Intel vpro Technology Use Case Reference Design

Transcription

1 Intel vpro Technology Use Case Reference Design Intel IPT with PKI and Protected Transaction Display Revision 1.0 May 2012 Document ID: 1114

2 Revision History Revision Revision History Date 1.0 Initial release. May 2012 INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION WITH INTEL PRODUCTS. NO LICENSE, EXPRESS OR IMPLIED, BY ESTOPPEL OR OTHERWISE, TO ANY INTELLECTUAL PROPERTY RIGHTS IS GRANTED BY THIS DOCUMENT. EXCEPT AS PROVIDED IN INTEL'S TERMS AND CONDITIONS OF SALE FOR SUCH PRODUCTS, INTEL ASSUMES NO LIABILITY WHATSOEVER, AND INTEL DISCLAIMS ANY EXPRESS OR IMPLIED WARRANTY, RELATING TO SALE AND/OR USE OF INTEL PRODUCTS INCLUDING LIABILITY OR WARRANTIES RELATING TO FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, OR INFRINGEMENT OF ANY PATENT, COPYRIGHT OR OTHER INTELLECTUAL PROPERTY RIGHT. UNLESS OTHERWISE AGREED IN WRITING BY INTEL, THE INTEL PRODUCTS ARE NOT DESIGNED NOR INTENDED FOR ANY APPLICATION IN WHICH THE FAILURE OF THE INTEL PRODUCT COULD CREATE A SITUATION WHERE PERSONAL INJURY OR DEATH MAY OCCUR. EXCLUSION OF OTHER WARRANTIES. THIS DOCUMENT IS PROVIDED "AS IS" WITHOUT ANY EXPRESS OR IMPLIED WARRANTY OF ANY KIND, INCLUDING WARRANTIES OF MERCHANTABILITY, NONINFRINGEMENT, OR FITNESS FOR A PARTICULAR PURPOSE. Intel does not warrant or assume responsibility for the accuracy or completeness of any information, text, graphics, links or other items contained within the Software. Intel may make changes to specifications and product descriptions at any time, without notice. Designers must not rely on the absence or characteristics of any features or instructions marked "reserved" or "undefined." Intel reserves these for future definition and shall have no responsibility whatsoever for conflicts or incompatibilities arising from future changes to them. The information here is subject to change without notice. Do not finalize a design with this information. The Intel Active Management Technology may contain design defects or errors known as errata which may cause the product to deviate from published specifications. Current characterized errata are available on request. Contact your local Intel sales office or your distributor to obtain the latest specifications and before placing your product order. Copies of documents which have an order number and are referenced in this document, or other Intel literature, may be obtained by calling , or by visiting Intel's Web Site. Intel Active Management Technology requires the computer system to have an Intel(R) AMT-enabled chipset, network hardware and software, as well as connection with a power source and a corporate network connection. Setup requires configuration by the purchaser and may require scripting with the management console or further integration into existing security frameworks to enable certain functionality. It may also require modifications of implementation of new business processes. With regard to notebooks, Intel AMT may not be available or certain capabilities may be limited over a host OS-based VPN or when connecting wirelessly, on battery power, sleeping, hibernating or powered off. For more information, see Throughout this document Intel ME refers to Intel Management Engine and Intel AMT refers to Intel Active Management Technology. Intel, the Intel logo, Intel AMT, and Intel vpro are trademarks or registered trademarks of Intel Corporation in the United States and other countries. *Other names and brands may be claimed as the property of others. Copyright 2012 Intel Corporation. All rights reserved. ii

3 Contents Revision History... ii Contents... iii 1 Preface Document Scope Document Organization Intended Audience Related Links Introduction Intel IPT with PKI Protected Transaction Display Special Considerations PIN Timeouts PIN Policy Settings Swapping the Hard Drive from One System to Another Changing a PIN or Forgotten PIN Situations Where PINs Will Not Work Slow Loading SSL Authentication to a Web Page Requirements Network Setup Set Up the Admin Console Set Up the Symantec* Managed PKI account and Managed PKI Client Software Set Up the Web Server Add the Symantec Root CA to the Computer s Trusted CA Store Install IIS Set Up a Secure Web Site Export the Server CA Set Up the Managed Client Import the Root CA Set Up the PKI Managed Client Create a Certificate the Profile Request a New Certificate for the User of the Managed Client Install the New Certificate Demonstrate the Use Case Digitally Sign and Encrypt Requirements Network Setup Server Setup Configure RAS Add Required Services for Exchange Install Exchange Add Mailboxes for Users iii

4 4.4 Set Up the Admin Console Join the Domain Set Up the Symantec Managed PKI Account and Managed PKI Client Software Install Outlook Setup the Managed Client Join the Domain Set Up the PKI Managed Client Add the Exchange Server Root CA Install the Certificate Create the Profile Request a New Certificate for the User of the Managed Client Install the New Certificate Configure Outlook Demonstrate the Use Case Set Up Outlook for Encryption and Digital Signature Create a Digitally Signed and Encrypted VPN Login VPN Login Using a Cisco* ASA Requirements Network Setup Admin Console Setup Set Up Cisco ASA Get Root Certificate for the ASA Get AnyConnect VPN Package Configure the ASA Set Up the Managed Client Trust Cisco CA Set Up MPKI Service Set Up Certificate Template for VPN Login Request a New Certificate for the User of the Managed Client Install the New Certificate Demonstrate the Use Case VPN Login Using a Microsoft* VPN Requirements Network Setup Server Setup Configure Remote Access Service Add and Configure Certificate Server Obtain an RAS Certificate Add Remote Access Permission to Users Configure the Admin Console Join the Domain Set Up the Symantec Managed PKI Account and Managed PKI Client Software Add Symantec Root CA to the NTAuth Certificate Store Configure the Managed Client Join the Domain Set Up MPKI Service Set Up Certificate Template for VPN Login Request a New Certificate for the User of the Managed Client iv

