{"id":36872,"date":"2019-10-31T22:14:26","date_gmt":"2019-10-31T19:14:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/go-to-2fa-dvuhfaktornaya-autentifikatsiya-dlya-asa-ssl-vpn\/"},"modified":"2019-10-31T22:14:26","modified_gmt":"2019-10-31T19:14:26","slug":"go-to-2fa-dvuhfaktornaya-autentifikatsiya-dlya-asa-ssl-vpn","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/go-to-2fa-dvuhfaktornaya-autentifikatsiya-dlya-asa-ssl-vpn","title":{"rendered":"Go to 2FA (Two-Factor Authentication for ASA SSL VPN)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

The need to provide remote access to the corporate environment is becoming increasingly frequent, whether it involves internal users or partners who require access to a specific server within your organization.<\/p>\n

For this purpose, most companies utilize VPN technology, which has proven to be a reliably secure method for granting access to an organization's local resources.<\/p>\n

My company is no exception, and like many others, we use this technology. We also use Cisco ASA 55xx as our remote access gateway.<\/p>\n

As the number of remote users increases, the need to simplify the credential issuing process arises. However, this must be done without compromising security.<\/p>\n

We found our solution in applying two-factor authentication for Cisco SSL connections, using one-time passwords. This publication will explain how to set up such a solution with minimal time investment and zero software costs (assuming you already have Cisco ASA in your infrastructure). VPN<\/a>The market is filled with boxed solutions for generating one-time passwords, offering a variety of options for their delivery, whether by sending passwords via SMS or using tokens, both hardware and software-based (for example, on a mobile phone). However, a desire to save money for my employer in the current crisis led me to find a free way to implement a one-time password generation service. This solution, despite being free, is hardly inferior to commercial offerings (it should be noted that this product does have a commercial version, but we agreed that our costs would be zero).<\/p>\n

So, we will need:
\n<\/a><\/noindex>
\n\u2014 A Linux image with a built-in toolkit \u2014 multiOTP, FreeRADIUS, and nginx, for web access (http:\/\/download.multiotp.net\/ \u2014 I used a ready-made image for VMware)<\/p>\n

\u2014 An Active Directory server
\n \u2014 The Cisco ASA itself (for convenience, I use ASDM)
\n \u2014 Any software token that supports the TOTP mechanism (for example, I use Google Authenticator, but FreeOTP will also work fine)
\n \u2014 Any software token that supports the TOTP mechanism (For example, I use Google Authenticator, but FreeOTP would also work.)<\/p>\n

I won't go into detail about deploying the image. You will end up with Debian Linux that has multiOTP and FreeRADIUS already installed, configured to work together, and a web interface for OTP administration.<\/p>\n

Step 1. Initiate the system and configure it for your network<\/b>
\nBy default, the system comes with the root credentials root root. I think everyone knows that it would be wise to change the root user password after the first login. It is also necessary to change the network settings (by default this is \u2018192.168.1.44\u2019 with a gateway of \u2018192.168.1.1\u2019). After that, you can reboot the system.<\/p>\n

In Active Directory, we will create a user otp<\/b>, with the password MySuperPassword<\/b>.<\/p>\n

Step 2. Set up the connection and import Active Directory users<\/b>
\nFor this, we will need access to the console and the file multiotp.php<\/b>, which we will use to configure the connection parameters to Active Directory.<\/p>\n

Go to the directory \/usr\/local\/bin\/multiotp\/<\/i> and sequentially execute the following commands:<\/p>\n

