{"id":46284,"date":"2020-11-03T09:00:05","date_gmt":"2020-11-03T08:00:05","guid":{"rendered":"https:\/\/nolabnoparty.com\/?p=46284"},"modified":"2020-11-02T14:39:14","modified_gmt":"2020-11-02T13:39:14","slug":"vmware-uag-two-factor-authentication-configuration","status":"publish","type":"post","link":"https:\/\/nolabnoparty.com\/en\/vmware-uag-two-factor-authentication-configuration\/","title":{"rendered":"VMware UAG: Two-Factor Authentication configuration"},"content":{"rendered":"<p><img decoding=\"async\" class=\"aligncenter wp-image-46567 size-full\" title=\"vmware-uag-two-factor-authentication-01\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/11\/vmware-uag-two-factor-authentication-01.jpg\" alt=\"vmware-uag-two-factor-authentication-01\" width=\"602\" height=\"202\" \/><\/p>\n<p>To add an<strong> extra layer of security<\/strong> to <a href=\"https:\/\/nolabnoparty.com\/en\/vmware-horizon-7-deploy-unified-access-gateway\/\">VMware UAG<\/a> appliance, the authentication process can be enforced using a Two-Factor Authentication procedure with solutions such as <strong>Duo Authentication Proxy<\/strong>.<\/p>\n<p>If the\u00a0UAG\u00a0appliance is installed in your\u00a0<a href=\"https:\/\/nolabnoparty.com\/en\/configure-vmware-horizon-7-to-access-physical-machines\/\">VMware Horizon<\/a> infrastructure, the Two-Factor Authentication makes the connection more secure <strong>avoiding unauthorized accesses<\/strong>. Duo is Cisco's user-friendly, scalable access security platform that can be configured in the UAG appliance providing a <strong>second source\u00a0of validation<\/strong>.<!--more--><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-46569 size-large\" title=\"vmware-uag-two-factor-authentication-02\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/11\/vmware-uag-two-factor-authentication-02-600x224.jpg\" alt=\"vmware-uag-two-factor-authentication-02\" width=\"600\" height=\"224\" \/><\/p>\n<p>&nbsp;<\/p>\n<h2>System requirements<\/h2>\n<p>DUO Authentication Proxy can be installed on the <strong>following supported OSs<\/strong>:<\/p>\n<ul>\n<li>Windows Server 2012 or later (Server 2016 or 2019 recommended)<\/li>\n<li>CentOS 7 or later<\/li>\n<li>Red Hat Enterprise Linux 7 or later<\/li>\n<li>Ubuntu 16.04 or later<\/li>\n<li>Debian 7 or later<\/li>\n<\/ul>\n<p>The minimum <strong>system requirements<\/strong> are the following:<\/p>\n<ul>\n<li>Form Factor: physical or virtual machine<\/li>\n<li>Processor: 1 processor<\/li>\n<li>Memory: 4 GB RAM<\/li>\n<li>Disk: 200 MB or greater<\/li>\n<\/ul>\n<p>The Authentication Proxy communicates with Duo's service on <strong>TCP port 443<\/strong>. Make sure to open <strong>firewall ports<\/strong> accordingly.<\/p>\n<p>The <strong>Duo Mobile app<\/strong> must be installed on your mobile device (<a href=\"https:\/\/play.google.com\/store\/apps\/details?id=com.duosecurity.duomobile&amp;hl=en\" target=\"_blank\" rel=\"noopener noreferrer\">Android<\/a> or <a href=\"https:\/\/apps.apple.com\/us\/app\/duo-mobile\/id422663827\" target=\"_blank\" rel=\"noopener noreferrer\">Apple<\/a>) to manage push notifications.<\/p>\n<p>&nbsp;<\/p>\n<h2>Install DUO for Two-Factor Authentication<\/h2>\n<p>DUO can be installed on both <strong>Windows or Linux OSs<\/strong> and the procedure is pretty straightforward.\u00a0To <strong>save Windows licenses<\/strong>, the Duo MFA can be easily installed on a supported Linux distributions.<\/p>\n<p>&nbsp;<\/p>\n<h4>Deploy CentOS OS<\/h4>\n<p>Download the minimal installation of <a href=\"https:\/\/www.centos.org\/download\/\" target=\"_blank\" rel=\"noopener noreferrer\">CentOS 7<\/a> and deploy the VM on your <strong>LAN<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-46573 size-large\" title=\"vmware-uag-two-factor-authentication-03\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/11\/vmware-uag-two-factor-authentication-03-600x395.jpg\" alt=\"vmware-uag-two-factor-authentication-03\" width=\"600\" height=\"395\" \/><\/p>\n<p>&nbsp;<\/p>\n<h4>Install DUO Authentication Proxy<\/h4>\n<p>SSH the CentOS 7 VM and run the following command from the console to install the <strong>needed packages<\/strong>:<\/p>\n<p><span style=\"color: #0000ff;\"># yum install gcc make libffi-devel perl zlib-devel wget<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-46579 size-large\" title=\"vmware-uag-two-factor-authentication-04\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/11\/vmware-uag-two-factor-authentication-04-600x361.jpg\" alt=\"vmware-uag-two-factor-authentication-04\" width=\"600\" height=\"361\" \/><\/p>\n<p>Download the Authentication Proxy module using the <em>wget<\/em> command.