BlackShield ID PRO. Steel Belted RADIUS 6.x. Implementation Guide. Copyright 2008 to present CRYPTOCard Corporation. All Rights Reserved

Transcription

1 BlackShield ID PRO Steel Belted RADIUS 6.x Implementation Guide Copyright 2008 to present CRYPTOCard Corporation. All Rights Reserved

2 License and Warranty Information CRYPTOCard and its affiliates retain all ownership rights to the computer program described in this manual and other computer programs offered by the company (hereinafter called CRYPTOCard) and any documentation accompanying those programs. Use of CRYPTOCard software is governed by the license agreement accompanying your original media. CRYPTOCard software source code is a confidential trade secret of CRYPTOCard. You may not attempt to decipher, de-compile, develop, or otherwise reverse engineer CRYPTOCard software, or allow others to do so. Information needed to achieve interoperability with products from other manufacturers may be obtained from CRYPTOCard upon request. This manual, as well as the software described in it, is furnished under license and may only be used or copied in accordance with the terms of such license. The material in this manual is furnished for information use only, is subject to change without notice, and should not be construed as a commitment by CRYPTOCard. CRYPTOCard assumes no liability for any errors or inaccuracies that may appear in this document. Except as permitted by such license, no part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means electronic, mechanical, recording or otherwise, without the prior written consent of CRYPTOCard. CRYPTOCard reserves the right to make changes in design or to make changes or improvements to these products without incurring the obligation to apply such changes or improvements to products previously manufactured. The foregoing is in lieu of all other warranties expressed or implied by any applicable laws. CRYPTOCard does not assume or authorize, nor has it authorized any person to assume for it, any other obligation or liability in connection with the sale or service of these products. In no event shall CRYPTOCard or any of its agents be responsible for special, incidental, or consequential damages arising from the use of these products or arising from any breach of warranty, breach of contract, negligence, or any other legal theory. Such damages include, but are not limited to, loss of profits or revenue, loss of use of these products or any associated equipment, cost of capital, cost of any substitute equipment, facilities or services, downtime costs, or claims of customers of the Purchaser for such damages. The Purchaser may have other rights under existing federal, state, or provincial laws in the USA, Canada, or other countries or jurisdictions, and where such laws prohibit any terms of this warranty, they are deemed null and void, but the remainder of the warranty shall remain in effect. Customer Obligation Shipping Damage: The Purchaser must examine the goods upon receipt and any visible damage should immediately be reported to the carrier so that a claim can be made. Purchasers should also notify CRYPTOCard of such damage. The customer should verify that the goods operate correctly and report any deficiencies to CRYPTOCard within 30 days of delivery. In all cases, the customer should notify CRYPTOCard prior to returning goods. Goods returned under the terms of this warranty must be carefully packaged for shipment BlackShield ID Pro - Steel Belted RADIUS Implementation Guide i

3 to avoid physical damage using materials and methods equal to or better than those with which the goods were originally shipped to the Purchaser. Charges for insurance and shipping to the repair facility are the responsibility of the Purchaser. CRYPTOCard will pay return charges for units repaired or replaced under the terms of this warranty. Copyright Copyright 2009, CRYPTOCard All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of CRYPTOCard. Trademarks CRYPTOCard, CRYPTO-Server, CRYPTO-Web, CRYPTO-Kit, CRYPTO-Logon, CRYPTO-VPN, are either registered trademarks or trademarks of CRYPTOCard Inc. Java is a registered trademark of Sun Microsystems, Inc.; Microsoft Windows and Windows XP/2000/2003/NT are registered trademarks of Microsoft Corporation. SecurID is a registered trademark of RSA Security. All other trademarks, trade names, service marks, service names, product names, and images mentioned and/or used herein belong to their respective owners. Publication History Date Changes Version January 26, 2009 Document created 1.0 July 9, 2009 Updated copyright year 1.1 October 16, 2009 Minor updates 1.2 BlackShield ID Pro - Steel Belted RADIUS Implementation Guide ii

