a way that can be cryptographically verified will work.


Process Overview

  1. Initialize/Configure Yubikey
  2. Which Certificate Is Right For Me?
  3. Submit certificate for verification
  4. Configure clients to use certificates

Initialize/Configure Yubikey


 First steps with Yubikey

Unable to render {include} The included page could not be found.

Which Certificate Is Right For Me?

The following is a suggested determination of which certificate process to follow. If you feel comfortable deviating, feel free to do so.

If you primarily log into and work mainly with Windows machines, please follow the process below:

 Windows CA issued Certificate

Unable to render {include} The included page could not be found.


Else, follow this process below:

 Self-Signed Certificate

Unable to render {include} The included page could not be found.

Submit certificate for verification


 Yubikey Attestation and Submission (Work in Progress)

Unable to render {include} The included page could not be found.

Configure clients to use certificates

Yubikey Windows SSH Client Configuration


Yubikey Mac SSH Client Configuration


Yubikey Linux SSH Client Configuration

Other uses of Yubikeys


  • No labels