- [Instructor] Hi, I'm Matt from Duo Security.
In this video, I'm going to show you
how to install and configure the Duo Certificate Proxy
to deploy certificates using
Active Directory Domain Services and Group Policies.
I will also show you how to configure
a Trusted Endpoints Policy to ensure that
only corporate-owned devices managed by your organization
are allowed to access your most sensitive
browser applications that use the Duo Prompt.
Be sure to read the documentation for
this trusted endpoint set up located at
Duo.com/docs/trusted-endpoints-adds
before starting the installation process.
In order to install the
Duo Certificate Proxy for Active Directory,
you will need to make sure you have
the necessary prerequisites in place.
You need an Active Directory domain account
that is a member of both the Enterprise Admins
and the Domain Admins groups.
You also need a Windows server 2012 R2 machine
joined to your Active Directory domain.
We recommend that the Windows server 2012 system
have two 2-gigahertz processors, 8 gigabytes of RAM,
and 100 gigabytes of disk space.
In addition, you need a single network adapter
with TCP 443 outbound internet access.
Ensure that your server has all Windows updates,
.NET Framework 4.5.2 or later,
and the Windows 10 Universal C Runtime installed.
After making sure you have the necessary prerequisites,
create the Active Directory Domain Services
Management Integration in the Duo Admin Panel.
Open a browser and log in to the Duo Admin Panel.
In the left sidebar, click Trusted Endpoints Configuration.
If this is your first trusted endpoints configuration,
you will see an informational screen.
Click Configure Management Tools Integration.
Under Active Directory Domain Services,
click Select this Integration.
Next, prepare your server for
deployment of the certificate proxy.
If your server is running a local firewall,
you need to open TCP ports 135 and 1024
through 65535 for DCOM and RPC inbound access
for your domain computers to the Duo Certificate Proxy.
Log in to your Windows server.
To permit access to these ports in the Windows Firewall,
open Windows Firewall with Advanced Security.
Right click Inbound Rules and click New Rule.
On the Rule Type page, select Custom.
Click next.
On the program page, set the rule to all programs.
Click Next.
On the Protocol and Ports page,
set the Protocol Type to TCP.
In the dropdown for Local Port, select RPC Dynamic Ports.
In the Remote Port dropdown, select Specific Ports.
In the field below, enter 135 comma space 1024-65535.
Click Next.
On the Scope page, leave both
Which local IP addresses does this rule to apply to?
and Which remote IP addresses does this rule apply to?
set to Any IP Address.
Click Next.
On the Action page,
select Allow the connection and click Next.
On the Profile page, select only the Domain network option,
and then click Next.
On the name page, enter a name to identify the rule.
For example, Duo RPC/DCOM.
Click Finish.
Verify that your new Duo rule is enabled.
After preparing your server,
install and configure the certificate proxy.
Log on to the server as a domain user
who is a member of both the Domain Admins
and Enterprise Admins groups.
If you were added to either of those groups
during your current log on session,
then you need to log out and back in
for your new privileges to take effect.
Log in to the Duo Admin Panel.
Navigate to the Active Directory Domain Services
integration page you created earlier.
Click the link to download
the Duo Certificate Proxy installer.
Launch the installer and follow the prompts.
Leave the Launch Duo Certificate Proxy Wizard option
checked on the final screen of the installer.
Click Finish.
The Duo Certificate Proxy Wizard will open.
Click Next.
The wizard will verify that you are
an AD enterprise and domain admin.
Copy the secret key from your integration page
and paste it in the wizard.
Click next.
Specify the AD group or groups containing the users
who will receive the Duo certificate.
We recommend targeting a group of
test users during initial configuration.
You can return to the Duo Certificate Proxy
Configuration Wizard later to add groups
after verifying certificate enrollment
and trusted endpoint reporting and access for a test group.
Either click the select button and type in
all or part of AD domain group,
or type in the full name of the AD target group
directly into the Configuration Wizard
and click Validate to check the group name against AD.