5 Install the New Certificate Set Up the VPN Demonstrate the Use Case VPN Login Using a Juniper Networks* Virtual Appliance Requirements Network Setup Server Setup Configure RAS Install VMWare Workstation Add Juniper Networks SA Virtual Appliance to VMWare Workstation Configure the Admin Console Configure the VPN Appliance Initial Configuration Further Configuration Configure the Managed Client Join the Domain Set Up MPKI Service Set Up Certificate Template for VPN Login Request a New Certificate for the User of the Managed Client Install the New Certificate Demonstrate the VPN Use Case Appendix Install and Configure PKI Managed Service and Client Software on the Admin Console Install and Configure PKI Managed Service and Client Software on the Managed Client Obtain Intel IPT with PKI Software Stack Create a Certificate Template Obtain Symantec PKI Root Certificate Export the Root CA Import the Root CA Add the Symantec Root CA to the Computer s Trusted CA Store Join the Domain Set Up Active Directory Initial Configuration Set Up a Domain Controller Setup a DHCP Service Add Users Add Remote Access Service Exporting MPKI Administrator Certificate for Use in Another Logon Add a User in MPKI v

6 vi

7 1 Preface Intel Identify Protection Technology (Intel IPT) is meant to augment security features that allow for user identification by adding a hardware layer of protection. Intel IPT with Private Key Infrastructure (PKI) acts as a hardware security module, similar to a Smart Card. However, it is as easy to manage as software PKI deployments. Intel IPT with Protected Transaction Display further protects PKI certificates with a PIN code. Display and entry of the PIN code is handled by secure hardware, making PIN theft very difficult. This document provides an overview of Intel IPT with PKI and Protected Transaction Display and outlines the most basic steps to try Intel IPT with PKI and Protected Transaction Display with secure web access, signing, and VPN logins. 1.1 Document Scope This document contains steps to use Intel IPT with PKI and Protected Transaction Display with: Secure Web Access via SSL Authentication using Microsoft Internet Information Server (IIS) Signing using Microsoft Exchange and Outlook VPN Login using a Cisco ASA 5505 VPN Login using Microsoft VPN VPN Login using Juniper Networks* Virtual appliance Steps incudes using the Symantec Managed PKI Service, which, at the time of this writing is a requirement of Intel IPT with PKI. This document also provides a brief overview of Intel IPT with PKI. However, it does not cover PKI in general. This document is not meant as a Best Known Method (BKM). Rather, it is meant to aid in experimenting with Intel IPT with PKI and Protected Transaction Display. Following this guide will provide hands on experience, which will aid in deployment planning for Intel IPT with PKI and Protected Transaction Display in a particular setup. 1.2 Document Organization The instructional chapters of this document, Chapters 3 through 5 which explain how to set up and configure SLL authentication to a web page, digital signing and encryption of , and VPN login, respectively contain several sections describing procedures that are common to all three activities. To avoid duplicating the detailed steps for these common procedures in each of the three chapters, the detailed steps for the common procedures are provided once in an appendix at the back of the 7

8 document. References to the appropriate appendix section are provided at the point in each chapter where those detailed steps are to be performed. For example, all three activities (SSL authentication to a web page, digital signing and encryption of , and VPN login) require the setup and configuration of an Admin Console. 1.3 Intended Audience This document is intended for Information Technology (IT) professionals who wish to experiment with Intel IPT with PKI and Protected Transaction Display. 1.4 Related Links Intel Identity Protection Technology Symantec Managed PKI Service PKI overview 8

9 2 Introduction 2.1 Intel IPT with PKI Intel Identity Protection Technology (Intel IPT) with PKI uses the Intel Management Engine (Intel ME) and 3rd generation Intel Core vpro processor based systems to provide a hardware based security solution similar to that of other hardware security modules like Smart Cards. Unlike most hardware security modules, however, Intel IPT with PKI is built to managed just like a software PKI deployment. The hardware based security is achieved by using the Intel ME to perform all cryptographic operations. In this way, keys are never exposed to software running on the computer s central processing unit (CPU). Furthermore, all certificates are tied to the platform on which they are created. The ease of use of Intel IPT with PKI is achieved in a number of ways. First, since keys are tied to the PC hardware, the PC itself becomes part of the authentication scheme. Compare this to a smart card where each card has a cost, and may need to be replaced over time. Furthermore, Intel IPT with PKI software is exposed as a Cryptographic Service Provider (CSP) via the Microsoft* CryptoAPI software layer. Thus, software that supports the use of cryptographic features through CryptoAPI can use Intel IPT with PKI. For example: Securely generate tamper resistant, persistent RSA key pairs in hardware Generate PKI certificates from hardware protected RSA key pairs Perform RSA private key operations within a protected hardware environment Protect key usage via PINs that use the Intel IPT with PKI protected transaction display The certificates created by Intel IPT with PKI support existing PKI usage models. This document provides steps to setup a lab to demonstrate primary use cases: SSL web site authentication signing and encryption VPN authentication Document uses Microsoft Internet Information Server, version 7.0 Document uses Microsoft Active Directory with Exchange 2010 and Microsoft Outlook as the client Document outlines the following Cisco AnyConnect VPN with an ASA 5505 Juniper Networks Junos Pulse* VPN with an SA Virtual Appliance Microsoft VPN Client with a Microsoft Remote Access Server 9

