How to implement two factor authentication with Windows Server 2008 NPS

Increasingly, whether due to regulatory requirements or a basic recognition that static passwords just don't provide adequate security, organisations are implementing some form of strong authentication. Like all new efforts, before you start you want to be reasonably assured that you will succeed.

In this tutorial we will document how to add two-factor authentication to various Microsoft remote access solutions through the Windows Server 2008 Network Policy Server. For two-factor authentication, we will be using the WiKID Strong Authentication Server - Enterprise Edition. WiKID is a dual-sourced, software-based two-factor authentication system. While the document is product specific, the process is typically the same no matter the products.

Assume that you have a mixed OS environment with some Windows, some Linux/Unix. You have a new requirement for two-factor authentication to meet PCI requirements. You intend to protect all key systems, which are mostly linux and you are going to lock down your remote desktop with two-factor authentication too (though we will only discuss the SSH here). The plan is to create an SSH gateway server that is locked down with two-factor authentication. Admins can then jump from the gateway box to other servers using public key authentication.

SSH offers a highly secure channel for remote administration of servers. However, since you face an audit for PCI, you have become aware of some potential authentication related short-comings that may cause headaches in an audit. For example:

• There is no way to control which users have public key authorisation
• There is no way to enforce passphrase complexity (or even be sure that one is being used)
• There is no way to expire a public key

Additionally, your intention is to add two-factor authentication to other services, such as RDP and a VPN. There is great benefit in having a single two-factor authentication service for all those services and SSH keys will not work for other services.

An overview

After everything is configured, the system will work like this: The user generates a one-time passcode from their WiKID software token. They enter it into the SSH password field. The credentials are passed from the SSH gateway to NPS via radius. NPS validates that the user is active in AD and in the proper group. If so, it sends the username and one-time password to the WiKID Strong Authentication Server still using Radius. If the OTP is valid, the WiKID server responds to the NPS, which in turn responds to the SSH gateway server and the user is granted access.

Note that this process is only for authentication, session management is still handled by the SSH gateway or any other remote access service you are using.

First we will enable Windows Server 2008 Network Policy Server (NPS)

Add the "Network Policy and Access Services" role to your domain controller.

Enable these role services during installation:

• Network Policy Server
• Routing & Remote Access Services
• Remote Access Service
• Routing

Next we add a new RADIUS Client - The SSH Gateway in this case.

From Administrative Tools select Network Policy Server.

Right click on Radius Clients and Select New.

Add a name, the IP address of your remote access server (RAS, VPN, etc) and create a shared secret. You will enter the same shared secret on the WiKID server.

Click OK.