4 Additional Information, Assistance, or Comments CRYPTOCard s technical support specialists can provide assistance when planning and implementing CRYPTOCard in your network. In addition to aiding in the selection of the appropriate authentication products, CRYPTOCard can suggest deployment procedures that provide a smooth, simple transition from existing access control systems and a satisfying experience for network users. We can also help you leverage your existing network equipment and systems to maximize your return on investment. CRYPTOCard works closely with channel partners to offer worldwide Technical Support services. If you purchased this product through a CRYPTOCard channel partner, please contact your partner directly for support needs. To contact CRYPTOCard directly: International Voice: North America Toll Free: support@cryptocard.com For information about obtaining a support contract, see our Support Web page at Related Documentation Refer to the Support & Downloads section of the CRYPTOCard website for additional documentation and interoperability guides: BlackShield ID Pro - Steel Belted RADIUS Implementation Guide iii

5 Table of Contents Solution Overview... 1 Implementation and Application Overview... 1 Prerequisites... 2 Installing the BlackShield ID Pro Steel Belted RADIUS Agent... 2 Configuring Steel Belted RADIUS... 3 Enabling CRYPTOCard as an Authentication Policy...3 Creating Profile entries...4 Customizing Reply Messages... 4 Troubleshooting... 5 Steel Belted RADIUS Logs...5 BlackShield Steel Belted RADIUS agent logs...5 Common Errors...6 BlackShield ID Pro - Steel Belted RADIUS Implementation Guide iv

6 Solution Overview Summary Product Name Steel Belted RADIUS 6.x Vendor Site Authentication Method BlackShield ID Pro Agent Supported BlackShield ID Pro Agent and RADIUS Functionality RADIUS Authentication Encryption Authentication Mode New PIN Mode PAP One-time password Challenge-response BlackShield ID Pro static password User-changeable Alphanumeric 3-16 digit PIN User-changeable Numeric 3-16 digit PIN Server-changeable Alphanumeric 3-16 digit PIN Server-changeable Numeric 3-16 digit PIN Implementation and Application Overview This document presents the necessary steps to configure Steel Belted RADIUS for use with CRYPTOCard tokens. The BlackShield ID Pro server works in conjunction with Steel Belted RADIUS to replace static passwords with strong two-factor authentication that prevents the use of lost, stolen, shared, or easily guessed passwords when establishing a tunnel to gain access to protected resources: 1. A user establishes a connection using his/her logon name and CRYPTOCard tokengenerated one-time password. 2. The network device passes the authentication information via RADIUS to Steel Belted RADIUS. Steel Belted RADIUS identifies the Authentication Policy as CRYPTOCard then forwards the authentication request to the BlackShield ID Pro Server. 3. The BlackShield ID Pro Server verifies the username and password and an Access- Accept message is returned to Steel Belted RADIUS, allowing the user to access the network. BlackShield ID Pro- Steel Belted RADIUS Implementation Guide 1

7 Prerequisites The following must be installed and operational prior to configuring Steel Belted RADIUS to use CRYPTOCard authentication: o Ensure end users can authenticate through Steel Belted RADIUS with a static password before enabling the CRYPTOCard Authentication Method. o BlackShield ID Pro server installed and a user account assigned with a CRYPTOCard token. The following BlackShield ID Pro server configuration information is required: IP Address of the Primary BlackShield ID Pro server: IP Address of the Secondary BlackShield ID Pro server (optional): Installing the BlackShield ID Pro Steel Belted RADIUS Agent On the Steel Belted RADIUS Server, launch the BlackShield ID Pro Steel Belted RADIUS agent. Accept the CRYPTOCard License Agreement and select the Destination Folder. 1. Enter the IP address or Hostname of the BlackShield ID Pro server in the location field. 2. If required, select the specify failover server checkbox then enter the IP address or Hostname of the BlackShield ID Pro server in the location field. 3. Connect using SSL can be used if the IIS Web Server where BlackShield resides has been configured to use SSL. 4. Restart the Steel Belted RADIUS service. If a firewall exists between Steel Belted RADIUS and BlackShield ID Pro, verify TCP port 80 and/or 443 are available. BlackShield ID Pro - Steel Belted RADIUS Implementation Guide 2

8 Configuring Steel Belted RADIUS In order for Steel Belted RADIUS to authenticate CRYPTOCard token users, CRYPTOCard authentication must be enabled within Authentication Policies and Profile entries must be created. Configuring Steel Belted RADIUS consists of 2 steps: o Step 1: Enabling CRYPTOCard as an Authentication Policy o Step 2: Creating Profile entries Enabling CRYPTOCard as an Authentication Policy In the Steel Belted RADIUS Administrator select Authentication Policies, Order of Methods. In Active Authentication Methods, verify CRYPTOCard Token Validator is the first or only entry in the list. Apply the setting then restart the Steel Belted RADIUS service for the setting to take effect. BlackShield ID Pro - Steel Belted RADIUS Implementation Guide 3