<\/p>\n<p><span style=\"color: #0000ff;\"># wget https:\/\/dl.duosecurity.com\/duoauthproxy-latest-src.tgz<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-46581 size-large\" title=\"vmware-uag-two-factor-authentication-05\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/11\/vmware-uag-two-factor-authentication-05-600x241.jpg\" alt=\"vmware-uag-two-factor-authentication-05\" width=\"600\" height=\"241\" \/><\/p>\n<p>Extract the files from the downloaded file .TGZ and run the <strong>build process<\/strong>.<\/p>\n<p><span style=\"color: #0000ff;\"># tar xzf duoauthproxy-latest-src.tgz<\/span><br \/>\n<span style=\"color: #0000ff;\"># cd duoauthproxy-<em>version<\/em>-src<\/span><br \/>\n<span style=\"color: #0000ff;\"># make<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-46583 size-large\" title=\"vmware-uag-two-factor-authentication-06\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/11\/vmware-uag-two-factor-authentication-06-600x248.jpg\" alt=\"vmware-uag-two-factor-authentication-06\" width=\"600\" height=\"248\" \/><\/p>\n<p>When the build process has completed successfully, run the <em>install<\/em> command to <strong>install the application<\/strong>.<\/p>\n<p><span style=\"color: #0000ff;\"># cd duoauthproxy-build<\/span><br \/>\n<span style=\"color: #0000ff;\"># .\/install<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-46585 size-large\" title=\"vmware-uag-two-factor-authentication-07\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/11\/vmware-uag-two-factor-authentication-07-600x436.jpg\" alt=\"vmware-uag-two-factor-authentication-07\" width=\"600\" height=\"436\" \/><\/p>\n<p>Note that the Duo Authentication Proxy's <strong>configuration file<\/strong> is stored in the directory <em>\/opt\/duoauthproxy\/conf\/authproxy.cfg<\/em>.<\/p>\n<p>&nbsp;<\/p>\n<h4>Retrieve Duo parameters<\/h4>\n<p>After registering the account in Duo, select the <strong>software to protect<\/strong> (VMware View) from the available applications list.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-46587 size-large\" title=\"vmware-uag-two-factor-authentication-08\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/11\/vmware-uag-two-factor-authentication-08-600x431.jpg\" alt=\"vmware-uag-two-factor-authentication-08\" width=\"600\" height=\"431\" \/><\/p>\n<p>Access the application area and <strong>write down the parameters<\/strong> reported in the <strong>Details<\/strong> area needed to configure Duo:<\/p>\n<ul>\n<li>Integration key<\/li>\n<li>Secret key<\/li>\n<li>API hostname<\/li>\n<\/ul>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-46589 size-large\" title=\"vmware-uag-two-factor-authentication-09\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/11\/vmware-uag-two-factor-authentication-09-600x395.jpg\" alt=\"vmware-uag-two-factor-authentication-09\" width=\"600\" height=\"395\" \/><\/p>\n<p>&nbsp;<\/p>\n<h4>Configure the push authentication<\/h4>\n<p>Duo provides different authentication methods you can configure. The <strong>push notification<\/strong> for example allows the application to send a push notification directly to the <strong>user's mobile\u00a0device<\/strong>.<\/p>\n<p>To configure the push notification, you need to <strong>edit the Duo's configuration file<\/strong> and configure it as follow:<\/p>\n<p><span style=\"color: #0000ff;\"># vi \/opt\/duoauthproxy\/conf\/authproxy.cfg<\/span><\/p>\n<p>[ad_client]<br \/>\nhost=xx.xx.xx.xx\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 (IP Domain Controller 1)<br \/>\nhost_2=xx.xx.xx.xx\u00a0 \u00a0 \u00a0(IP Domain Controller 2)<br \/>\nservice_account_username=<em>duoservice<\/em><br \/>\nservice_account_password=<em>password<\/em><br \/>\nsearch_dn=DC=<em>domain<\/em>,DC=<em>com<\/em><\/p>\n<p>[radius_server_auto]<br \/>\nikey=<em>xxxxxxxxxxxxxxxxxxxx<\/em><br \/>\nskey=<em>xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx<\/em><br \/>\napi_host=api-<em>xxxxxxxx<\/em>.duosecurity.com<br \/>\nradius_ip_1=192.168.95.101\u00a0 \u00a0 \u00a0 (UAG1 IP address)<br \/>\nradius_ip_2=192.168.95.102\u00a0 \u00a0 \u00a0(UAG2 IP address)<br \/>\nradius_secret_1=<em>xxxxxxxxxxxxxxxxxxxx<\/em>\u00a0 \u00a0 \u00a0(configure secret also in UAG)<br \/>\nfailmode=secure<br \/>\nclient=ad_client<br \/>\nport=1812<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-46591 size-large\" title=\"vmware-uag-two-factor-authentication-10\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/11\/vmware-uag-two-factor-authentication-10-600x502.jpg\" alt=\"vmware-uag-two-factor-authentication-10\" width=\"600\" height=\"502\" \/><\/p>\n<p>Save the file and <strong>restart the service<\/strong>.