13

Just got asked today about implementing two factor authentication for users of SSLVPN within our company (connecting via Cisco AnyConnect we don't support/use WebVPN). Currently we use LDAP for authentication.

I've identified a company that integrates directly with anyConnect and the mobility client to afford token based two factor authentication, but was wondering what are more common ways of implementing two-factor in this sort of setting? First thing that came to my mind was Google Authenticator or RSA, but finding information on these types of setups in conjunction with AnyConnect was surprisingly hard to find (I found nothing .. in fact)

4
  • Our company uses Duo security. I have understood that the first ten users are free you can try to see if it suits your needs. PD: I have no affiliations with Duo security. This is simply given as an example.
    – user2641
    Sep 12, 2013 at 17:51
  • We have used YubiKey successfully. Very, very economical and easy to set up. Works with Cisco ASA SSL VPN, PaloAlto and others probably. (I'm not connected to this company in any way, just a user)
    – Jakob
    Feb 17, 2014 at 14:57
  • Cool, thanks for the recommendation - we ended up going DUO - I'll just a dollar a user... is awesome, the service is straight-forward, my only gripe is that re-enrollment when they get a new phone or device is a bit of an annoyance administratively (not self service yet). highly recommend them (and not affiliated with them at all).
    – A L
    Mar 5, 2014 at 20:38
  • FWIW, I have always been shy of having auth (which is critical) depend on so many pieces (active directory + 2 factor piece). I want the 2 factor piece IN THE DEVICE, so it is active directory + device.... but this is hard to find. Jan 8, 2016 at 19:40

3 Answers 3

13

The two paths I can think of are as follows:

  1. You want to use the built-in Cisco ASA secondary authentication

  2. You are open to using a radius server.

The Concept for #2:

  1. Pick an authenticator. For example, Google, LDAP, AD, etc...

  2. Setup a Radius Server (FreeRADIUS, Windows NPM, Cisco ACS, etc...) that supports the authenticator.

  3. Configure the authentication on your Cisco ASA to use that Radius server (IP Address, ports, secret key, etc...) and then you are done. Adjust timeouts as needed.

About Google Authenticator:
You can setup FreeRadius to use Google Authenticator and then setup the Cisco ASA aaa-server to use the FreeRadius server. Done :)

About Duo Security:
I have used Duo Security and it works great. This configuration link shows how to set up 2-Factor Authentication without installing the Duo Security application. However, if you install the application (acts as a RADIUS server) then the setup becomes even easier. Below is a sample config that should help.

The CAVEATS to this setup:
Increase your timeouts! I've had issues with this. Do not install the Duo application on an existing RADIUS server (listening port conflict).

  • After installing the application on a server you need to modify the authproxy.cfg file to use Active Directory as your primary authenticator, at the top of your authproxy.cfg

  • Set client to ad_client and server to radius_server_auto

    [main]  
    client=ad_client  
    server=radius_server_auto  
    
  • Create a section called ad_client.

    [ad_client]
    host=10.x.x.11
    host_2=10.x.x.12
    service_account_username=ldap.duo
    service_account_password=superSecretPassword
    search_dn=DC=corp,DC=businessName,DC=com
    
  • security group is optional. this group allows users to authenticate.

    security_group_dn=CN=Administrators,CN=Builtin,DC=example,DC=com
    
  • Specific DUO security config info

    [radius_server_auto]
    ikey=xxxxxxxxxxxxx
    skey=xxxxxxxxxxxxx
    api_host=api-xxxxx.duosecurity.com
    
  • Safe or secure are the options here.

  • Safe=allow auth if Duo is unreachable.
  • Secure=do not allow auth if Duo is unreachable failmode=safe

  • IP address of Cisco ASA that you want to hit and the key

    radius_ip_1=10.x.x.1
    radius_secret_1=superSecretPassword
    
  • Windows Server that has the DuoSecurity App installed

    net stop DuoAuthProxy
    net start DuoAuthProxy
    
  • Cisco ASA 8.4 Configuration

  • Add new aaa-server to corresponding VPN policy

    aaa-server DUO protocol radius
    !
    aaa-server DUO (inside) host 10.x.x.101
     accounting-port 1813
     authentication-port 1812
     key superSecretPassword
     retry-interval 10
     timeout 300
    !
    
1
  • Thanks so much for the extensive write up! I've got a lot to work with here. Interesting to see how these systems work together to provide two-factor auth.
    – A L
    Sep 13, 2013 at 19:28
2

The definition of two factor authentication is having a variety of methods. These are the methods:

  1. What you know, like a login account's username and password
  2. What you have, like an RSA keyfob that generates numbers or a certificate file
  3. What you are, like retinal scans and fingerprint scanners

Two factor authentication is not having two different login accounts, as in two different sets of usernames and passwords, from two different sources because they are both "what you know". An example of two factor authenticating is inserting a smartcard into a laptop (what you have) and then swiping a fingerprint scanner (what you are).

It seems like you have a Microsoft Server, if I understand your use of LDAP. Why not enable the Microsoft Certificate Authority service on the nearest Microsoft Windows Server, which is included with the operating system, and enable user certificate enrollment? The ASA, with the CA's root certificate, can validate accounts, which it refers to as XAUTH, and then authenticate user certificates which Windows, Linux, and MacOS can use.

0

Correct, however provided you have a secure process for enrollment, in a way the mobile phone becomes the physical key fob. Duo also offers the UX flexibility of the app push or sms code. The internal CA on the ASA is great too but not an option if you run in HA pairs or multi-context. As suggested, use the MS/Dogtag CA or Duo.

IMO, you get the most coverage by configuring the vpn group as such:

Factor 1 - Use Certificates (MS/Dogtag/ASA onboard for CA) - can use ldap/AD user to gen the cert. (Best done locally, OpSec best practice must be followed in delivering/installing the cert.)

Factor 2 - FreeRADIUS or Duo proxy with secure enrollment for token/OTP fob or mobile device.

This way, if a user is targeted, the attacker must obtain a.) a copy of the certificate which should only exist in the laptop/endpoint keystore b.) the users AD / radius username/password c.) the fob (rsa/yubikey) or mobile device (DuoSec)

This also limits liability for lost/stolen devices. I believe duo also offers a way to manage the users via your AD as well which makes the whole setup easy to manage. Your gear must allow for timeout/retry adjustments to support the out-of-band user interaction during authentication. (Unlocking phone/pulling fob from pocket/etc. - allow at least 30sec radius timeout)

Not the answer you're looking for? Browse other questions tagged or ask your own question.