Seed portal: Difference between revisions

From SecuTech Wiki
Jump to navigationJump to search
← Older editNewer edit →

Mapril (talk | contribs)

0 edits
Mapril (talk | contribs)
0 edits
No edit summary
Mapril (talk | contribs)
0 edits
No edit summary
Line 7: Line 7:


The UniOTP Seed portal located here: https://esecutech.com/customers/uniotp/index.php is used to download, convert and troubleshoot OTP secret key files and tokens.
The UniOTP Seed portal located here: https://esecutech.com/customers/uniotp/index.php is used to download, convert and troubleshoot OTP secret key files and tokens.
The "Upload tokens" tab and "Choose File" operation does not upload the secret key files anywhere, it only loads them onto the browser of the local machine.


The features are:
The features are:
Line 20: Line 22:
When a new token has been purchased from SecuTech, a link is provided, eg. https://esecutech.com/customers/uniotp/index.php?1234
When a new token has been purchased from SecuTech, a link is provided, eg. https://esecutech.com/customers/uniotp/index.php?1234


When this page is visited, it will request an email address to confirm that the link user is the purchaser. Note that this link will expire after 7 days, and after downloading the tokens have been downloaded, the link can be force expired. Please contact SecuTech to re-enable the link.
When this page is visited, it will request the purchasers email address to confirm that the link user is the purchaser. This link will expire after 7 days or after downloading the tokens, the link can be force expired. IP addresses that repeatedly attempt to visit possible links will be blacklisted. Please email sales (at) esecutech.com for assistance or to re-enable the link if more then 7 days is needed.
 
 
 
 




Line 32: Line 38:


<div class="mw-collapsible mw-collapsed">
<div class="mw-collapsible mw-collapsed">
CSV in base 16/Hex, commonly used by custom solutions
CSV in base 16/Hex: commonly used by custom solutions
<div class="mw-collapsible-content">
<div class="mw-collapsible-content">
*DUO format CSV: This format is a secret key container type used by DUO security: https://duo.com/
*DUO format CSV: This format is a secret key container type used by DUO security: https://duo.com/
Line 43: Line 49:


<div class="mw-collapsible mw-collapsed">
<div class="mw-collapsible mw-collapsed">
CSV in base 32, Duo security and Google authenticator use this format
CSV in base 32: Duo security and Google authenticator
<div class="mw-collapsible-content">
<div class="mw-collapsible-content">
*Generic format CSV: This format is a nice format for viewing with Excel and can be used by a custom solution easily
*Generic format CSV: This format is a nice format for viewing with Excel and can be used by a custom solution easily
Line 52: Line 58:


<div class="mw-collapsible mw-collapsed">
<div class="mw-collapsible mw-collapsed">
XML in base 64, most commonly supported seed file format, eg. RCDev
XML in base 64: most commonly supported seed file format, eg. RCDev http://www.rcdevs.com/products/openotp/
<div class="mw-collapsible-content">
<div class="mw-collapsible-content">
*Encrypted export is not supported by the Seed portal yet.
*Encrypted export is not supported by the Seed portal yet.
Line 61: Line 67:


<div class="mw-collapsible mw-collapsed">
<div class="mw-collapsible mw-collapsed">
UINF, SecuTech's proprietary seed format.
UINF: SecuTech's proprietary seed format.
<div class="mw-collapsible-content">
<div class="mw-collapsible-content">
*Encrypted export is not supported by the Seed portal yet.
*Encrypted export is not supported by the Seed portal yet.
*Raw uinf file: Exports the secret key file in uinf format. Previously used by SecuTech's legacy management system, this file should be retained for future use for token trouble shooting.
*Raw uinf file: Exports the secret key file in uinf format. Previously used by SecuTech's legacy management system, please retain this file for future use for token trouble shooting.


