Xceedium Xsuite. Secured by RSA Implementation Guide for 3rd Party PKI Applications. Partner Information. Last Modified: February 10 th, 2014

Transcription

1 Secured by RSA Implementation Guide for 3rd Party PKI Applications Last Modified: February 10 th, 2014 Partner Information Product Information Partner Name Xceedium Web Site Product Name Version & Platform 2.4 Product Description Xceedium protects your organization from security threats associated with privileged users, individuals and applications that have unfettered administrative access to your most sensitive IT infrastructure and business data. Xceedium s highly scalable solution employs role-based privilege access control, ensuring that privileged users, such as network administrators, security staff and trusted third parties, have rights to access only the specific systems, devices and commands they require. In other words, it provides least privilege access.

2 Solution Summary The Xceedium integrates with the RSA SID800 smart card to provide two factor authentication for users required to use certificate authentication for access to infrastructure resources

3 Product Configuration This section provides instructions for configuring Xceedium with RSA SecurID Authentication. This document is not intended to suggest optimum installations or configurations. It is assumed that the reader has both working knowledge of all products involved, and the ability to perform the tasks outlined in this section. Administrators should have access to the product documentation for all products in order to install the required components. All Xceedium components must be installed and working prior to the integration. Perform the necessary tests to confirm that this is true before proceeding. Configuration Summary Create Client Certificate template. Submit an End-Entity Certificate Request for the newly created Client Certificate. Import the client certificate to the RSA SID800 and import the CA Certificate on the user desktop. Upload the CA certificate and CRL to a 2.3 Appliance. Perform initial Login as user with Client Certificate. Grant PKI authentication to user within Xceedium Appliance. Client Certificate The client user certificate template is used by all Xceedium Clients who will be utilizing both the RSA SID800 smart card and PKI certificate for authentication. Create an End-Entity Certificate template within your Certificate Authority with the following mandatory certificate requirements: Certificate Requirements: basicconstraints = CA:FALSE nscerttype = client keyusage = digitalsignature, keyencipherment extendedkeyusage = clientauth 1. Using the Certificate of Authority where you created your End-Entity Certificate submit an End-Entity Certificate Request and approve the request

4 2. Download the P7b certificate for the user and import the certificate onto the RSA SID800 using the RSA Authentication Client. Note: Refer to the RSA Authentication Client documentation for more information on how to import the certificate. Note: Importing the End-Entity Certificate into a web browser is suggested only for testing. This option provides no security for the certificate since it is not password protected. 3. Download the Issuing CA Certificate & Chain if required and import into the Trusted Root Certification Authorities of the workstation used to access Xceedium. Xceedium CRL Configuration 1. Download the CA s latest CRL to insure the latest certificate status is available for validation by Xceedium. 2. Import the latest CRL into Xceedium. Client Authentication 1. Insert the SID800 containing the End-Entity certificate for the user into the workstation. 2. Open a browser window and browse to the web page of the Xceedium application. 3. When prompted enter the PIN of the RSA SID800 smart card. Note: The initial login to Xceedium will fail by design and as seen in the graphic in step 5 of the Client Authentication section of this guide

5 4. Select the Client Certificate for the user. 5. During the initial logon you will receive the following message from the Xceedium web page. 6. Login as the Xceedium Administrator and Select Users from the Menu

6 7. Select Approve CAC User. 8. Select Approve from the CAC Users Waiting for Approval screen and select Update. 9. When approved Xceedium will display the following message. 10. Logout of the Administrative Logon for the Xceedium, close the browser. 11. Login a second time with a new browser window and browse to the web page of the Xceedium application

7 12. When prompted enter the PIN of the RSA SID800 smart card. 13. Select the Client Certificate for the user. 14. When successful you will see the following within your browser window

8 Certification Checklist for 3 rd Party Applications Date Tested: February 10, 2014 Certification Environment Product Name Version Information Operating System RSA Certificate Manager 6.9 Build 554 Windows 2008 R2 x64 RSA Authentication Client (RAC) 3.6 Windows 7 SP2 x64 RSA SID800 Smart Card Revision D 3.7 Firmware Xceedium 2.4 Proprietary (Linux) Certificate Functionality Test Case Results Certificate Enrollment P10 Certificate Request P7 Response installed correctly CMP Certificate Request CMP Response installed correctly SCEP Certificate Request SCEP Response installed correctly Import Certificate Import PKCS#12 envelope Import via cut & paste Install Root Certificate via cut/paste Install SubCA Certificate via cut/paste Install Root Certificate via SCEP Install SubCA Certificate via SCEP Verify Certificate chain is installed Certificate Usage Sign Encrypt SSL S/MIME Document and Files SSL Client Authentication LDAP Support Results Name lookup Certificate retrieval Status Check of Certificate OCSP CRL Other Success with a valid certificate Fails with a revoked certificate Fails with a suspended certificate Pass with a re-instated certificate RSA Remote Authentication Client Access certificates via MS CAPI (Internet Explorer) RAC DRP / PAR = Pass = Fail = Non-Available Function - 8 -