.\/multiotp.php -config default-request-prefix-pin=0<\/code><\/pre>\n
\nSpecifies whether an additional (static) pin is required when entering a one-time pin (0 or 1)<\/p>\n
.\/multiotp.php -config default-request-ldap-pwd=0<\/code><\/pre>\n
\nSpecifies whether the domain password needs to be entered when entering a one-time pin (0 or 1)<\/p>\n
.\/multiotp.php -config ldap-server-type=1<\/code><\/pre>\n
\nIndicates the type of LDAP server (0 = regular LDAP server, in our case 1 = Active Directory)<\/p>\n
.\\\/multiotp.php -config ldap-cn-identifier=\"sAMAccountName\"<\/code><\/pre>\n
\nIndicates the format for representing the username (this value will output only the name, without the domain)<\/p>\n
.\\\/multiotp.php -config ldap-group-cn-identifier=\"sAMAccountName\"<\/code><\/pre>\n
\nThe same, but for the group<\/p>\n
.\\\/multiotp.php -config ldap-group-attribute=\"memberOf\"<\/code><\/pre>\n
\nSpecifies the method for determining user group membership<\/p>\n
.\/multiotp.php -config ldap-ssl=1<\/code><\/pre>\n
\nSpecify whether to use a secure connection to the LDAP server (of course \u2014 yes!)<\/p>\n
.\/multiotp.php -config ldap-port=636<\/code><\/pre>\n
\nPort for connecting to the LDAP server<\/p>\n
.\/multiotp.php -config ldap-domain-controllers=adSRV.domain.local<\/code><\/pre>\n
\nAddress of your Active Directory server<\/p>\n
.\\\/multiotp.php -config ldap-base-dn=\"CN=Users,DC=domain,DC=local\"<\/code><\/pre>\n
\nSpecifies where to start searching for users in the domain<\/p>\n
.\\\/multiotp.php -config ldap-bind-dn=\"otp@domain.local\"<\/code><\/pre>\n
\nSpecifies the user with permission to search in Active Directory<\/p>\n
.\\\/multiotp.php -config ldap-server-password=\"MySuperPassword\"<\/code><\/pre>\n
\nSpecifies the password for the user connecting to Active Directory<\/p>\n
.\/multiotp.php -config ldap-network-timeout=10<\/code><\/pre>\n
\nSet the timeout for connecting to Active Directory<\/p>\n
.\/multiotp.php -config ldap-time-limit=30<\/code><\/pre>\n
\nSet the time limit for the user import operation<\/p>\n
.\/multiotp.php -config ldap-activated=1<\/code><\/pre>\n
\nActivating the connection configuration to Active Directory<\/p>\n
.\/multiotp.php -debug -display-log -ldap-users-sync<\/code><\/pre>\n
\nImporting users from Active Directory<\/p>\n
Step 3. Generate QR code for the token<\/b>
\nThis step is quite straightforward. Open the OTP server's web interface in your browser, log in (don't forget to change the default admin password!), and click the 'Print' button:<\/p>\n
\"Go
\nThe result of this action will be a page containing two QR codes. We can ignore the first one (despite the enticing labels Google Authenticator \/ Authenticator \/ 2 Steps Authenticator) and confidently scan the second code in the software token on the phone:<\/p>\n
\"Go
\n(yes, I intentionally ruined the QR code to make it unreadable).<\/p>\n
After performing these actions, your application will generate a six-digit password every thirty seconds.<\/p>\n
For confirmation, you can perform a check in the same interface:<\/p>\n
\"Go
\nBy entering the username and the one-time password from the application on your phone. Did you get a positive response? Then let\u2019s proceed.<\/p>\n
Step 4. Fine-tune and test FreeRADIUS operation<\/b>
\nAs I mentioned earlier, multiOTP is already configured to work with FreeRADIUS; now we just need to run tests and add information about our VPN gateway to the FreeRADIUS configuration file.<\/p>\n
Returning to the server console, navigate to the directory \/usr\/local\/bin\/multiotp\/<\/i>, type:<\/p>\n
.\/multiotp.php -config debug=1\n.\/multiotp.php -config display-log=1<\/code><\/pre>\n
\nThus enabling more detailed logging.<\/p>\n
In the FreeRADIUS client configuration file (\/etc\/freeradius\/clinets.conf<\/i>) comment out all lines related to localhost<\/b> and add two entries:<\/p>\n
client localhost {\n        ipaddr = 127.0.0.1\n        secret = testing321\n        require_message_authenticator = no\n}<\/code><\/pre>\n
\n \u2014 for testing<\/p>\n
client 192.168.1.254\/32 {\n        shortname = CiscoASA\n        secret = ConnectToRADIUSSecret\n}<\/code><\/pre>\n
\n \u2014 for our VPN gateway.<\/p>\n
Restart FreeRADIUS and try to authenticate:<\/p>\n
radtest username 100110 localhost 1812 testing321<\/code><\/pre>\n
\nwhere username <\/i>= username, 100110 <\/i>= the password provided by the application on your phone, localhost <\/i>= the RADIUS server address, 1812 <\/i> \u2014 RADIUS server port, testing321 <\/i> \u2014 RADIUS client password (which we specified in the config).<\/p>\n
The result of this command will be output similar to the following:<\/p>\n
Sending Access-Request of id 44 to 127.0.0.1 port 1812\n        User-Name = \"username\"\n        User-Password = \"100110\"\n        NAS-IP-Address = 127.0.1.1\n        NAS-Port = 1812\n        Message-Authenticator = 0x00000000000000000000000000000000\nrad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=44, length=20<\/code><\/pre>\n
\nNow we need to ensure that the user has successfully authenticated. For this, we will check the log of multiotp:<\/p>\n
tail \/var\/log\/multiotp\/multiotp.log<\/code><\/pre>\n
\nAnd if the last entry there is:<\/p>\n