10 2.2 Protected Transaction Display Intel Identity Protection Technology (IPT) with Protected Transaction Display allows for secure PIN input by allowing the Intel ME to draw the input window and accept mouse clicks as input. In this way, software running on the main CPU does not have access to what is actually displayed on the screen even though the user can see it. Additionally, number keys on the PIN pad are randomized so that the numbers do not appear in the same position each time the PIN pad is launched. This prevents malware from determining the user s PIN based on the repetitive position of the mouse clicks. The following figures illustrate this. Figure 1 shows what the user will see displayed on the PC s screen. Figure 2 shows what software running on the CPU (such as a malicious process implemented by a hacker) would perceive. Figure 1: What the User Sees 10

11 Figure 2: What Software on the CPU sees Since certificates can be password protected, Intel IPT with PKI and Protected Transaction display can be combined to offer a higher level of certificate security. 2.3 Special Considerations PIN Timeouts During normal certificate usage, it is common for a certificate to be accessed multiple times in a row, then not used again for long periods. Rather than have the user enter the PIN code repeatedly, the PIN code is cached for 10 minutes. In other words, if the PIN is entered once it does not need to be entered again for the next 10 minutes. This cache timeout may be adjusted in the registry PIN Policy Settings The PIN policy settings provide a mechanism to define the complexity requirements for a valid pin for the secure PIN. The PIN policy settings can be found in the registry at HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Intel\Intel IPT with PKI. 11

12 The policy values are all DWORD values and include: Value Description Default Value PinMinLength PinMinUnique PinCacheTimeout The minimum acceptable length for the PIN. This value must be greater than or equal to 4. The maximum supported value is 10. The minimum number of unique digits required in the PIN. This value must be greater than or equal to 3. If this value is greater than the PinMinLength the PinMinLength value will be used. The time in minutes that a PIN will be cached on the system. The maximum supported time is 10,080 minutes (one week) Swapping the Hard Drive from One System to Another Sometimes a hard drive is taken from one failed system and placed in another working system for the purpose of getting user back up and running. This is sometimes called a Shell Swap. For software based PKI, this works great. For Intel IPT with PKI, this is a challenge because the certificates are tied to the PC hardware. Thus, for a shell swap, you need to add a step to the process to revoke existing user certificates and create new ones. Once the user first boots their platform, they can install the new certificates, create new PINs if needed, and then go about normal operations. Because keys are tied to the platform, they need to be regenerated Changing a PIN or Forgotten PIN In the current implementation of Intel IPT, PINs cannot be changed and cannot be recovered. If a PIN is forgotten or if a PIN is compromised, revoke the old certificate and create a new one. To enforce regular PIN changes, set a short validity period for a certificate so that the user must get a new certificate, and create a new PIN. NOTE Intel IPT currently does not enforce a policy that PINs across multiple certificates must be different. 12

13 2.3.4 Situations Where PINs Will Not Work Because entering a PIN requires user input, any process that cannot expose a dialog to the user cannot use certificates with PINs. The same is true for password protected software certificates. For example, some VPN software runs as a Windows service, not in the user context. Juniper Networks Junos Pulse, for example, as well as the Microsoft VPN client cannot use certificates that are password protected. This does not affect all VPN software Cisco AnyConnect and Juniper Networks Network Connect do work with the PIN code Slow Loading Intel IPT may seem slow if there is no connection to the Internet. This is because it checks for a public certificate revocation list which, if there is no internet connection, must timeout before the program can continue. You can work around this by following steps provided at the following link. 13

14 3 SSL Authentication to a Web Page Using a standard PKI setup, web applications can be configured to use certificates to authenticate users. In this way, only users who have valid certificates can access the web service. This is similar to using a username-password combination, where the certificate is used to identify the user. This is a standard use case with PKI that can be enhanced using Intel IPT with PKI and Protected Transaction Display. This section uses Microsoft Internet Information Server (IIS) to host a secure web site. In this use case both the server and the client will authenticate using a certificate. That way, only trusted users who possess a valid certificate are able to view the secure web site. Using certificates that tie into Intel IPT with PKI and Intel IPT with Protected Transaction display ensures certificates have not moved to a new PC and that the user knows the PIN code before they can use the certificate. Although these steps use IIS, these concepts may be applied to any web service. The following web browsers are tested with certificates that use Intel IPT with PKI. Internet Explorer* 8 Internet Explorer 9 Google* Chrome* 3.1 Requirements Role Managed Client Admin Console Internet Firewall Router Internet Connection Requirement The system must be a 3 rd generation Intel Core vpro processor based PC. Intel Graphics are required for Intel IPT with Protected Transaction Display. Any Windows based PC. Acts as Manages certificates Web Server Provides DHCP to the office network. Provides internet connectivity to all PCs on the network. Provides access to Symantec s Managed PKI Service. 14

