Operated by Los Alamos National Security, LLC for the U.S. Department of Energy's NNSA

Transcription

1 Operated by Los Alamos National Security, LLC for the U.S. Department of Energy's NNSA

2 Improving Remote Access Technology at LANL Veronica Martinez May 22, :30 AM Location: 104B Operated by Los Alamos National Security, LLC for the U.S. Department of Energy's NNSA LA-UR

3 LANL Remote Access Introduction Provides flexibility for our workforce to work remotely. While on travel or from home While on-call or performing after hours system maintenance If the lab is evacuated for an emergency or natural disaster 200+ users at any moment 316,000 successful logins in the last year (ever-increasing) Offers various remote services SSL Portal (Remote Desktop, Citrix, SSH, Web) Virtual Private Network (VPN) Providing reliable remote access services for our staff is essential remote access is the future! 6/13/2018 3

4 Issues with Previous Solution My VPN connection drops hourly. I just upgraded my Java and now I can t pass Host Checker!! I m experiencing slow network speeds when connected to VPN. Why am I getting a Windows Security prompt when trying to RDP to my machine? My Outlook client keeps prompting me for reauthentication. 6/13/2018 4

5 Pulse Secure Upgrade PSA7000f Version 8.3.R5 Hardware 15x faster High Availability Cluster Active/Passive Faster 10Gigabit Ethernet Connectivity No more Java dependency Pulse Secure Application Launcher Improved technology HTML5 RDP 6/13/2018 5

6 License Upgrade 1,000 concurrent VPN users ICE (In Case of Emergency) license capable of 25,000 concurrent VPN users Past events in Los Alamos have proven this to be a necessity 6/13/2018 6

7 Role Based Access Controls Roles: US Citizen, Foreign National, Basic Network, Employee Role, etc. Access Options: Web, Terminal Services, VPN Tunneling, etc. 6/13/2018 7

8 Two Options for Remote Access Portal Web (Limited features) Connection established through browser Must obtain Employee # and CRYPTOCard to authenticate. Access Limited web resources Terminal Sessions VPN (Advanced features) Connection established through Pulse Secure Client Must obtain Employee # and CRYPTOCard to authenticate. Management Approval LANL machine certificate Access Full internal web functionality RDP SSH 6/13/2018 8

9 Machine Certificate Deployment by OS. Windows Systems bound to Active Directory receive their machine certificate automatically. Mac Issued to systems that are enrolled in LANL software management. -Systems bound to Active Directory receive their machine certificate automatically. Systems not bound to Active Directory receive their machine certificates from LANL s Simple Certificate Enrollment Protocol (SCEP) server. Linux Currently we do not have an automated way to distribute certificates to Linux machines. This will be another SCEP implementation. 6/13/2018 9

10 Machine Certificate Enforcement Windows Mac Linux Few Host Checker options for Mac and Linux Trusted Client CA method 6/13/

11 OS-Specific Restrictions Windows vs Mac/Linux 6/13/

12 Client Software Distribution Windows: Application Catalog Mac: Application Catalog Linux: Files hosted on Web Web Portal 6/13/

13 Testing and Feedback Testing phase: Mailing list to inform people in pilot group Building documentation for users Regular review of logs Notes: Need to update iptables/trusted IP lists if any servers are using specific VLAN ranges Working closely with the vendor was helpful during implementation Positive Feedback: No more Outlook/Network drops No more issues passing Host Checker Reliable service 6/13/

14 Current Research and Path Forward 6/13/

15 Remote X11 Issues Issue: Launching an X client remotely causes performance issues due to the constant back and forth communication between client and server. Researched solution: X2Go Open Source Remote Desktop software for Linux Helps to solve Remote X11 issues Improves performance of graphical applications running remotely on Linux servers. Runs over SSH A server component is installed on the server or destination system. X2Go clients are available for Windows, Mac, and Linux. 6/13/

16 Multi-Factor Authentication Approach Goal is to meet NIST /63/171 authentication requirements Possible solutions that integrate with Pulse Secure RSA Security Google Authenticator Generic Requires a QR Code Duo Security Easy to integrate Good vendor support DOE is sponsoring for FedRAMP certification 6/13/

17 Duo Security Trade-offs Pros: Minimal info required from an employee (Employee Number, Address, and Mobile Number) Duo never sees the CRYPTOCard passcode. Mobile, landline phone, tablet, or hardware token can be used Cons: Use of CRYPTOCard (OTP) on web side of portal. Tries to replay passcode. (SAML is a workaround) 6/13/

18 Duo Authentication Process Demo xxxxxxx 6/13/

19 Resources Pulse Secure- X2Go- Duo Security- How Duo Security meets NIST policy requirements- 6/13/

20 Questions? 6/13/