F5 Privileged User Access with Ephermal Authentication

Key Concepts:

• Privileged User Access (PUA)
• Ephemeral Authentication
• Common Access Card (CAC) / Smart Card Authentication
• APM (Access Policy Manager)
• LDAP (Lightweight Directory Access Protocol)
• Web SSH
• UDF (User Defined Function) Deployment
• Playbook (Configuration Automation)
• Data Groups
• iRules
• Proxy Virtual Servers (VIPs)

1. Introduction to the APM Solution

• The video introduces an APM solution that combines privileged user access (PUA) with ephemeral authentication.
• This solution aims to protect sensitive network endpoints and provide a centralized SSH access point for system administrators using smart card-based authentication (Common Access Card).
• The solution can be easily deployed using a parameterized solution customizable to specific environments.

2. Topology and Components

• Customer Network Environment: Includes a device to manage, an administrator with smart card access, LDAP authorization, and a Big IP 171 with APM enabled.
• Admin User Workflow: The admin user requests the APM webtop using their smart card.
• Authentication Process:
  • Big IP validates the smart card.
  • Authenticates the UPN (User Principal Name) against the LDAP server.
  • On successful authentication, an ephemeral password is configured in LDAP for that user.
• Web SSH Connection: The user initiates a web SSH connection via the webtop link to the network device.
• Device Validation: The device checks against LDAP to validate the ephemeral password.
• Session Establishment: A web SSH session is established.
• UDF Deployment: The demo leverages a UDF deployment to emulate the customer environment.
• UDF Components:
  • LDAP server
  • Big IP (network device under management)
  • Big IP 171 (with APM enabled)
  • Windows client PC
• Big IP 171 Configuration: Has the default configuration other than basic network connectivity.

3. PO Application and Playbook Deployment

• PO Application: A containerized application with both an API and a GUI interface.
• Playbook Concept: Leverages a playbook to deploy solution configuration that can be customized for specific environment parameters.
• Deployment Process:
  1. Click on "add deployment."
  2. Name the deployment.
  3. Specify the target Big IP on which to deploy.
  4. Select the PUA smart card-based playbook.
  5. Specify characteristics specific to the environment (using a pre-filled form for convenience).
• Deployment Tracking: Progress can be tracked via console logs.
• Deployment Steps (as shown in the logs):
  • Data groups are deployed.
  • iRule workspaces are deployed.
  • The APM policy is deployed.
  • Proxy VIPs are created.
• Deployment Time: The deployment completes in approximately 27 seconds.

4. Demonstration and Validation

• Client Access: Accessing the webtop from the client machine.
• Certificate Selection: Selecting the appropriate user certificate sent by the smart card system.
• Successful Authentication: Validating the certificate leads to an SSH session using the new ephemeral password.
• Invalid Certificate Test: Attempting to use an invalid certificate results in session rejection.

5. Technical Terms and Concepts

• Privileged User Access (PUA): Managing and controlling access for users with elevated privileges.
• Ephemeral Authentication: Using temporary, short-lived credentials for authentication.
• Common Access Card (CAC) / Smart Card Authentication: Authentication using a physical smart card.
• APM (Access Policy Manager): F5's module for managing access policies and authentication.
• LDAP (Lightweight Directory Access Protocol): A directory service protocol used for authentication and authorization.
• Web SSH: Accessing a server's command line interface through a web browser.
• UDF (User Defined Function) Deployment: Deploying a pre-configured environment for testing or demonstration.
• Playbook: A configuration automation script used to deploy and configure the solution.
• Data Groups: Collections of data used in iRules for decision-making.
• iRules: F5's scripting language for customizing traffic management behavior.
• Proxy Virtual Servers (VIPs): Virtual IP addresses that act as a proxy for backend servers.

6. Logical Connections

• The video logically connects the need for secure privileged access with the proposed APM solution.
• It demonstrates how smart card authentication and ephemeral passwords enhance security.
• The UDF deployment and playbook automation simplify the deployment process.
• The demonstration validates the solution's functionality by showing both successful and failed authentication attempts.

7. Synthesis/Conclusion

The video showcases an APM solution that enhances security for privileged user access by combining smart card authentication with ephemeral passwords. The solution is designed to protect sensitive network endpoints and provide a centralized SSH access point. The use of a UDF deployment and playbook automation simplifies the deployment process, making it easier to implement in various environments. The demonstration effectively validates the solution's functionality and security.