</div>
</div>
Line 74: Line 80:


== Test and Synchronize a token ==
== Test and Synchronize a token ==
To test if a token is out of synch due to repeatedly pressing the button on the token or a time lag from the onboard clock, please use this feature.
It is possible to input 1 OTP for this operation, however a single OTP is not recommended to be used over 50 OTP's. When synchronizing over large ranges, please use 2 OTP's.


</div>
</div>
Line 79: Line 88:


== Search for a lost serial number ==
== Search for a lost serial number ==
In the event that a token's serial number is lost, for example the sticker is worn out and the token itself has been returned, it can be identified.


</div>
This process is identical to a synchronization process, however the tool will search through the defined range to find the matching OTP sequences on all seeds loaded.


Open the original uinf file (note that multiple uinf secret key files can be loaded into the tool), input 2 OTP's from the device and press search. If the token has been in use for some time and it is HOTP based, the uinf files may be out of synch to the token.


== Installation ==
As a rule of thumb, the "search range" should be approximately 3 * number of days the token has been in use. It would be unusual for users to have more uses then this.


==== Preparation ====
If thousands of tokens are used, multiple instances of the search can be run by splitting the secret key files using "Download tokens" tab, "Custom grouping".


Before implementing the UniOTP Windows Logon Agent, please verify the following requirements:
Note that this process is time consuming, a minimum of 450 sequences are tested every second (more with a fast computer). For 1000 tokens with a search range of 1000 (roughly 1 year of HOTP token usage), it can take close to 1 hour to complete. In this event we recommend splitting the file into 4 parts and opening 4 different instances of the seed portal to quarter the time taken.
* The UniOTP authentication server is already configured and running.
* The administrator has and is already using an active account for the agent on the server
* The aforementioned account has been bound to the UniOTP device used.


==== UniOTP Windows Logon Agent Installation ====
Chrome pauses javascript operations on pages that are not open, when attempting to run multiple instances, make sure that the browser tabs the seed portal instances are in, have been dragged next to each other and are visible.


1. Once the UniOTP Windows Distributable Package has been downloaded and installed, find the installation file setup.exe inside the package and double-click it to launch the installation process.
</div>
 
2. Click on Next in the InstallShield Wizard welcome screen.
 
[[Image:uniotpcp img01.jpg|500px|alt=installation wizard initial screen]]
 
3. Input your User Name and Company Name and click on Next.
 
[[Image:uniotpcp img02.jpg|500px|alt=inputting user and company name]]
 
4. Select Complete and click on Next.
 
[[Image:uniotpcp img03.jpg|500px|alt=selecting installation type]]
 
5. Click on Install to begin the installation of the PKI package. After verifying the InstallShield Wizard has completed successfully then click Finish. Once the installation completed, the User Management Tool UniOTPManager will open automatically.
 
[[Image:uniotpcp img04.jpg|500px|alt=UniOTPManager main window]]
 
6. '''Important:''' It is strongly advised that a user account is added for this machine at this point. A new user account must be created before exiting this tool.  If a functioning user account is not configured and added on the computer, users will '''not''' be able to log into the machine. '''Uninstall the UniOTP Windows Logon Agent immediately if any unresolvable errors appear in the following steps.'''
 
[[Image:uniotpcp img05.jpg|500px|alt='it is dangerous if you do not add a UniOTP account for this computer' message]]
 
7. In the UniOTPManager window, click Add to add a UniOTP account to be authenticated with on the computer.
 
[[Image:uniotpcp img06.jpg|500px|alt=adding new account]]
 
8. Under the Add Account window, in the fields:
* Account, input a valid UniOTP account name;
* Auth Server, input the IP address of the UniOTP authentication server;
* Port, input the service port of the above server (default is 1812);
* Share, input the shared key (used by the UniOTP authentication server);
* and Max Wait Time, input the number of seconds the computer should wait for the server response.
 
9. After the account has been added, and any other additional modifications made, click Apply. The Apply button must be clicked to submit and apply user information.
 
