Hackers gained access to the main email server of the international company Deloitte. The administrator account for this server was only protected by a password.
Independent Austrian researcher David Wind was rewarded $5,000 for discovering a vulnerability on the Google intranet login page.
91% of Russian companies hide facts about data leaks.
Such news can be found almost every day in the news feeds on the Internet. This is direct evidence that internal company services must be protected.
The larger the company, the more employees it has, and the more complex its internal IT infrastructure, the more relevant the issue of information leakage becomes. What information is of interest to attackers and how can it be protected?
What kind of information leakage can harm a company?
- information about clients and transactions;
- technical information about products and know-how;
- information about partners and special offers;
- personal data and accounting.
If you realize that any information from the list provided can be accessed from any segment of your network simply by presenting a username and password, it’s worth considering improving the level of data security and protecting it from unauthorized access.
Two-factor authentication using hardware cryptographic tokens (tokens or smart cards) has earned a reputation for being very reliable while also relatively easy to implement.
We discuss the benefits of two-factor authentication in nearly every article. You can read more about it in articles on how to protect your account in a Windows domain, email, and .
Let’s proceed with the setup.
Step 1 — Server Setup .
The foundation of any server is its operating system. In our case, it’s Windows Server 2016. Along with it, IIS (Internet Information Services) is distributed with other operating systems in the Windows family.
The foundation of any server is its operating system. In our case, it’s Windows Server 2016. Along with it, IIS (Internet Information Services) is distributed with other operating systems in the Windows family.
The foundation of any server is its operating system. In our case, this is Windows Server 2016. Along with it and other operating systems from the Windows family, IIS (Internet Information Services) is included.
IIS is a group of internet servers, including a web server and FTP server. IIS includes applications for creating and managing websites.
IIS is designed to build web services using user accounts provided by a domain or Active Directory service. This allows for the use of existing user databases.
In We have thoroughly discussed how to install and configure a Certification Authority on your server. Now, we will not focus on this in detail, assuming everything is already set up. The HTTPS certificate for the web server must be issued correctly. It is best to check this right away.
Windows Server 2016 includes IIS version 10.0.
If IIS is installed, the next step is to configure it correctly.
At the role services selection stage, we checked the box Basic Authentication.
Then in IIS Manager we enabled Basic Authentication.
and specified the domain where the web server is located.
Next, we added the site binding.
And selected the SSL options.
At this point, the server configuration is complete.
After performing the actions mentioned, only users with a token containing a certificate and the token's PIN code will be able to access the site.
We remind you once again that according to , the user was previously issued a token with keys and a certificate issued according to the template type A user with a smart card.
Now we move on to configuring the user's computer. They need to configure the browsers they will use to connect to the secured websites.
Step 2 — Configuring the user's computer
For simplicity, let's assume our user has Windows 10 OS.
Let’s also assume they have the package installed .
The installation of the driver package is optional, as token support will likely come through Windows Update.
But if that does not happen, installing the RUTOKEN Drivers for Windows package will solve all issues.
We’ll connect the token to the user's computer and open the RUTOKEN Control Panel.
On the tab Certificates We will check the box next to the necessary certificate if it is not already checked.
Thus, we have verified that the token is functional and contains the required certificate.
All browsers except Firefox are configured automatically.
There is nothing special to do with them.
Now let's open any browser and enter the resource address.
Before the site loads, a window will open for certificate selection, followed by a window for entering the token PIN code.
If Aktiv ruToken CSP is set as the default cryptographic provider for the device, a different window will open for entering the PIN code.
Only after successfully entering it will our site open in the browser.
For Firefox, additional settings need to be configured.
In the browser settings, select Privacy and Protection. In the section Certificates click Protection Device. A window will open Device Management.
Click Download, specify the name of the RuToken digital signature and the path C:\windowssystem32rtpkcs11ecp.dll.
That's it; now Firefox knows how to communicate with the token and allows access to the site using it.
By the way, token access to websites works on Macs with Safari, Chrome, and Firefox.
You just need to install from the RuToken website and see the certificate on the token.
There's no need to configure Safari, Chrome, Yandex, and others; just open the site in any of these browsers.
Firefox is configured almost the same way as in Windows (Settings — Advanced — Certificates — Protection Devices). The path to the library is slightly different: /Library/Akitv Co/Rutoken ECP/lib/librtpkcs11ecp.dylib.
Conclusions
We have demonstrated how to set up two-factor authentication on websites using cryptographic tokens. As always, we did not need any additional software except for the system libraries of RuToken.
You can perform this procedure with any of your internal resources, and you can also flexibly set up user groups that will have access to the site, just as you can anywhere in Windows Server.
Do you use a different OS for the server?
If you would like us to write about configuring other operating systems, please mention it in the comments to the article.
Source: habr.com
