Creating a Yubikey MFA Service in AWS

Transcription

1 Amazon AWS is a cloud based development environment with a goal to provide many options to companies wishing to leverage the power and convenience of cloud computing within their organisation. In 2013 AWS introduced Workspaces, a Desktop as a Service product which is very useful for those wishing to make better use of Cloud technologies and integrate the solutions with their workflow. Workspaces is a virtual desktop within a Virtual Private Cloud infrastructure which can provide more secure access to applications and systems hosted within AWS. In 2014 AWS added further Directory Service controls to their product, allowing for a connected Active Directory environment accessed within the AWS cloud to be secured using Multi-Factor Authentication methods, such as a Hardware Keyfob. This will enable an extra stage to the Workspaces Login Page which will request the additional authentication passcode. This tutorial will run through the steps and requirements to enable use of a Yubico Yubikey as the Hardware Keyfob by using the YubiX platform written by Yubico. For more information on Yubico and YubiX please visit the company s website at Prerequisites You will need: An AWS Account A VPC configured within any AWS region that supports Workspaces and Directory Services Four Subnets located within your VPC: o One public subnet housing a working NAT server o One private subnet for housing your internal server instances o Two private subnets for housing your Workspaces Two Windows Active Directory DC s, one located in each of the two Workspaces subnets, fully configured with DNS and a working AD Domain. One AWS Directory connection to your working AD Domain with working Workspaces A minimum of one Yubikey (get yours from they are also for sale from Amazon) Page 1 of 11

2 Launch a new Instance For my purposes, I installed an Ubuntu 14 Server from the AWS Quick Launch. This is my preference, but you may prefer to use a different flavour of Linux. You will need to modify your commands to suit your preferred Distribution. The Instance I have created is a T2.Medium instance within a PRIVATE subnet (it access the Internet via a NAT box) and I have chosen all other default settings. For the Security Group I have used the following rule: All Traffic from my VPC CIDR (Because this is within a PRIVATE subnet) Once the Instance is launched, I created a PPK file that will provide adequate credentials to allow me to connect to the server via PUTTY. As the instance is within a Private Subnet, I will need to have access to the VPC in order to make my connection. I could have launched an interim Windows or Linux server Instance within my public subnet. In my case I already have another server within that VPC that I can use. Initial Configuration As this is a new server, I always make sure everything is up to date sudo apt-get update && sudo apt-get upgrade Install YubiX The next step follows the guide located at Install Python Properties The one pre-requisite on the Linux side is the Python Software Properties package. sudo apt-get install python-software-properties Add repositories To perform an installation of YubiX, you will need to add software repositories to Apt. sudo add-apt-repository ppa:yubico/stable sudo add-apt-repository ppa:yubico/yubix sudo apt-get update Page 2 of 11

3 Install YubiX sudo apt-get install yubix Once you have started the YubiX install, you will have the following steps to complete: Enter a password for the MySQL Database, you will need this when creating the individual databases in the next steps. You will be asked to confirm the password. The next bit will get a bit boring. You will need to use the following format for each new database that is created. Page 3 of 11

4 Choose the default option of <YES> to create the database. Choose the default of MySQL for the database type. Page 4 of 11

5 Enter the MySQL Root password which you created earlier. Leave the next field blank, this will allow the installer to create its own password. Page 5 of 11

6 Update the YubiAdmin details Before you can access your YubiAdmin control panel, you will need to modify the config file that defines where the control panel can be accessed from. By default it will only allow access on the local machine. sudo nano /etc/yubico/admin/yubiadmin.conf Update the INTERFACE information to contain the local IP address of your server. In this case the server is If you so desire, you can change the Username and/or Password for the YubiAdmin login here. If you ever forget your U/P in future, this is the place to come to in order to change it. Log into YubiAdmin Open your preferred browser and point it to the YubiX server on port 8080 (remember, in this case I have created the server within a private subnet so am only able to access the server from an instance or workspace within the VPC). You will be asked for your credentials, in case you missed them on the previous screenshot the default credentials are: Username: yubiadmin Password: yubiadmin Page 6 of 11