15 3.2 Network Setup 1. Using the network diagram below as a guide, connect the Admin Console and Managed Client to the Internet firewall/router s LAN ports. 2. Connect the Internet connection to the WAN port of the Internet firewall/router. It is assumed that the Internet connection provides a DHCP address. If not, refer to Internet firewall/router documentation for further configuration details. 3. Plug in the Internet firewall/router. When it finishes turning on, plug in and turn on both PCs. 4. From the Admin Console, perform a basic Internet connectivity test to verify the connection to the Internet is working. Figure 3: Secure Web Login 15

16 3.3 Set Up the Admin Console Set Up the Symantec* Managed PKI account and Managed PKI Client Software Set up the Symantec* Managed PKI account and Managed PKI Client software as described in section 6.1 Install and Configure PKI Managed Service and Client Software on the Admin Console on page 50. NOTE If the managed PKI client software was set up before, under a different user account, the MPKI Administrative certificate needs to be exported from the original user account and imported into the current account. See section 6.9 Exporting MPKI Administrator Certificate for Use in Another Logon on page 57 for details. 3.4 Set Up the Web Server In this use case the Admin Console will be used as the web server. On the Admin Console, perform the steps described in the following sub-sections Add the Symantec Root CA to the Computer s Trusted CA Store Follow steps in section 6.5 Obtain Symantec PKI Root Certificate on page 51. Follow steps in section 6.8 Add the Symantec Root CA to the Computer s Trusted CA Store on page Install IIS 1. Click Start -> Control Panel. 2. Set View to Small icons. 3. Select Programs and Features. 4. Turn Windows Features on or off. 5. Select Internet Information Services. 6. Click OK. Wait while Windows installs IIS. 7. Reboot if prompted. 16

17 3.4.3 Set Up a Secure Web Site 1. Click Start -> Control Panel. 2. Select Administrative Tools. 3. Select Internet Information Services (IIS) Manager. 4. In the navigation tree, select your computer. 5. Double-click Server Certificates. 6. Click Create a Self-Signed Certificate. 7. For friendly name this document uses Web Server. 8. In the navigation tree, expand <Computer Name> -> Sites -> Default Web Site. 9. Right-click Default Web Site and choose Edit bindings. 10. Click Add. 11. Set as follows: Type: https IP address: Add Unassigned Port: 443 SSL certificate: Web Server Click OK 12. Select the row labeled http 80 and click Remove. 13. Click Yes. 14. Click Close. 15. Double-click SSL Settings. 16. Set as follows: Require SSL: selected Client Certificates: Require 17. Under Actions (on the right) click Apply. Now, only users with a valid client certificate will be able to connect to this web server Export the Server CA Follow steps in section 6.6 Export the Root CA on page 52. The certificate you wish to export is issued to the Admin Console (look for its name). 3.5 Set Up the Managed Client Perform the steps in this section to set up the Managed Client Import the Root CA Follow steps in section 6.7 Import the Root CA on page

18 3.5.2 Set Up the PKI Managed Client 1. Follow steps in section 6.2 Install and Configure PKI Managed Service and Client Software on the Managed Client on page Create a Certificate the Profile On the Admin Console, create a new certificate template by following steps in section 6.4 Create a Certificate Template on page 51. For the Certificate Template use Secure Sign-in. For a Friendly name, the document uses Web Sign-in Request a New Certificate for the User of the Managed Client On the Admin Console, request a new certificate for the Managed Client. 1. In Internet Explorer go to 2. In the lower center cluster of icons, click the second from the left, labeled Manage users and certificates. 3. If the user is not already added, follow steps in section 6.10 Add a User in MPKI on page 57 to add them. For this section, use kw@vprodemo.com. 4. Select kw@vprodemo.com. 5. Click Enroll user for a certificate. 6. Select the certificate template created above. The document uses Web Sign-in. Leave the passcode for picking up certificate at the defaults. Do not select Have the system send the enrollment . Click Continue. 7. For Other Name (UPN) enter kw@vprodemo.com. Click Continue. 8. Copy the instructions provided into a new text document, save it, and copy this document to the Managed Client. 9. Click Done Install the New Certificate 1. On the Managed Client, open the text file created in above. 2. In a browser, go to the URL link in the text file. 3. For address enter kw@vprodemo.com and click Continue. 4. Enter the enrollment code listed in the text file and click Continue. 5. Click Continue. 6. Click Install Certificate. 7. If prompted Enter a PIN. The document uses When prompted to install a root CA, click Yes. 18