To specify more than one group,
separate the group names with a comma.
Do not input spaces before or after commas.
Click Next.
Pick the trust configuration method.
If no public key infrastructure (or PKI) exists
in your environment such as
Active Directory Certificate Services,
select the first option,
Install Duo root certificate as untrusted.
If your organization does have an existing PKI,
select the Trust the Duo root option.
Do not choose the Manual setup of Duo root option
without first contacting Duo Support.
For this example, we will select the first option.
Click Next.
Double-check your selected
domain groups and trust configuration.
If everything looks correct, click Confirm.
Click Exit.
You have completed the initial
Duo Certificate Proxy configuration.
Now configure your Group Policy Object (or GPO)
for Duo certificate deployment and browser configuration.
On your domain controller or another system with
the Windows Remote Server Administration Tools installed,
log in to the Duo Admin Panel and
navigate to your Active Directory
Domain Services Management Tools integration.
Then launch the Group Policy Management Console, or GPMC.
In the Group Policy Management Console,
expand your forest and navigate
down the tree to Group Policy Objects.
Right-click the Group Policy Objects Folder and click New.
Enter a name for the new GPO like
Duo Certificate Policy and click OK.
Right click the new GPO you created and click Edit.
To enable automatic retrieval of
the Duo device certificate by domain clients,
navigate to User Configuration, Policies,
Windows Settings, Security Settings, Public Key Policies.
Double-click Certificate Services Client - Auto-Enrollment
in the right pane of the policy editor.
On the Enrollment Policy Configuration settings tab,
set the Configuration Model to Enabled,
and check both the Renew expired certificates,
update pending certificates,
and remove revoked certificates and
Update certificates that use certificate templates options.
Then click OK.
To enable automatic selection of the
Duo certificate by Internet Explorer on client endpoints,
navigate to User Configuration,
Preferences, Windows Settings, Registry.
On the Duo Admin Panel page for
your ADDS management tools integration,
click the Internet Explorer Configuration download link
in the Configure Your Group Policy Object
section of the page to obtain
the Internet Explorer configuration XML file.
Save this file in a location accessible from the GPMC.
Open that location in Windows Explorer.
From the Explorer window,
copy the downloaded Internet Explorer XML file,
NOT the file contents,
and paste it under the registry pane
on the right side of the GPO editor window.
When asked if you are sure you want to
import the pasted document, click Yes.
These registry values allow Internet Explorer
to automatically select the Duo device certificate
when requested by the Duo browser prompt.
If you do not push these
registry settings to your Windows clients,
then Internet Explorer prompts users to
manually select the Duo certificate during authentication.
If Windows clients also use the Google Chrome browser
when accessing Duo-protected applications,
you should configure automatic certificate selection
for Chrome in the GPO as well.
Back in the Duo Admin Panel,
click the Chrome Configuration download link
to obtain the Chrome configuration XML file.
Again, save this file in a location
accessible from the GPMC.
Then copy the Chrome XML file, NOT the file contents,
from the Windows Explorer window,
and paste it into the top-level Registry pane
on the right of the GPO Editor window.
Confirm import of the pasted document by clicking Yes.
This registry value lets Chrome automatically select
the Duo device certificate when requested by
the Duo browser prompt without prompting the user
interactively to select the certificate.
When you have finished configuring all settings,
close the Group Policy Editor window.
Now apply the Duo GPO.
Click the Delegations tab of
your new Duo Certificate GPO and then click
the Advanced button in the lower-right corner.
On the Security tab, click the Add... button.
Enter Domain Computers in the Select Users, Computers,
Service Accounts, or Groups dialogue, and click OK.
In the Group or user names list,
click on the Domain Computers group.
In the Permissions for Domain Computers area
in the bottom half of the security settings window,
check the boxes for Read and
Apply group policy in the Allow column.
Click OK.
The default GPO security filtering applies the new policy
to all domain authenticated users.
