Changes between Version 7 and Version 8 of 2faVPN


Ignore:
Timestamp:
02/04/21 12:08:41 (4 years ago)
Author:
dabantz@…
Comment:

--

Legend:

Unmodified
Added
Removed
Modified

  • 2faVPN

    v7 v8  
    1 Two factor authentication provides Increased assurance for privileged VPN access to UA network. 
     1 
     2=== Use !YubiKey for 2FA with UA Duo account === 
     3 
     41. Obtain a !YubiKey supporting OTP in form factor that works for you: 
     5    https://www.yubico.com/products/yubikey-hardware/ 
     6 
     72. Download and install the !YubiKey Manager application on your computer: 
     8    https://www.yubico.com/products/services-software/download/yubikey-manager/ 
     9 
     103. Configure your !YubiKey for OTP in one of its two (virtual) slots*  using detailed illustrated instructions in the Duo guide:[[br]][[br]] 
     11   https://duo.com/docs/yubikey  
     12 
     13   NOTE WELL: You will use the !YubiKey Manager to generate cryptographic keys and store them on your !YubiKey;[[br]] 
     14   BE PATIENT: each of the three items will take a minute or so to generate and store;[[br]] 
     15   DO NOT REPEAT steps by clicking multiple times - each click will restart and overwrite the previous result! 
     16 
     174. Send the CSV string with digital serial no, 6 byte private id, 16 bit secret key (like this:) 
     18    {{{ 
     194475749, e7 fe 84 57 55 d4, 81 84 65 01 22 db e5 00 57 f9 68 92 7f 22 4b 6a 
     20}}} 
     21    to IAM or Security, noting your UA Username, which is the Duo account to which the token will be attached. 
     22 
     235. IAM or Security will upload the CSV string to import your token, and assign it to your ID at Duo 
     24 
     256. When integrated (step 5), you can use the !YubiKey to send the second factor passcode:  
     26    In the password field type your password followed by comma then touch your key*; that is, 
     27    {{{ 
     28password, 
     29}}}  
     30 then touch your key, which enters a one-time passcode.[[br]] 
     31  
     32 
     33---- 
     34 
     35 *Which of the !YubiKey's two (virtual) slots is used is determined by the duration of your touch. The first slot is used to generate the output when the !YubiKey button is touched between 0.3 to 1.5 seconds and released and the second slot is used if the button is touched between 2 to 5 seconds. 
     36 
     37=== Two factor authentication for privileged VPN access to UA network === 
    238As of March 2017 two VPNs require Duo two-factor authentication:[[br]] 
    339 swf-no-1.vpn.alaska.edu and [[br]] 
    … …  
    3470 
    3571You can enroll telephone numbers in your Duo account if you are enrolled for use of Duo for SSO (see https://iam.alaska.edu/trac/wiki/mfa for Duo enrollment instructions). 
    36  
    37 === Use !YubiKey for 2FA with UA VPNs === 
    38  
    39 1. Obtain a !YubiKey supporting OTP in form factor that works for you: 
    40     https://www.yubico.com/products/yubikey-hardware/ 
    41  
    42 2. Download the !YubiKey Personalization Tool: 
    43     https://www.yubico.com/support/knowledge-base/categories/articles/yubikey-personalization-tools/ 
    44  
    45 3. Configure your !YubiKey for OTP in one of its two (virtual) slots*  
    46    (generally shipped already programmed for OTP in slot 1) using the Duo guide: 
    47     https://duo.com/docs/yubikey 
    48  
    49 4. Send the CSV string with digital serial no, 6 byte private id, 16 bit secret key (like this:) 
    50     {{{ 
    51 4475749, e7 fe 84 57 55 d4, 81 84 65 01 22 db e5 00 57 f9 68 92 7f 22 4b 6a 
    52 }}} 
    53     to IAM or Security, noting your UA Username, which is the Duo account to which the token will be attached. 
    54  
    55 5. IAM or Security will upload the CSV string to import your token, and assign it to your ID at Duo 
    56  
    57 6. When integrated (step 5), you can use the !YubiKey to send the second factor passcode:  
    58     In the password field type your password followed by comma then touch your key*; that is, 
    59     {{{ 
    60 password, 
    61 }}}  
    62  then touch your key, which enters a one-time passcode.[[br]] 
    63   
    64  
    65 ---- 
    66  
    67  *Which of the !YubiKey's two (virtual) slots is used is determined by the duration of your touch. The first slot is used to generate the output when the !YubiKey button is touched between 0.3 to 1.5 seconds and released and the second slot is used if the button is touched between 2 to 5 seconds.