19 3.6 Demonstrate the Use Case 1. On the Managed Client, use Internet Explorer to go to Address of the admin console>/. 2. If a certificate error is given, click Continue (not recommended). 3. If multiple client authentication certificates are found, you will be prompted with a list to choose from. Choose your certificate now. If only one is found, Internet Explorer may automatically select it. Note: if no valid client authentication certificates are found, you will see an error on the page. This may happen if the Symantec root CA was not imported into the computer store on the Admin Console, or if the user certificate was not installed on the Managed Client. 4. If you protected the certificate with a PIN, the Enter Pin window opens. 5. Enter the PIN that you used when installing the certificate and click OK. 6. You can now see the default IIS 7 web page. This page is only viewable by users with a valid user certificate issued by the Symantec Managed PKI server. In other words, the certificate must be signed by the root CA you imported into the computer store on the Admin Console. 7. Access the same page from the Admin Console. Unless it has a valid client certificate, you will see 403 unauthorized, a 404 page not found, or Internet Explorer cannot display the webpage. 19

20 4 Digitally Sign and Encrypt can be signed and/or encrypted using a standard PKI setup. Signing applies a checksum, or signature, to an that allows the recipient to verify that it came from the sender and that it was not tampered with along the way. When signing an , the sender s certificate private key is used to generate the signature. The recipient uses the sender s certificate public key to verify the signature. Encrypting scrambles the contents of an such that only the recipient can read it. When encrypting an , the sender uses the recipient s certificate public key to encrypt the message and the recipient uses his own certificate private key to decrypt and read the message. Intel IPT with PKI and Protected Transaction Display can be used to enhance this use case. Steps below describe configuring a Windows 2008 R2 server with Active Directory, Remote Access, and an Exchange Server 2010 for deploying this use case. Of course, other systems that support Microsoft CryptoAPI can be used as well. These steps are designed to set up an Exchange server as quickly as possible. They are not meant as a Best Known Method, or BKM, but rather the shortest path possible to demonstrate the use case. If you have an Exchange server already set up, you may use it by skipping ahead to section 4.4 Set Up the Admin Console on page 24. When creating certificates, be sure to use actual user accounts on your Exchange server. Also note that Symantec s MPKI service only allows one certificate per address. This is enforced across MPKI accounts. As such, do not use standardized test domains or user accounts such as contoso.com or vprodemo.com. Instead, use an actual domain you own. When finished, revoke any certificates so there will not be conflicts at a later time. 20

21 4.1 Requirements Role Managed Client Admin Console Server Internet Connection Requirement The system must be a 3rd generation Intel Core vpro processor-based PC. Intel Graphics are required for Intel IPT with Protected Transaction Display. Any Windows based PC. You may use the managed client for this role. PC with Windows 2008R2 installed with default options Access to Microsoft Exchange Server SP1 install media: This acts as: Active Directory DHCP DNS Internet Firewall / Router Exchange server 2 NICs Provides access to Symantec s Managed PKI Service. 4.2 Network Setup 1. Using the network diagram below as a guide, connect the Server, Admin Console, and Managed Client to the same network switch. 2. Connect the Internet connection to the second port on the Server. It is assumed that the Internet connection provides a DHCP address. If not, be sure to configure the Server s second adapter appropriately. 3. Power on the Server. Wait to power on the PCs until after the Server is configured. 21

22 Figure 4: 4.3 Server Setup These instructions were written using a fresh Windows 2008 R2 64 bit Enterprise with SP1 installed. Follow steps in section Set Up Active Directory on page 53. Note: Symantec s MPKI service only allows one certificate per address. This is enforced across MPKI accounts. As such, do not use the domain vprodemo.com as suggested in the steps. Instead, use an actual domain you own Configure RAS 1. Click Start -> Administrative Tools -> Routing and Remote Access. 2. Select the Server tree. 3. Right-click the Server and select Configure and Enable Routing and Remote Access. 4. Click Next. 5. Select Network Address Translation and click Next. 22

23 6. Select Use this public interface to connect to the Internet. Select the connection that is connected to the Internet. Click Next. 7. Click Finish. If a dialog opens suggesting that you open the NPS console, dismiss it Add Required Services for Exchange 1. Open Microsoft Windows PowerShell*. 2. Enter the command: Import-Module ServerManager 3. Enter the command: Add-WindowsFeature NET-Framework,RSAT-ADDS,Web-Server,Web-Basic- Auth,Web-Windows-Auth,Web-Metabase,Web-Net-Ext,Web-Lgcy-Mgmt- Console,WAS-Process-Model,RSAT-Web-Server,Web-ISAPI-Ext,Web-Digest- Auth,Web-Dyn-Compression,NET-HTTP-Activation,RPC-Over-HTTP-Proxy. 4. The features will be installed. Eventually a Warning will appear that a reboot is required. When the script completes, reboot the Server. 5. After the reboot, login and open Windows PowerShell. 6. Enter the command: Set-Service NetTcpPortsharing StartupType Automatic 7. Download and install the Microsoft Filter Pack 2.0 from the following website: Install Exchange 1. Insert your Exchange CD. 2. Run setup.exe. 3. Under Install, steps 1 and 2 are already completed. Click Step Choose Install only languages included on the DVD. 5. Click Step 4. The Exchange Server setup appears. 6. Click Next. 7. Select I accept and click Next. 8. Select No and click Next. 9. Select Typical Exchange Server Installation and click Next. 10. For Specify the name for this Organization this document uses vprodemo. Click Next. 11. Select No and click Next. 12. Click Next. 13. Select I don t want to join the customer experience program and click Next. 14. Exchange performs a Readiness test. When it finishes, click Install. 23