[[Image:uniotpcp img07.jpg|500px|alt=UniOTPManager new account and authentication server added]]
 
10. The dialog box below will appear if updating account information was successful.
 
[[Image:uniotpcp img08.jpg|250px|alt='update account information successfully' message]]
 
11. After successfully installing the UniOTP Windows Authentication Agent and adding a new user, performing a two-factor user logon can be done to ensure all processes are functioning correctly. Choose a user in the account list then click Test to perform an authentication test.
 
[[Image:uniotpcp img09.jpg|500px|alt=authentication test on a user account]]
 
12. Input the OTP password generated from the corresponding OTP device (If the authentication method is set to OTP+PIN, input the PIN directly after the OTP password in the same field), then click OK. If the password entered is correct, the following dialog will be displayed.
 
[[Image:uniotpcp img10.jpg|250px|alt='authenticated successfully' message]]
 
If the password entered is incorrect, the following dialog will instead be displayed.
 
[[Image:uniotpcp img11.jpg|250px|alt='authentication failed' message]]
 
13. A popup message indicating the result of the UniOTP authentication test will appear. If unsuccessful, refer to the displayed message to solve the error. '''Do not log off, switch user, lock, shutdown, reboot, or otherwise interact with Windows user credentials until successfully completing the authentication test. If an encountered error cannot be resolved, please uninstall the UniOTP Windows Logon Agent immediately.''' Failure to do so will result in the user being unable to log back into Windows. It is recommended to uninstall the UniOTP Windows Logon Agent until the error, if present, has been identified and rectified.
 
14. After verifying the two-factor authentication test has completed successful, the user account is now secured with UniOTP authentication. All user accounts identified with UniOTP require the corresponding OTP to successfully authenticate with the user account. To add additional users, repeat the above steps from step 7.
 
 
== Usage ==
 
[[Image:uniotpcp img12.jpg|750px|alt=Windows user select screen]]
 
1. In the Windows login screen, select a user to log into with.
 
[[Image:uniotpcp img13.jpg|750px|alt=Windows user login screen]]
 
2. In the password field, input the Windows password for the user account to log onto Windows.
 
3. In the UniOTP Account drop-down list, select the corresponding UniOTP account. In the OTP[PIN] password field, input the generated one-time password (if the authentication method is set to OTP+PIN, by default, input your dynamic password followed by your PIN immediately afterwards in the field. Refer to your administrator as to how OTP+PIN authentication is set up).
 
4. Press Enter or click the arrow button to authenticate.
 
If the OTP[PIN] password entered is incorrect, the following error will appear.
 
[[Image:uniotpcp img14.jpg|750px|alt='error code 13' message]]
 
If the OTP[PIN] entered is correct, but the Windows user account password is incorrect, the following error message will appear.
 
[[Image:uniotpcp img15.jpg|750px|alt='incorrect password or username' message]]
 
If authentication was successful, the Windows user account is secured with UniOTP dynamic password authentication.
 
== Important Remarks ==
 
# After installing the UniOTP Windows Authentication Agent, if none of the UniOTP user accounts pass the authentication test, uninstall the UniOTP Windows Authentication Agent '''without delay''', otherwise no user account on the computer will be able to log in.
# If authentication has failed numerous times in succession (, more than five consecutive attempts, refer to the administrator to inspect configuration settings), wait ten minutes before attempting to authenticate again. If authentication is still unsuccessful, refer to the administrator to repair your device.
# Do not modify or delete the "%SYSTEMROOT%\secuagt_cp.conf" file as this is the configuration file for the UniOTP Windows Authentication Agent. Deletion or modification of this file may result in a locked operating system.

Revision as of 15:49, 12 June 2018


Seed Portal and Token Troubleshooting Guide

Guide Version: 1.0

Introduction

The UniOTP Seed portal located here: https://esecutech.com/customers/uniotp/index.php is used to download, convert and troubleshoot OTP secret key files and tokens.

