<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Georgia;
panose-1:2 4 5 2 5 4 5 2 3 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I was wondering if the following should/could work and if anyone has any experience setting it up. I spend some hours on it but haven’t managed to get it to work so far…<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I have a windows terminal server/remote desktop services gateway, which is a MS product for proxying RDP over a tunneled connection using TLS.<o:p></o:p></p>
<p class="MsoNormal">This is built on top of IIS/NPS. NPS is used for the authentication part.<o:p></o:p></p>
<p class="MsoNormal">Functionality wise, RDS GW provides exactly what I want, allowing a tunneled RDP connection over 443 to resources I define on the GW server per user/group.<o:p></o:p></p>
<p class="MsoNormal">The user will have to provide a username and password to create the tunnel to the RDS GW, however by default it uses local authentication (active directory). It’s possible to configure NPS to forward it’s authentication requests to a RADIUS
server, so I figured if I do that I can use some other form of authentication for creating the tunnel like some form of OTP. Whether it be RSA, TOTP, HOTP or Yubikey and possibly other things I haven’t thought of.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">However once I do this, in my RADIUS server I receive the following error once I try to authenticate. I figurd I’d test out LSA first, and once I have that working I’d work on getting OTP’s working<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Mon Jul 10 03:36:41 2017: DEBUG: Packet dump:<o:p></o:p></p>
<p class="MsoNormal">*** Received from 172.16.0.3 port 55428 ....<o:p></o:p></p>
<p class="MsoNormal">Code: Access-Request<o:p></o:p></p>
<p class="MsoNormal">Identifier: 2<o:p></o:p></p>
<p class="MsoNormal">Authentic: <212><215><195><163><28><225><128><240><145>U[<219><239>BdV<o:p></o:p></p>
<p class="MsoNormal">Attributes:<o:p></o:p></p>
<p class="MsoNormal"> Service-Type = Voice<o:p></o:p></p>
<p class="MsoNormal"> User-Name = "domain\username"<o:p></o:p></p>
<p class="MsoNormal"> Called-Station-Id = "UserAuthType:PW"<o:p></o:p></p>
<p class="MsoNormal"> MS-Machine-Name = "hostname.something"<o:p></o:p></p>
<p class="MsoNormal"> MS-Network-Access-Server-Type = Terminal-Server-Gateway<o:p></o:p></p>
<p class="MsoNormal"> NAS-Port-Type = Virtual<o:p></o:p></p>
<p class="MsoNormal"> Proxy-State = <254><128><0><0><0><0><0><0><228><28>lj<193>l@<170><0><0><0><2><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Mon Jul 10 03:36:41 2017: DEBUG: Handling request with Handler 'Client-Identifier = From_NPS', Identifier 'Default'<o:p></o:p></p>
<p class="MsoNormal">Mon Jul 10 03:36:41 2017: DEBUG: Deleting session for domain\username, 172.16.0.3,
<o:p></o:p></p>
<p class="MsoNormal">Mon Jul 10 03:36:41 2017: DEBUG: Handling with Radius::AuthLSA:
<o:p></o:p></p>
<p class="MsoNormal">Mon Jul 10 03:36:41 2017: DEBUG: AuthBy LSA result: REJECT, Authentication protocol Unknown not allowed by AuthenProto configuration parameter<o:p></o:p></p>
<p class="MsoNormal">Mon Jul 10 03:36:41 2017: INFO: Access rejected for domain\username: Authentication protocol Unknown not allowed by AuthenProto configuration parameter<o:p></o:p></p>
<p class="MsoNormal">Mon Jul 10 03:36:41 2017: DEBUG: Packet dump:<o:p></o:p></p>
<p class="MsoNormal">*** Sending to 172.16.0.3 port 55428 ....<o:p></o:p></p>
<p class="MsoNormal">Code: Access-Reject<o:p></o:p></p>
<p class="MsoNormal">Identifier: 2<o:p></o:p></p>
<p class="MsoNormal">Authentic: <168><196>1<151><190>*<174><132><177>*l<209>\NT~<o:p></o:p></p>
<p class="MsoNormal">Attributes:<o:p></o:p></p>
<p class="MsoNormal"> Reply-Message = "Request Denied"<o:p></o:p></p>
<p class="MsoNormal"> Proxy-State = <254><128><0><0><0><0><0><0><228><28>lj<193>l@<170><0><0><0><2><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I tried the following handler for LSA auth:<o:p></o:p></p>
<p class="MsoNormal"><Handler Client-Identifier = From_NPS><o:p></o:p></p>
<p class="MsoNormal"> Identifier Default<o:p></o:p></p>
<p class="MsoNormal"> <AuthBy LSA><o:p></o:p></p>
<p class="MsoNormal"> Domain domainname<o:p></o:p></p>
<p class="MsoNormal"> UsernameMatchesWithoutRealm<o:p></o:p></p>
<p class="MsoNormal"> </AuthBy><o:p></o:p></p>
<p class="MsoNormal"> AuthLog Logfile_Dev<o:p></o:p></p>
<p class="MsoNormal"> AcctLogFileName %L/Dev_detail_%Y-%m-%d.log<o:p></o:p></p>
<p class="MsoNormal"></Handler><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Any pointers would be appreciated. <o:p></o:p></p>
<p class="MsoNormal">It should be possible, since for example this guide shows how to do it with WikiD
<a href="http://www.techworld.com/tutorial/security/configuring-nps-2012-for-two-factor-authentication-3223170/">
http://www.techworld.com/tutorial/security/configuring-nps-2012-for-two-factor-authentication-3223170/</a>.<o:p></o:p></p>
<p class="MsoNormal">But I rather use 1 product instead of various products to achieve the same result..<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We do actually have Azure MFA which can be used for this, but I actually don’t want to use it for this scenario.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Georgia",serif;color:#4472C4">Kind regards,<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Georgia",serif;color:#4472C4"><o:p> </o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Georgia",serif;color:#4472C4">Stephan Schwarz<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Georgia",serif;color:#4472C4">Senior Security Administrator | Leiden University Medical Center<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Georgia",serif;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><a href="http://www.linkedin.com/pub/stephan-schwarz/23/911/695"><span style="font-size:10.0pt;font-family:"Georgia",serif;color:blue;text-decoration:none"><img border="0" width="24" height="24" style="width:.25in;height:.25in" id="Picture_x0020_2" src="cid:image001.png@01D2FCD5.9479F5A0" alt="social-linkedin-box-blue-icon"></span></a><span style="font-size:10.0pt;font-family:"Georgia",serif;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Georgia",serif;color:black">Tel.: +31 (0)71-526-1822<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Georgia",serif;color:black">Email:
</span><u><span style="font-size:10.0pt;font-family:"Georgia",serif;color:blue"><a href="mailto:s.schwarz@lumc.nl"><span style="font-family:"Times New Roman",serif;color:blue">s.schwarz@lumc.nl</span></a></span></u><span style="font-size:10.0pt;font-family:"Georgia",serif;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>