24 15. The installation begins. When it finishes, uncheck Finish this installation using the Exchange Management Console. Click Finish. 16. Reboot the system Add Mailboxes for Users 1. From the Start menu, open the Exchange Management Console. 2. Expand Microsoft Exchange on Premises -> Recipient Configuration -> Mailbox. 3. Right-click Mailbox and select New Mail Box. 4. Select User Mailbox and click Next. 5. Select Existing Users, click Add, then select both itproadmin and kw. Click OK. 6. Click Next. 7. Click Next. 8. Click New. 9. Click Finish. 4.4 Set Up the Admin Console Join the Domain 1. Follow steps in section Join the Domain on page 53 to join the domain. 2. Login as <your domain>\itproadmin Set Up the Symantec Managed PKI Account and Managed PKI Client Software Set up the Symantec Managed PKI account and Managed PKI Client software as outlined in section 6.1 Install and Configure PKI Managed Service and Client Software on the Admin Console on page 50. NOTE If the Managed PKI Client software was set up before under a different user account, the MPKI Administrative certificate needs to be exported from the original user account and imported into the current account. See section 6.9 Exporting MPKI Administrator Certificate for Use in Another Logon on page 57 for details. 24

25 4.4.3 Install Outlook 1. Install Outlook from an Office 2010 DVD ( using the default options. 2. Launch Outlook. 3. Click Next. 4. Select Yes and click Next. 5. Enter the following input and click Next: Your Name: ITPro Admin address: domain> Password: 6. The Exchange Server is discovered. If prompted with a security alert, click Yes to proceed. 4.5 Setup the Managed Client Join the Domain 1. Follow steps in section Join the Domain on page 53 to join the domain. 2. Login as <your domain>\kw Set Up the PKI Managed Client Follow steps in section 6.2 Install and Configure PKI Managed Service and Client Software on the Managed Client on page Add the Exchange Server Root CA On the domain controller, perform the following steps: 1. Click Start -> Run -> MMC -> OK. 2. Click File -> Add / Remove Snap In. 3. Select Certificates and click Next. 4. Select Computer and click Next. 5. Select Local Computer and click Next. 6. Click OK. 7. Expand Console Root -> Certificates (local computer) -> Personal -> Certificates. 8. Select DC1. 9. Expand Action -> All Tasks -> Export. 10. Click Next. 11. If prompted, do not export the private key. 25

26 12. Select Base 64 encoded X.509 (.CER) and click Next. 13. For File Name enter c:\exchange.cer and click Next. 14. Click Finish. 15. Click OK. 16. Close MMC. 17. Optionally save the MMC configuration if desired. 18. Copy c:\exchange to the Managed Client. On the Managed Client, perform the following steps: 1. Right-click exchange.cer and choose Install Certificate. If prompted with an Open File Security Warning, click Open. 2. Click Next. 3. Select Place all certificates in the following store. 4. Click Browse. 5. Select Trusted Root Certificate Authorities. 6. Click OK. 7. Click Next. 8. Click Finish. 9. Click OK Install the Certificate Create the Profile On the Admin Console, create a new certificate template by following steps in section 6.4 Create a Certificate Template on page 51. For the Certificate Template use Secure . For a Friendly name, this document uses . 26

27 4.5.5 Request a New Certificate for the User of the Managed Client On the Admin Console, request a new certificate for the Managed Client. 1. In Internet Explorer, go to 2. In the lower center cluster of icons, click the second icon from the left, labeled Manage users and certificates. 3. If the user is not already added, follow steps in section 6.10 Add a User in MPKI on page 57 to add them. For this section, use kw@<your domain>. 4. Select kw@<your domain>. 5. Click Enroll user for a certificate. 6. Select the certificate template created above. This document uses . Leave the passcode for picking up certificate at the defaults. Do not select Have the system send the enrollment . Click Continue. 7. For Other Name (UPN) enter kw@<your domain>. Click Continue. 8. Copy the instructions provided into a new text document, save it, then copy the saved text document to the managed client. 9. Click Done Install the New Certificate 1. On the Managed Client, open the text file created in above. 2. Open the URL link in the text file. 3. For address enter kw@<your domain> and click Continue. 4. Enter the enrollment code listed in the text file and click Continue. 5. Click Continue. 6. Click Install Certificate. 7. If prompted enter a PIN. The document uses When prompted to install a root CA, click Yes Configure Outlook 1. Install Microsoft Outlook* from a Microsoft Office* 2010 DVD using the default options. 2. Launch Outlook. 3. Click Next. 4. Select Yes and click Next. 27