9 Creating Profile entries If users are located in an SQL or LDAP container, a profile with the same name must exist in Steel Belted Radius for the user to successfully authenticate. On the Secured Users or Assignment Tab, make note of the Full Path location of the user. Ex. Full Path: \LDAP\OFFICE\CN=Users\ In the Steel Belted RADIUS Administrator select Profiles. Enter the BlackShield ID Pro Full Path entry as the name of the Steel Belted RADIUS Profile. The Profile name must not begin with a backslash. Ex. If the Full Path in BlackShield ID Pro is \LDAP\OFFICE\CN=Users\ the Steel Belted RADIUS Profile name will be LDAP\OFFICE\CN=Users\ Customizing Reply Messages The ccauthsbr.aut file found in the \Program Files\Juniper Networks\Steel-Belted Radius\Service directory allows for customization of the text strings presented to users. Any text after the equal sign may be changed to suit your companies needs. BlackShield ID Pro - Steel Belted RADIUS Implementation Guide 4

10 The following entries exist: CHALLENGE=Please respond to the challenge: SERVER_PIN_PROVIDED=Please re-authenticate, using the next response. Your new PIN is: USER_PIN_CHANGE=Please enter a new PIN. OUTER_WINDOW_AUTH=Please re-authenticate, using the next response. CHANGE_STATIC_PASSWORD=Your password has expired. Please select a new password. STATIC_CHANGE_FAILED=Password change failed. Please select a new password. PIN_CHANGE_FAILED=PIN change failed. Please select a new PIN. Troubleshooting Steel Belted RADIUS Logs When troubleshooting authentication issues in Steel Belted RADIUS to refer to the log files in the \Program Files\Juniper Networks\Steel-Belted Radius\Service\ directory. The Steel Belted RADIUS logging level can be changed in the \Program Files\Juniper Networks\Steel-Belted Radius\Service\radius.ini file. In the [Configuration] section change LogLevel and TraceLevel to 3. Restart the Steel Belted RADIUS server for the setting to take effect. BlackShield Steel Belted RADIUS agent logs All logging information for the BlackShield Steel Belted RADIUS agent can be found in the \Program Files\CRYPTOCard\BlackShield ID\SBR Agent\log directory. The logging level can be changed in the registry under the HKEY_LOCAL_MACHINE\SOFTWARE\CRYPTOCard\AuthSBR key. Change LogLevel from 3 to 5. Restart the Steel Belted RADIUS server for the setting to take effect. BlackShield ID Pro - Steel Belted RADIUS Implementation Guide 5

11 Common Errors Symptom The Steel Belted RADIUS log file displays the message Profile <RANDOM_NAME> required for user <username> does not exist Possible causes and solutions Verify the BlackShield ID Pro Full Path in the Assignment or Secured Users tab for the user exists as a Profile in Steel Belted RADIUS. The Steel Belted RADIUS log file displays the message Unable to find user <username> with matching password. This will occur when one or more of the following conditions occur: o The username does not correspond to a user on the BlackShield ID Pro Server o The CRYPTOCard password does not match any tokens for that user. o The BlackShield Agent for Steel Belted RADIUS cannot contact the BlackShield ID Pro Server. o The Pre-Authentication Rules on the BlackShield server do not allow incoming requests from the BlackShield Agent for Steel Belted RADIUS. o The BlackShield Agent for Steel Belted RADIUS Keyfile does not match the Keyfile stored on the BlackShield Server. The BlackShield agent for Steel Belted RADIUS log file displays the message "Send Failed. Could not connect to host. Timed out [A connection with the server could not be established -> msxml6.dll]." This will occur when one or more of the following conditions occur: o The WWW Web service or Token Validator web site is not running on the BlackShield ID Pro server. o The Pre-Authentication Rules on the BlackShield server do not allow incoming requests from the BlackShield Agent for Steel Belted RADIUS. o The BlackShield Agent for Steel Belted RADIUS Keyfile does not match the Keyfile stored on the BlackShield Server. BlackShield ID Pro - Steel Belted RADIUS Implementation Guide 6