<\/p>\n<p><span style=\"color: #0000ff;\"># \/opt\/duoauthproxy\/bin\/authproxyctl restart<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-46593 size-large\" title=\"vmware-uag-two-factor-authentication-11\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/11\/vmware-uag-two-factor-authentication-11-600x400.jpg\" alt=\"vmware-uag-two-factor-authentication-11\" width=\"600\" height=\"400\" \/><\/p>\n<p>&nbsp;<\/p>\n<h2>Configure UAG<\/h2>\n<p>Once the DUO Authentication Proxy has been configured successfully, the UAG must be configured accordingly.<\/p>\n<p>Using your preferred browser, type the addess <span style=\"color: #0000ff;\">https:\/\/&lt;IP_UAG&gt;:9443<\/span>, enter the <strong>admin credentials<\/strong> and click <strong>Login<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-46595 size-full\" title=\"vmware-uag-two-factor-authentication-12\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/11\/vmware-uag-two-factor-authentication-12.jpg\" alt=\"vmware-uag-two-factor-authentication-12\" width=\"450\" height=\"500\" \/><\/p>\n<p>Click <strong>Select<\/strong> under <strong>Configure Manually<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-46613 size-large\" title=\"vmware-uag-two-factor-authentication-13\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/11\/vmware-uag-two-factor-authentication-13-600x424.jpg\" alt=\"vmware-uag-two-factor-authentication-13\" width=\"600\" height=\"424\" \/><\/p>\n<p>&nbsp;<\/p>\n<h4>Configure RADIUS<\/h4>\n<p>To take benfit of Duo Two-Factor Authentication, you need to access the <strong>Authentication section<\/strong> in UAG and configure <strong>RADIUS<\/strong> as protocol.<\/p>\n<p>To set the RADIUS protocol enable the <strong>Authentication Settings<\/strong> switch.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-46615 size-large\" title=\"vmware-uag-two-factor-authentication-14\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/11\/vmware-uag-two-factor-authentication-14-600x320.jpg\" alt=\"vmware-uag-two-factor-authentication-14\" width=\"600\" height=\"320\" \/><\/p>\n<p>Click on the <strong>RADIUS Settings icon<\/strong> to configure the protocol.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-46617 size-large\" title=\"vmware-uag-two-factor-authentication-15\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/11\/vmware-uag-two-factor-authentication-15-600x391.jpg\" alt=\"vmware-uag-two-factor-authentication-15\" width=\"600\" height=\"391\" \/><\/p>\n<p>Click on <strong>Enable RADIUS<\/strong> switch.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-46619 size-large\" title=\"vmware-uag-two-factor-authentication-16\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/11\/vmware-uag-two-factor-authentication-16-600x138.jpg\" alt=\"vmware-uag-two-factor-authentication-16\" width=\"600\" height=\"138\" \/><\/p>\n<p>Configure the required parameters and click <strong>Save<\/strong>. The <strong>Shared Secret<\/strong> must be the same as configured in Duo Authentication Proxy.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-46621 size-large\" title=\"vmware-uag-two-factor-authentication-17\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/11\/vmware-uag-two-factor-authentication-17-600x398.jpg\" alt=\"vmware-uag-two-factor-authentication-17\" width=\"600\" height=\"398\" \/><\/p>\n<p>&nbsp;<\/p>\n<h4>Enable RADIUS authentication in UAG<\/h4>\n<p>Once the protocol has been enabled, RADIUS must be configured in the Horizon's settings. Click <strong>Edge Service Settings<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-46623 size-large\" title=\"vmware-uag-two-factor-authentication-18\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/11\/vmware-uag-two-factor-authentication-18-600x355.jpg\" alt=\"vmware-uag-two-factor-authentication-18\" width=\"600\" height=\"355\" \/><\/p>\n<p>Click the <strong>Horizon Settings<\/strong> icon.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-46625 size-large\" title=\"vmware-uag-two-factor-authentication-19\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/11\/vmware-uag-two-factor-authentication-19-600x308.jpg\" alt=\"vmware-uag-two-factor-authentication-19\" width=\"600\" height=\"308\" \/><\/p>\n<p>From the <strong>Auth Methods<\/strong> drop-down menu select <strong>RADIUS<\/strong> and click <strong>Save<\/strong>. You need to click the <strong>More<\/strong> link to display additional settings.