Restrict this new GPO so that it applies to
only members of the domain group or groups
you specified during Duo Certificate Proxy configuration.
Click the Scope tab of the new Duo certificate GPO.
In the Security Filtering section,
click Authenticated Users to select it,
and then click Remove.
Next, click the Add button under Security Filtering.
Select the same domain groups you selected on
the Select AD Group page of the
Duo Certificate Proxy configuration wizard and click OK.
Those groups are added the Security Filtering list
alongside the Domain Computers group.
Finally, link the policy.
Right-click on your domain in the left side of the GPMC
and select Link an Existing GPO…
Select the new Duo certificate GPO
in the list of Group Policy Objects, and click OK.
Confirm that the Duo Certificate Proxy is working
by manually applying the Duo GPO settings on an endpoint.
Log on to a domain-joined client PC as a member of
the pilot group specified during
the Duo Certificate Proxy group selection
and in the Duo certificate GPO scope.
Open a browser and navigate to the documentation page
located at duo.com/docs/trusted-endpoints-adds.
In the left sidebar, click the anchor link
to skip down to the Verify Your Setup section.
There are commands in this section that you will
need to copy and paste into a command prompt.
Open a command prompt window and run
the gpupdate /force command provided
in step 2 of this section of the documentation.
After the policy update completes,
run the gpresult /v command
from step 3 of the documentation.
In the output, under Applied Group Policy Objects,
look for your new Duo GPO.
If the Duo certificate enrollment GPO
was successfully applied,
check that the Duo certificate was
successfully obtained via the Duo Certificate Proxy server.
In the same command prompt window where you ran gpresult,
run the Certificate Manager Tool using
the command provided in step 4 of the documentation.
Expand Certificates - Current User, Personal, Certificates.
Look for the Duo Device Authentication
certificate in the list.
Finally, verify the Chrome and Internet Explorer
Registry changes from the GPO.
In your command prompt window,
run the registry query commands provided in
step 6 of the documentation to check for
the new Internet Explorer and Chrome settings.
Confirm that the output of your query
contains the two items highlighted
in the screenshot in the documentation.
You have successfully configured the Duo Certificate Proxy
and deployment of the Duo Trusted Endpoints Certificate!
Once your domain users' computers apply
the new certificate GPO settings
and receive the Duo certificate,
you can configure the Trusted Endpoints policy
to start checking for the certificate as users
authenticate to Duo-protected services and applications.
Please read the documentation located at
duo.com/docs/trusted-endpoints
before watching this section of the video.
You will need to have a test group of users
and select a browser-based application
to use with your Trusted Endpoints policy.
Log in to the Duo Admin Panel as an administrator
with the Owner or Administrator admin role.
Navigate to the properties page for
the application you want to use Trusted Endpoints with.
Click the Apply a policy to a group of users button.
Then click Or, create a new Policy.
The policy editor launches.
Enter a name for the policy at the top of the left column,
such as Trusted Endpoints.
Then in the left menu under Devices,
click Trusted Endpoints.
Select the radio button for Block endpoints
that do not have a Duo certificate.
Click the Create Policy button to save your settings
and return to the Apply a Policy prompt
with your new policy selected.
In the Groups field, select the group of users
you want to apply the policy to.
Click the Apply Policy button.
You will see your applied policy on your properties page.
Now, when a user with an endpoint
that lacks a Duo certificate
attempts to access this application,
they will not be allowed access.
A prompt will appear indicating that they are being blocked
due to their use of a personal device.
You have successfully configured the Duo Certificate Proxy,
deployment of the Duo Trusted Endpoints Certificate,
and a Trusted Endpoints Policy.
For more infomation >> How cruel .pls share this video..it will help someone - Duration: 2:19. 
For more infomation >> How to Get SOLID Headstands, Handstands, & Forearm Stands 💪🏼😜 - Duration: 9:03. 
Không có nhận xét nào:
Đăng nhận xét