General Information on Certificate-Based Authentication in Empirum

As an alternative to log-in with user name and password, the Advanced Agent can also perform a certificate-based authentication. Specific infrastructure and configuration settings are required to be able to use this authentication method.

Authentication via client certificates provides a higher degree of security.

• Each computer has an individual client certificate for access to the Empirum depot server. In case this certificate is not valid anymore or has been withdrawn from the computer, access is denied accordingly. Individual certificates can be withdrawn centrally.
• Optionally, no valid user and password information is stored on the computers. Although this information is always encrypted by Empirum, it may provide a potential attack vector.
• In case the password has been changed and computers have received information updates too late, they are not “suspended, since configuration is done centrally on the server components.

On the other hand, the higher degree of security also implies a higher degree of infrastructure complexity. The following requirements must be met to be able to use certificate-based authentication:

• The computers must receive a certificate and certificate renewal must be regulated and controlled accordingly, for instance, based on the Microsoft Active Directory Certificate Services (PKI). Alternatively, it is possible to use other PKI environments, but as of to date, Matrix42 only tests and describes the Microsoft AD PKI.
• Communications are done via the https protocol and Microsoft IIS.
• IIS must be configured for certificate-based authentication accordingly. Depending on the settings, it may also accept user name and password (“Accept” option for client certificates is selected), based on hybrid operations, or accept certificates only (“Required” option for client certificates is selected). This must be accounted for in case of a migration.
• During IIS configuration, a so-called “one-to-many” connection is established between the trusted certificates (related to the issuer) and a user. This user is equal to a user accessing the depot server (e.g., the user used in the USER_1 variable) and can read in the Empirum directories and write log/inventory data.
• As of to date, operating system installation is always done, based on the user name and password. In most cases, SMB is used as protocol. Certificate-based authentication is only possible if the Advanced Agent is installed. The certificate must be installed on the computer (AD join and GPO) when this installation is performed.

Important Information for the Switch or Hybrid Operations

When an existing infrastructure and the Agent are switched to certificate-based authentication, it is important to note the following:

• If the “Required” option has been selected for client certificates in the SSL settings of IIS, no Advanced Agent can establish a connection with user name and password. Hybrid operations via https are excluded. Protocol fail-over to SMB or an alternative server is still possible.
• If the “Accept” option has been selected for the SSL settings of IIS, the Advanced Agent version 16.1.3 or higher can establish a connection either via certificate or via user name and password.
• Attention: Older versions of the Advanced Agent cannot establish connection to IIS in this mode. Protocol fail-over to SMB or an alternative server is still possible.
• If the Advanced Agent has been configured for certificate-based authentication, the system attempts to log-in with user name and password in case authentication via certificate has failed. If this log-in attempt also fails, the server is deemed unavailable and, if configured accordingly, a protocol or server fail-over is performed.
• If the Advanced Agent has been configured for authentication via certificate only, log-in with user name and password cannot be performed and it is not possible to perform a protocol fail-over to SMB. No valid log-in information in the Agent template or the computer.ini file is available.

Infrastructure Configuration

The following configuration steps must be performed or respective requirements must be met to be able to use certificate-based authentication:

• PKI infrastructure
• Install and configure the Microsoft Active Directory Certificate Services (PKI).
• Create an operating system configuration (template).
• Distribute the certificate, based on the group policy.
• Details can be found in knowledge base article.
• Details on how to deploy certificates on a Mac see this knowledge base article.
• Install IIS on the Empirum server (optional) and the depots with the Web Service Configuration package
• Configure the required settings in the SUBDEPOT variables. Empirum Webservice Configuration Package
• Configure the Agent Template for certificate-based authentication.