7 Update your API key You will need an API key from Yubico in order to use the service. Not to worry, it doesn t cost anything. Click on the YubiAuth module within the YubiAdmin console and then navigate to the OTP Validation menu. You will notice the following warning: Click on the button to generate a unique API Key. Enter your address and use your Yubikey to generate its OTP in the relevant fields. Unless you have modified its function, the Yubikey should automatically send a CR command, so it will automatically Save the form. When you see this banner, you are good to go. Click again on the OTP Validation menu to see your updated Client ID, API Key and other information related to talking to the Yubico servers. Page 7 of 11

8 Configure a RADIUS client In order to have your AWS Directory talk to the YubiAuth server you will need to create a RADIUS client. YubiX comes with FreeRadius installed and configured to listen on port To talk to FreeRadius, the system needs to be told where to expect traffic from, and what to do with it when it receives that traffic. Click on the FreeRADIUS module within the YubiAdmin console, then navigate to the RADIUS Clients menu. You will see that this is a text wrapper containing the config file located at /etc/freeradius/clients.conf. You will see some examples for creating the RADIUS clients if you scroll down. It is pretty daunting if you have not spent a lot of time modifying Linux Config files, but the process is very simple. Scroll down and locate the end of the CLIENTS sections. This will be denoted by a comment block which starts with a line of # characters. Insert the following CLIENT section just above this block: client /16 { secret = [SOMESECURESECRETCODE] nastype = other require_message_authenticator = no } Once saved, you will need to restart FreeRADIUS. Add YubiAuth server to Directory You are now ready to add the server to your directory as an MFA Radius connection. Open your AWS Console and navigate to Directory Service. Select your Directory by clicking on the Directory ID. Select the Multi-Factor Authentication tab and update enable MFA. You will now be able to enter the YubiAuth server details. Page 8 of 11

9 The secret code is the SECRET value you entered within the RADIUS client in the previous step. The Server Timeout and Max Retries are best left at 20 and 5 respectively. Any of the Protocols will connect, but I don t know if they will work in terms of authentication. Your mileage may vary. Click Update Directory and wait. You will need to refresh the screen to see if it has worked, if everything has gone well then you will now see the following: Create your users There are some limitations when using this within AWS. I did not spend much time on getting the Automatic Enrolling functionality working when linked to AD. It was something that was not very important in my testing and further implementation. To create your users, go to the YubiAdmin console once again and enter the YubiAuth module and select the Manage Users menu. Page 9 of 11

10 Click Create new user to create a user. Enter the domain username and click Save. You can enter a password if you wish, but it is not necessary. Repeat for each user you are adding to the RADIUS system. Once finished, click on the Manage Users menu once again, you will see your list of users. To manage in individual user, click on the username. Here you can change the password, but the important part is adding a Yubikey to the user. Simply connect the Yubikey to your USB port and use it to enter an OTP within the Assign Yubikey field. Again, if you haven t modified your Yubikey it will automatically send a CR character, so you will not need to click Assign. Page 10 of 11

11 Your Yubikey is now ready to be used against that user. Enable blank passwords If you have chosen not to use passwords for any of your users then you will need to enable blank passwords. The password is entered before your OTP when logging in, so if you have a password set it will need to be entered into the Passcode field of the Workspaces Client Login Page, followed by your Yubikey OTP. To enable blank passwords, navigate to the YubiAuth module within the YubiAdmin console. Here you will need to go into the General tab (which is the default tab for the module) and check the entry marked Allow Empty Passwords. Click Save and then click the button to reload the web server. Using your Yubikey You are now ready to use your Yubikey within the AWS Workspaces connected to this directory. Launch your Amazon Workspaces Client and ensure it is registered to the correct Directory. Then enter your Username and Password. You will now be presented with a second screen asking for additional credentials. The Passcode you need to enter is the Yubikey OTP (if you have added a password for the YubiAuth user then you will need to enter the password followed by the OTP). Page 11 of 11