28 5. Enter the following input and click Next: Your Name: Knowledge Worker address: domain> Password: 6. The Exchange Server is discovered. If prompted with a security alert, click Yes to proceed. 4.6 Demonstrate the Use Case You can use Intel IPT with PKI to digitally sign and encrypt . This section provides the instructions for both use cases as demonstrated in Microsoft Outlook Set Up Outlook for Encryption and Digital Signature 1. Open Outlook and navigate to the Security tab of the Trust Center. 2. Select the File tab. 3. Click Options. The Outlook Options window is displayed. 4. In the bottom left side of the Outlook Options window, click Trust Center. 5. Click Trust Center Settings. The Trust Center window is displayed. 6. In the left side of the Trust Center window, click Security. 7. Select Encrypt contents and attachments for outgoing messages. This causes s to be encrypted whenever possible by default. Note that sending encrypted uses the recipient s certificate, which must be published in the Global Access List (GAL). 8. Select Add digital signature to outgoing messages. This causes all s you send to be signed with your certificate by default. Note that this also can be enabled on a case-by-case basis. In addition, note that sending signed uses your certificate, which must be published in the Global Access List (GAL). 9. Click Publish to GAL. 10. Click OK. 11. If prompted, enter your PIN Code. 12. Click OK. The Trust Center window closes Create a Digitally Signed and Encrypted 1. In Outlook, create a new as you normally would, and then click Send. The settings you set in above are used by default. Optionally you can turn encryption and/or signing on and off for this only using the Options tab. As a test, you can try sending an to yourself (kw@<yourdomain>). 2. If you protected the certificate with a PIN, the Enter Pin window is displayed. 3. Enter the PIN that you used when installing the certificate and click OK. 28

29 NOTE In the figure below, the is signed and encrypted as indicated by the blue lock icon and the red Digital Signature icon in the . You can click the red Digital Signature icon to view the signature certificate details. Figure 5: Valid Digital Signature Displayed 29

30 5 VPN Login PKI can be used for VPN authentication. In this case, when a VPN session is connected, certificates are used to authenticate the user. PKI VPN authentication can be used instead of, or in addition to, a username password combination. In this way, only users with a valid certificate are allowed to connect to the VPN. Intel IPT can be used to further enhance the VPN login use case. This document describes various VPN solutions including the following: Cisco* AnyConnect* Microsoft s VPN client Juniper Networks Network Connect 5.1 VPN Login Using a Cisco* ASA 5505 These instructions are provided as a quick start guide. They assume the ASA 5505 is in its default configuration. For more details on ASA 5505 configuration and use, see the following links Quick Start: poster.html Cisco ASA 5000 series Command Line Reference: NOTE This guide was written using ASA version 8.1 and ASDM version 6.2. Steps may vary for different versions. This document uses Any Connect version Intel IPT with PKI was also tested with AnyConnect and is expected to work with any 2.5.* or 3.0.* version (except , which has a known issue) Requirements Role Managed Client Admin Console VPN Appliance Two Internet Connections Requirement The system must be a 3rd generation Intel Core vpro processor based PC. Intel Graphics are required for Intel IPT with Protected Transaction Display. Any Windows based PC. You can use the managed client for this role. Cisco ASA 5505 This document uses ASA version 8.2 Provides access to Symantec s Managed PKI Service. Used to connect to the VPN hosted by the ASA

31 5.1.2 Network Setup 1. Using the network diagram below as a guide, connect the Admin Console and Managed Client to ports 1 and 2 of the ASA Connect port 0 of the ASA 5505 to an Internet connection. It is assumed that the Internet connect provides a DHCP address. If not, refer to your ASA 5505 documentation for further configuration details. 3. Plug in the Cisco ASA. When it finishes turning on, plug in and turn on both PCs. 4. From the Admin Console, perform a basic Internet connectivity test to verify the connection to the Internet is working. Figure 6: Cisco ASA 5505 Setup 31

32 5.1.3 Admin Console Setup Set up the Symantec Managed PKI account and Managed PKI Client software as outlined in section 6.1 Install and Configure PKI Managed Service and Client Software on the Admin Console on page 50. NOTE If this was setup before, under a different user account, the MPKI Administrative certificate needs to be exported from the original user account and imported into the current account. See section 6.9 Exporting MPKI Administrator Certificate for Use in Another Logon on page 57 for details Set Up Cisco ASA Get Root Certificate for the ASA Follow steps in section 6.5 Obtain Symantec PKI Root Certificate on page Get AnyConnect VPN Package If your ASA 5505 does not have an AnyConnect VPN Package saved in the flash, go to Cisco s web site and download your desired version. This document uses Intel IPT with PKI was also tested with and is expected to work with any 2.5.* or 3.0.* version (except , which has a known issue). Download from here: Configure the ASA On the Admin Console, do the following: 1. If Java for Windows is not already installed, download and install the latest Java for Windows: 2. Open Internet Explorer and go to 3. If a cert error appears, click Continue to this website (not recommended). 4. Click Run ASDM. 5. If prompted, accept the Java security warnings. 6. Enter the administrative credentials for the ASA By default, these are blank. 7. Click Configuration at the top. 8. Click Remote VPN Access at the bottom left. 9. In the navigation tree, expand Certificate Management -> CA Certificates. 10. Click Add. 11. Click Browse. 12. Select c:\ca_public_key.cer and click Install. 32

