Computer Documentation Wiki

User Tools

Site Tools

Trace: • linux • connect • citrix
lion:2fa:introduction

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
lion:2fa:introduction [2021/09/13 07:23] – [Where] deullion:2fa:introduction [2021/09/22 11:25] (current) – [How] deul
Line 6: Line 6:
 We need to put a stop to that, and the only way to do that is to introduce a second step in identifying that you are the rightful owner of the account credentials. This second step is provided throught the Two-Factor Authentication (2FA) mechanism. For this second verification, you need a physical device, for instance a smart phone or personal computer. We need to put a stop to that, and the only way to do that is to introduce a second step in identifying that you are the rightful owner of the account credentials. This second step is provided throught the Two-Factor Authentication (2FA) mechanism. For this second verification, you need a physical device, for instance a smart phone or personal computer.
  
 +Although we have done our best to make use of the university system, they were unwilling to cooperate. Therefore we had to buy and implement our own commercial multi factor aruthentication system, independent of the central system. Unfortunately you will have to deal with both systems separately.
 ====Where==== ====Where====
 In principle for every service where you need to identify yourself, 2FA is needed. In the beginning we will restrict 2FA to two major services: Web pages and ssh remote login. At a later stage 2FA will be implemented for other services as well. You will be informed well in advance. In principle for every service where you need to identify yourself, 2FA is needed. In the beginning we will restrict 2FA to two major services: Web pages and ssh remote login. At a later stage 2FA will be implemented for other services as well. You will be informed well in advance.
 ===WEB Pages & 2FA === ===WEB Pages & 2FA ===
 For all Web pages where you need to login, we will enforce 2FA. This also, and in particular, includes webmail. The Observatory WEBsite has many pages shielded by authentication and each page will be individually added to the 2FA facility. For all Web pages where you need to login, we will enforce 2FA. This also, and in particular, includes webmail. The Observatory WEBsite has many pages shielded by authentication and each page will be individually added to the 2FA facility.
 +===Console and remote desktop login & 2fa===
 +Each Windows desktop will be equipped with Multi factor Authentication, so you first need to login using your PHYSICS account credentials and then you will be asked to provide the second form of authentication through a window asking you a Push approval, six digit passcode or Yubikey secret. Once that is verified you get access to your desktops Windows environment. This process works similar when you sit in front of your desktop of when you access your desktop from remote (Tunnelier of VPN). 
 ===ssh remote login & 2FA=== ===ssh remote login & 2FA===
 One other major way to gain access to our resources and data is through the ssh protocol. So this means that using ''%%ssh%%'' to login from remote to the Observatory ssh gateway or to the local desktops or servers, you will be confronted with a second prompt to enter credentials. How this works is explained later on this page. In fact, 2FA is imposed on the ssh protocol, so ''%%scp%%'', ''%%sftp%%'', remote ''%%rsync%%'' and even tunnelier (Win) will also be affected. One other major way to gain access to our resources and data is through the ssh protocol. So this means that using ''%%ssh%%'' to login from remote to the Observatory ssh gateway or to the local desktops or servers, you will be confronted with a second prompt to enter credentials. How this works is explained later on this page. In fact, 2FA is imposed on the ssh protocol, so ''%%scp%%'', ''%%sftp%%'', remote ''%%rsync%%'' and even tunnelier (Win) will also be affected.
Line 15: Line 18:
 For the purpose of accessing your home adn data share you used to access the physics ssh3 server. But, due to incompatibilities between the 2FA and automatic mounting of shares that way of accessing your shares will not be available anymore. The VPN facility replaces this functionality and allows your personal computer device to become part of the Physics network. Once that is the case you can mount your personal home and data disks in the usual way through the Windows File Explorer (or samba mount). For the purpose of accessing your home adn data share you used to access the physics ssh3 server. But, due to incompatibilities between the 2FA and automatic mounting of shares that way of accessing your shares will not be available anymore. The VPN facility replaces this functionality and allows your personal computer device to become part of the Physics network. Once that is the case you can mount your personal home and data disks in the usual way through the Windows File Explorer (or samba mount).
 ====How==== ====How====
-The 2FA protocol that we have implemented is based on the Time-based One Time Password (TOTP) mechanism and we are using RedHat developed tools to implement this. TOTP means that for a limited amount of time you get a passcode, which you have to provide to the authentication program as a second 'password' to gain access to the resource. Initially, at first use of 2FA, you have been given a private secret key and have stored that on your mobile device. Then, for each login, you use that mobile device to generate (time limited) passcodes. This passcode you present (type in) to the login procedure and after verification it gives you access to the restricted resource. Details on this process are described below.+The 2FA protocol that we have implemented is based on the [[https://duo.com|DUO]] (a Cisco product) software suite. Using DUO we are implementing two-factor authentication on web server, console login, remote access to your desktop, VPN and ssh.
lion/2fa/introduction.1631517805.txt.gz · Last modified: by deul

Page Tools

Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
CC Attribution-Share Alike 4.0 International Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki