This is my first post so please… Rip it apart if you want.
Yubikey. If you don’t know what it is or haven’t heard of it yet then now is a good time to check it out on yubi.co
Yubikey is a small device that supports multiple authentication protocols and in my personal opinion is the best way forward if you are tasked to implement multi factor authentication.
Picture the following scenario: you are a sysadmin and it is your job to protect the business, so you have state of the art firewall’s, top notch antivirus solution, VPNs and encrypted remote connection for endpoints… You looking after a number of Servers running in a virtual environment where you have a fair few version of windows servers as well as Linux, perhaps some Mac OSX servers, etc. There are some cloud accounts for business like salesforce, perhaps you have in house devs using Github… So your infrastructure spans right over the boundaries of your network and way deep into the cloud. Boundaries are blurred.
There isn’t a one for all solution ever, that fits all and is all perfect, this is one of the reasons you have ended up with mixed platforms in your environment (Windows, Linux, Android, iOS, Mac OS, BSD, etc…) didn’t you?
So back to the ‘task’: a ‘simple project’ your boss might says, who just heard the ‘2 form authentication’ expression and makes it an absolute must have, which by the way for this one time is a good decision. So you start looking at various vendors like RSA, Duo, etc… There are many out there and I am sure they do a good job, at a cost. A cost that you have no budget for so you need to be a bit more creative here. And you come across this thing called yubikey. Relatively cheap, one of cost for the hardware token plus your time and resources that you already have. And boy I like it! I haven’t got much of an experience to compare it with anything but I am not even sure if there is anything similar to this out there.
There are a number of guides on the internet on how to implement the yubikey on many platforms so I am not going to try to replicate one of them but instead give a basic principle of how I have implemented in a Windows Active Directory environment where a fair number of linux hosts (Centos,debian,ubuntu) coexists but the linux hosts are not integrated in AD (no AD authentication).
So the challenge I had initially is to get yubikey to work in the windows environment - and it is a bit complex since you require a PKI in place but there are some really good guides out there how to set one up in your environment. Once the PKI is in place the rest is simple - guides are on yubico’s website and at other places too on how to set up PIV (personal Identity verification) smart-card logon for your existing users.
Windows is easy as it all plays together nicely. But what to do with linux? Perhaps you only have a handful of users in the IT department who occasionally log in over ssh, but you need to have 2 form authentication. Firstly, if all the users log in sharing one user account with a password then it really is time for you to shake things up! So the goal is to have all users with their own account, who require remote access (ssh) to the linux hosts. This can be achieved with the aid of GPG, again I won’t detail the setup, just google ‘yubikey GPG ssh’. For instance you might have 5 hosts and 2 users (including you), this is simple since you can set all this up manually, wont take that long right? But what if you ended up having 15 or 20 or more hosts that you really need to just set up with two form authentication? Well, this is where puppet comes into play. Puppet allows you to do the distribution of the individual user accounts with private keys for authentication from a centralised server. This will allow you to do regular password changes too if you tend to keep old fashion accounts (without ssh access).
I have deliberately focused on ssh here and not PAM as the remote access method mostly will be through ssh to gain root level access. The ssh configuration is simple to change and you can have 3 form authentication with gpg where the gpg pin is the first form, the certificate is the second and the user password is the 3rd.
And why I love yubikey is because it allows you to add even more, it is very powerful and broad. Once you start digging into it you will want to get to learn more about cryptography and Public Key Infrastructure. I have my yubikey to unlock by bitlocker encryption on startup on my workstation too. So basically there is a single device that fits for many.
I am not a reseller of yubikey nor a salesman of theirs, I just simply liked the product and thought it worth a quick write up, perhaps others can share their experience on other solutions too.