The "Upload tokens" tab and "Choose File" operation does not upload the secret key files anywhere, it only loads them onto the browser of the local machine.

The features are:

Download tokens from SecuTech

When a new token has been purchased from SecuTech, a link is provided, eg. https://esecutech.com/customers/uniotp/index.php?1234

When this page is visited, it will request the purchasers email address to confirm that the link user is the purchaser. This link will expire after 7 days or after downloading the tokens, the link can be force expired. IP addresses that repeatedly attempt to visit possible links will be blacklisted. Please email sales (at) esecutech.com for assistance or to re-enable the link if more then 7 days is needed.




Convert seed file for different platforms

The Seed portal page provides 4 file types for different platforms:


CSV in base 16/Hex: commonly used by custom solutions

  • DUO format CSV: This format is a secret key container type used by DUO security: https://duo.com/

"Token serial name" , "secret key (in hex)", "counter"

  • Generic format CSV: This format is a nice format for viewing with Excel and can be used by a custom solution easily

First line is header which provides format: "serial", "secret key (in hex)", "counter", "type (HOTP/TOTP/OCRA)", "timestamp (time last synchronized)", "digits", "authwnd (authentication window)", "timestep". Please note that the authentication window and timestep may not be needed, for example most authentication servers use a global default, and is not token specific. Timestep is provided as 60 even for HOTP tokens, as some servers have different behaviours to missing values, despite not been used.

CSV in base 32: Duo security and Google authenticator

  • Generic format CSV: This format is a nice format for viewing with Excel and can be used by a custom solution easily

First line is header which provides format: "serial", "secret key (in base32)", "counter", "type (HOTP/TOTP/OCRA)", "timestamp (time last synchronized)", "digits", "authwnd (authentication window)", "timestep". Please note that the authentication window and timestep may not be needed, for example most authentication servers use a global default, and is not token specific. Timestep is provided as 60 even for HOTP tokens, as some servers have different behaviours to missing values, despite not been used.

XML in base 64: most commonly supported seed file format, eg. RCDev http://www.rcdevs.com/products/openotp/

This format is supported by most OTP authentication servers.

UINF: SecuTech's proprietary seed format.

  • Encrypted export is not supported by the Seed portal yet.
  • Raw uinf file: Exports the secret key file in uinf format. Previously used by SecuTech's legacy management system, please retain this file for future use for token trouble shooting.


Test and Synchronize a token

To test if a token is out of synch due to repeatedly pressing the button on the token or a time lag from the onboard clock, please use this feature.

It is possible to input 1 OTP for this operation, however a single OTP is not recommended to be used over 50 OTP's. When synchronizing over large ranges, please use 2 OTP's.

Search for a lost serial number

In the event that a token's serial number is lost, for example the sticker is worn out and the token itself has been returned, it can be identified.

This process is identical to a synchronization process, however the tool will search through the defined range to find the matching OTP sequences on all seeds loaded.

Open the original uinf file (note that multiple uinf secret key files can be loaded into the tool), input 2 OTP's from the device and press search. If the token has been in use for some time and it is HOTP based, the uinf files may be out of synch to the token.

As a rule of thumb, the "search range" should be approximately 3 * number of days the token has been in use. It would be unusual for users to have more uses then this.

If thousands of tokens are used, multiple instances of the search can be run by splitting the secret key files using "Download tokens" tab, "Custom grouping".

Note that this process is time consuming, a minimum of 450 sequences are tested every second (more with a fast computer). For 1000 tokens with a search range of 1000 (roughly 1 year of HOTP token usage), it can take close to 1 hour to complete. In this event we recommend splitting the file into 4 parts and opening 4 different instances of the seed portal to quarter the time taken.

Chrome pauses javascript operations on pages that are not open, when attempting to run multiple instances, make sure that the browser tabs the seed portal instances are in, have been dragged next to each other and are visible.

Retrieved from "https://esecutech.com/wiki/index.php?title=Seed_portal&oldid=3352"