2016-09-01 08:58:17     notice  username  User    OK: User username successfully logged in from 127.0.0.1\n2016-09-01 08:58:17     debug           Debug   Debug: 0 OK: Token accepted from 127.0.0.1<\/code><\/pre>\n
\nThen everything went smoothly, and we can proceed with<\/p>\n
Step 5. Configuring Cisco ASA<\/b>
\nLet\u2019s assume we already have a configured group and policies for access via SSL VPN, set up in conjunction with Active Directory, and we need to add two-factor authentication for this profile.<\/p>\n
1.<\/strong> Adding a new group servers<\/a> AAA:<\/p>\n
\"Go
\n2.<\/strong> Adding our multiOTP server to the group:<\/p>\n
\"Go
\n3.<\/strong> Editing the connection profile<\/b>, setting the primary authentication server to be the Active Directory server group:<\/p>\n
\"Go
\n4.<\/strong> On the tab Advanced -> Authentication<\/b> also select the Active Directory server group:<\/p>\n
\"Go
\n5.<\/strong> On the tab Advanced -> Secondary<\/b> authentication select the created server group that includes the multiOTP server. Note that the Session username is inherited from the primary AAA server group:<\/p>\n
\"Go
\nApply the settings and<\/p>\n
Step 6, which is also the last step<\/b>
\nCheck whether two-factor authentication works for our SSL VPN:<\/p>\n
\"Go
\nVoila! When connecting via the Cisco AnyConnect VPN Client, a second one-time password will also be requested.<\/p>\n
I hope this article will help someone, and that it will provide food for thought on how to use this free<\/b> OTP server for other tasks. Share in the comments if you would like.
\n
Source: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u041f\u043e\u0442\u0440\u0435\u0431\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u0435 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u0432\u0441\u0435 \u0447\u0430\u0449\u0435 \u0438 \u0447\u0430\u0449\u0435, \u043d\u0435 \u0432\u0430\u0436\u043d\u043e, \u0431\u0443\u0434\u044c \u0442\u043e \u0441\u0432\u043e\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u043b\u0438 \u043f\u0430\u0440\u0442\u043d\u0435\u0440\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0442\u043e\u043c\u0443 \u0438\u043b\u0438 \u0438\u043d\u043e\u043c\u0443 \u0441\u0435\u0440\u0432\u0435\u0440\u0443 \u0432 \u0432\u0430\u0448\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438. \u0414\u043b\u044f \u044d\u0442\u0438\u0445 \u0446\u0435\u043b\u0435\u0439, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044e VPN, \u0437\u0430\u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u0432\u0448\u0443\u044e \u0441\u0435\u0431\u044f, \u043a\u0430\u043a \u043d\u0430\u0434\u0435\u0436\u043d\u043e \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438. \u041c\u043e\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043d\u0435 \u0441\u0442\u0430\u043b\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27626,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-36872","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Go to 2FA (Two-Factor Authentication for ASA SSL VPN) | ProHoster","description":"The need to provide remote access to the corporate environment is becoming more frequent, whether it is for our users or partners who need access to certain servers in your organization.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/go-to-2fa-dvuhfaktornaya-autentifikatsiya-dlya-asa-ssl-vpn","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Go to 2FA (\u0414\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0430\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0434\u043b\u044f ASA SSL VPN) | ProHoster","og:description":"\u041f\u043e\u0442\u0440\u0435\u0431\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u0435 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u0432\u0441\u0435 \u0447\u0430\u0449\u0435 \u0438 \u0447\u0430\u0449\u0435, \u043d\u0435 \u0432\u0430\u0436\u043d\u043e, \u0431\u0443\u0434\u044c \u0442\u043e \u0441\u0432\u043e\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u043b\u0438 \u043f\u0430\u0440\u0442\u043d\u0435\u0440\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0442\u043e\u043c\u0443 \u0438\u043b\u0438 \u0438\u043d\u043e\u043c\u0443 \u0441\u0435\u0440\u0432\u0435\u0440\u0443 \u0432 \u0432\u0430\u0448\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438..","og:url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/go-to-2fa-dvuhfaktornaya-autentifikatsiya-dlya-asa-ssl-vpn","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:14:26+00:00","article:modified_time":"2019-10-31T19:14:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36872","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:05:56","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:37:23","updated":"2026-02-09 17:05:56","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/36872","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=36872"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/36872\/revisions"}],"predecessor-version":[{"id":158589,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/36872\/revisions\/158589"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/27626"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=36872"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=36872"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=36872"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}