33 13. Click Install Certificate. 14. Click OK. 15. In the navigation tree, expand Network (Client) Access-> Advanced -> Certificate to SSL VPN Connection Profile Maps. 16. Under Certificate to Connection Profile Maps click Add. 17. Set as follows and click OK: Map: Existing: DefaultCertificateMap Priority: Mapped to Connection profile: DefaultRAGroup 18. Set as follows and click OK: Map: Existing: DefaultCertificateMap Priority: Mapped to Connection profile: DefaultWebVPNGroup 19. Under Mapping Criteria, click Add. 20. Set as follows and click OK: Field: Subject Component: Organizational Unit (OU) Operator: Equals Value: VPN-WEB 21. In the navigation tree, expand Network (Client) Access-> Address Assignment -> Address Pools. 22. Click Add. 23. Set as follows and click OK: Name: VPN Starting IP Address: Ending IP Address: Subnet Mask: In the navigation tree, expand Network (Client) Access-> Group Policies. 25. Select DfltGrpPolicy (System Default) and click Edit. 26. In Address Pools, click Select. 27. Select VPN and click Addin->. 28. Click OK. 29. Click OK again. 30. In the navigation tree, expand Network (Client) Access-> AnyConnect Connection Profiles. 31. Select the following: Enable Cisco AnyConnect; ADSM will prompt to select an AnyConnect VPN Package. Either choose one already on the firmware, or upload the one downloaded from above; click OK. For Outside select both Allow Access and Enable DTLS. For Connection Profiles, select Enable for both profiles. 32. Select DefaultRAGroup and click Edit. 33. Set Authentication Method to Certificate. 34. Click OK. 35. On the left, click Firewall. 33

34 36. In the navigation tree, click NAT Rules. 37. Click Add -> Add NAT Exempt Rule 38. Set as follows and click OK: Action: Exempt Interface: inside Source: /24 Destination: /24 NAT Exempt Direction; NAT Exempt outbound traffic from interface inside 39. Click Apply. 40. At the top of the window, click Home. 41. Under Interface Status find the IP Address of the outside interface. Write the IP Address down, as it is used later to connect the VPN Set Up the Managed Client Trust Cisco CA On the Managed Client, do the following: 1. Open Internet Explorer and go to 2. If a cert error appears, click Continue to this website (not recommended). 3. To the right of the Address Line, click the Certificate Message. It may be pink and display Certificate Error. 4. A message is displayed. At the bottom, click View Certificates. 5. Click Install Certificate. 6. Click Next. 7. Select Place all certificates in the following store. 8. Click Browse. 9. Select Trusted Root Certificate Authorities. 10. Click OK. 11. Click Next. 12. Click Finish. 13. When prompted with a security warning click Yes. 14. Click OK. 15. Click OK Set Up MPKI Service Follow steps in section 6.2 Install and Configure PKI Managed Service and Client Software on the Managed Client on page

35 Set Up Certificate Template for VPN Login On the Admin Console, create a new certificate template by following steps in section 6.4 Create a Certificate Template on page 51. For the Certificate Template use Secure Sign in. For a Friendly name, the document uses VPN Request a New Certificate for the User of the Managed Client On the Admin Console, request a new certificate for the Managed Client. 1. In Internet Explorer, go to 2. In the lower center cluster of icons, click the second from the left, labeled Manage users and certificates. 3. If the user is not already added, follow steps in section 6.10 Add a User in MPKI on page 57 to add them. For this section, use kw@vprodemo.com. 4. Select kw@vprodemo.com. 5. Click Enroll user for a certificate. 6. Select the certificate template created above. The document uses VPN. Leave the passcode for picking up certificate at the defaults. Do not select Have the system send the enrollment . Click Continue. 7. For Other Name (UPN) enter kw@vprodemo.com. Click Continue. 8. Copy the instructions provided into a new text document, save it, then copy the text document to the Managed Client. 9. Click Done Install the New Certificate 1. On the Managed Client, open the text file created in section above. 2. In the text file, open the URL link. 3. For address enter kw@vprodemo.com and click Continue. 4. Enter the enrollment code listed in the text file and click Continue. 5. Click Continue. 6. Click Install Certificate. 7. If prompted enter a PIN. The document uses When prompted to install a root CA, click Yes Demonstrate the Use Case 1. Move the Managed Client to a direct Internet connection. 2. On the Managed Client, in Internet Explorer, go to outside IP Address written down in section above>. 3. If a certificate warning appears, click Continue to the website (not recommended). 4. If prompted, choose the certificate installed above. Note: This step will be skipped if only one certificate is installed. 35

36 5. If prompted, enter the PIN code for the certificate. The document uses This certificate is used as a login to the web service hosted on the ASA When the web service finishes loading, click AnyConnect on the left. 7. Click Start AnyConnect. 8. If AnyConnect is not yet installed, it will be installed automatically now. Accept any security warnings. 9. AnyConnect will make a VPN Connection. Accept any certificate warning messages. Congratulations, you have successfully used Intel IPT with PKI and Intel IPT Secure Transaction display to log into a Cisco ASA 5505 using AnyConnect and an SSL VPN. 5.2 VPN Login Using a Microsoft* VPN These steps are designed to setup a Microsoft Remote Access Server (RAS) on Windows 2008 R2 as quickly as possible. They are not meant as a Best Known Method (BKM), but rather the shortest path possible to demonstrate the use case. NOTE The Microsoft VPN client is not able to use certificates that are protected by a password/pin code Requirements Role Managed Client Admin Console Server Two Internet Connections Requirement The system must be a 3rd generation Intel Core vpro processor based PC. Intel Graphics are required for Intel IPT with Protected Transaction Display. Any Windows based PC. You may use the Managed Client for this role. PC with Windows 2008 R2 installed with default options 2 NICs This acts as: Active Directory DHCP DNS Internet Firewall / Router VPN Provides access to Symantec s Managed PKI Service. Used to connect to the VPN Service 36