Two-Factor Authentication for SSH

Two-Factor Authentication uses smart card technology for remote device management. Two-Factor Authentication requires enhanced secure mode with Secure Shell (SSH) and X.509 V3 authorization enabled on the switch. You must provide the digital certificates to enable the identity management for the SSH client and SSH server. Two-Factor Authentication requires the following items:

• a Fabric Engine switch

• a switch

• a computer with Secure CRT 8.3.2 or 8.3.3 as the SSH client

• a smart card reader

• a Common Access Card (CAC) or Personal Identity Verification (PIV) card for each configured user

You can also use a Windows Server 2008, or newer, configured with a Remote Access Dial-In User Services (RADIUS) server and Active Directory.

Digital certificates in the X.509 V3 format provide identity management. A chain of signatures by a trusted certificate authority (CA) and its intermediate certificate CAs binds a given public signing key to a given digital identity. For user authentication, the SSH client sends the user certificate stored on the CAC or PIV card to the SSH server for verification. The SSH server validates the incoming user certificate using Public Key Infrastructure (PKI) trust-store.

After the switch validates the SSH certificate, the system parses for a username to forward to the RADIUS server for authorization. The switch prompts you to enter a password for the username. If the RADIUS server is unreachable or not configured, the authorization occurs locally on the switch for the username and password.

Two-Factor Authentication on the switch uses SSH and the X.509 V3 certificates stored on the smart card. X.509 V3 digital certificates are documented in RFC5280.

Smart Card Authentication Process

The process for PIV or CAC card authentication is as follows:

1. The PIV Authentication or the Card Authentication certificate is read from the PIV Card Application.

2. The relying system validates the PIV Authentication certificate from the PIV Card Application using standards-compliant PKI path validation to ensure that the certificate is valid and from a trusted source.

3. The cardholder is prompted to submit a PIN to activate the card.

4. The relying system issues a challenge string to the card and requests an asymmetric operation in response.

5. The card responds to the previously issued challenge by signing using the PIV Authentication private key.

6. The relying system verifies that the response from the card is expected for the issued challenge.

7. A unique identifier from the PIV Authentication certificate is extracted and passed as input to the access control decision.