11 April,19 at 11:51 AM
Background
Last month, with the release of Server Suite 2016.1, Centrify expanded on the MFA Everywhere strategy adding support for UNIX systems (AIX, HP-UX, Solaris) for Server Login and Privilege Elevation, on Microsoft Windows, MFA was added for Privilege Elevation and finally, MFA at login for Auto Zone and Classic Zones. This means that Centrify Express for UNIX/Linux customers can use the industry-recognized Centrify Identity Service tenants can implement MFA or step-up authentication when accessing systems.
This article covers the steps to implement MFA as an additional control to access systems integrated to AD with Centrify Express for UNIX/Linux. The information in this article can also be applied to Classic zones and Auto Zone (workstation mode).
For an in depth discussion on Centrify Server Suite MFA, you can read this lab entry.
For information on how to get started with Centrify Identity Service, visit the Getting Started page.
Planning
Potential Stakeholders
Technical Requirements
Centrify Parameters for MFA on Auto Zone
Centrify Express joins Active Directory in workstation mode. This allows for quick integration with AD for all users without worrying about UNIX identity. UNIX login, UID, primary group, GECOS, home and Shell are generated by the Centrify client. Configuration can be managed via parameters. The parameters introduced for MFA are the following:
Other relevant parameters:
Implementation
Scenario
We will get started with a Centrify Identity Service that has the Centrify Connector set up with the AD Bridge enabled.
To learn how to set up a Centrify connector you can always review the Getting Started guide.
First, we will enable MFA using information from a user in AD (e-mail, SMS, phone factor), then we will walk the user through the process of enrolling a mobile device (to enable Centrify Mobile Authenticator for push MFA) and we'll also use Google Authenticator for OATH OTP.
Configuring a Centrify Connector
Centrify connector configuration steps are outlined here. However, the steps are as follows:
Retrieve the IWA Cert
Since Centrify Identity Platform 16.10, IWA happens over HTTPS. This means that you must deploy a public, enterprise or tenant certificate. The steps below explain how to use the IWA certificate provided with the connector.
Configuring your Centrify Identity Service tenant for Server MFA
There are 4 tasks to configure MFA for Servers in the Admin Portal side:
Configuring the UNIX/Linux System's PKI to use the tenant certificate
You need to make sure the ca-certificates package is installed in your system and that you append the certificate retrieved from the connector in the previous steps (IWACert.crt) to the ca-bundle file.
To check if the CA certificates bundle is installed
# On RHEL and derivatives $ sudo yum info ca-certificates # If not installed $ sudo yum install ca-certificates
To append the Centrify Connector IWA certificate to your existing CA bundle
$ sudo cat /home/user/IWACert.crt >> /etc/pki/tls/certs/ca-bundle.crt
Note: This approach is recommended for a lab. Ideally you would have a public certificate or an Enterprise CA certificate deployed. More info in this post.
Configure Centrify Express for MFA at login
This is a parameter-based configuration. As defined above, you need at least 4 parameters in the /etc/centrifydc/centrifydc.conf file:
# set this one to true adclient.legacyzone.mfa.enabled: true # to require MFA, you can either use individual users or groups. # groups are more efficient adclient.legacyzone.mfa.required.groups: mfa-required # all members of mfa-required AD group will be prompted
# rescue rights can be assigned for HA in case all CCs are down # or there's no redundant connectivity to the cloud service adclient.legacyzone.mfa.rescue.users: vip.user1, vip.user2 # vip users can access systems in case of comm failure
# The cloud URL is the key parameter to specify your tenant # note that no direct internet connectivity is required, the CC # will broker this. adclient.legacyzone.mfa.cloudurl: https://unique-id.my.centrify.com:443/ # Use the unique URL instead of the vanity URL if you expect
# any changes.
# There are other parameters (e.g. for a Proxy server)
Save your changes and run an adreload or simply restart the centrifydc service.
Use adcdiag to check your work:
$ sudo /usr/share/centrifydc/bin/adcdiag
In my case, I just need to make sure that ChallengeResponse is set, since I'm using stock SSH.
$ grep Challenge /etc/ssh/sshd_config ChallengeResponseAuthentication yes
Verification
login as: lisa.simpson Using keyboard-interactive authentication. Password: Using keyboard-interactive authentication. [Available mechanisms] 1 - Mobile Authenticator 2 - Yubikey or OATH Token 3 - Email... @rpdemo.net 4 - SMS... XXX-2980 5 - Phone Call... XXX-2980 6 - Phone Call... XXX-4210 Please select a mechanism [1]:
Device enrollment for Push MFA with Centrify's Mobile Authenticator
Push MFA enhances the experience and provides more meaningful information. This requires that the current policy allows the user to enroll an Android or iOS device.
OATH OTP (Google Authenticator, FreeOTP, Yubico Authenticator, Duo and more)
OATH OTP opens more possibilities with this open standard. Users are easy to onboard, and there are a variety of Authenticators that can be used.
Enhancements
For those using Centrify Standard Edition with classic zones or workstation mode, you can use GPOs to manage the settings (or DevOps tools)
Centrify has also enhanced the documentation available for solutions like SecurID. Check out the Documentation Center.
Video Playlist