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-46627 size-large\" title=\"vmware-uag-two-factor-authentication-20\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/11\/vmware-uag-two-factor-authentication-20-600x342.jpg\" alt=\"vmware-uag-two-factor-authentication-20\" width=\"600\" height=\"342\" \/><\/p>\n<p>You need also to enable the these settings to <strong>avoid entering the credentials twice<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-46629 size-full\" title=\"vmware-uag-two-factor-authentication-21\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/11\/vmware-uag-two-factor-authentication-21.jpg\" alt=\"vmware-uag-two-factor-authentication-21\" width=\"600\" height=\"414\" \/><\/p>\n<p>&nbsp;<\/p>\n<h2>Test authentication<\/h2>\n<p>Open your preferred browser (for https access) and type the URL to access your Horizon infrastructure. Enter the credentials of an entitled user and click <strong>Login<\/strong>. Credentials are verified and authenticated against Active Directory.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-46632 size-full\" title=\"vmware-uag-two-factor-authentication-22\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/11\/vmware-uag-two-factor-authentication-22.jpg\" alt=\"vmware-uag-two-factor-authentication-22\" width=\"442\" height=\"562\" \/><\/p>\n<p>Once the account has been validated in AD, a push request is then sent to the user's mobile. Click <strong>Approve<\/strong> to login.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-46635 size-full\" title=\"vmware-uag-two-factor-authentication-23\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/11\/vmware-uag-two-factor-authentication-23.jpg\" alt=\"vmware-uag-two-factor-authentication-23\" width=\"302\" height=\"433\" \/><\/p>\n<p>When the authorization has been given via Duo, the access to Horizon is granted.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-46637 size-large\" title=\"vmware-uag-two-factor-authentication-24\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2020\/11\/vmware-uag-two-factor-authentication-24-600x421.jpg\" alt=\"vmware-uag-two-factor-authentication-24\" width=\"600\" height=\"421\" \/><\/p>\n<p>UAG is now configured with Two-Factor Authentication making the access to your infrastructure <strong>more secure<\/strong>.<\/p>\n<p><img decoding=\"async\" title=\"signature\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/images\/firma.jpg\" alt=\"signature\" \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>To add an extra layer of security to VMware UAG appliance, the authentication process can be enforced using a Two-Factor Authentication procedure with solutions such as Duo Authentication Proxy. If the\u00a0UAG\u00a0appliance is installed in your\u00a0VMware Horizon infrastructure, the Two-Factor Authentication makes the connection more secure avoiding unauthorized accesses. Duo is Cisco's user-friendly, scalable access security platform that can be configured in the UAG appliance providing a second source\u00a0of validation.<\/p>\n","protected":false},"author":3,"featured_media":46567,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rop_custom_images_group":[],"rop_custom_messages_group":[],"rop_publish_now":"initial","rop_publish_now_accounts":{"linkedin_93tdZWzMZc_93tdZWzMZc":"","facebook_2879994398731222_17841400390232720":"","twitter_113568041_113568041":"","mastodon_115463926174894442_115463926174894442":""},"rop_publish_now_history":[],"rop_publish_now_status":"pending","footnotes":""},"categories":[903,1025],"tags":[2266,2265,576,2250],"class_list":["post-46284","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-vmware-en","category-horizon-en","tag-duo","tag-mfa","tag-radius-en","tag-uag","has_thumb"],"_links":{"self":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/46284","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/comments?post=46284"}],"version-history":[{"count":0,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/46284\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media\/46567"}],"wp:attachment":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media?parent=46284"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/categories?post=46284"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/tags?post=46284"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}