12-18-2023 12:23 PM
Hi:
My company will convert the devices to MFA (Multi Factor Authentication) soon.
My question is how to make NSO use MFA to the device?
I searched the src/ncs/yang and found that in tailf-ncs-devices.yang there is
container devices {
container authgroups {
list group {
grouping remote-user-remote-auth {
leaf callback-node {...}
leaf action-name {...}
}
}
}
}
will that help to have NSO to use MFA to the device?
I need some example java code how to use callback-node and action-name.
Does any one have experience?
THX
sm000x
Solved! Go to Solution.
01-12-2024 07:39 AM
Hello,
while introducing MFA for users to log into devices makes sense to me. It would be good to understand the security benefit for introducing MFA to enhance the security of 2 software systems communicating via an NBI, NSO and device in this case.
How would the different factors look like in this case? Just to make it concrete, say NSO starts to login to a device, soon after an email user receives an email with a unique URL. NSO has to log into the mail server retrieve the URL and access it before the device enables the connection. Did we really gain much in security? We now have 2 different passwords that NSO needs to know, but I think the risk of compomise is likely to be correlated. I think that's why we don't hear about MFA much for machine to machine communication.
If you decide to implement such a scheme I think those callback in the authgroup might be able to do it. They would return the password (first factor) but leave a process in the background that takes care of the other factor.
There are other ways to enhance the security of the authentication between NSO and device you can look at including having unique randomly generated password per device, and changing them frequently for the userid that NSO employs toward the device. The callback actions can also be used for NSO to retrieve credentials externally - so storing any secrets in a centralised store that is carefully managed. I created an example of that with terraform vault.
https://gitlab.com/nso-developer/nso-secrets-in-vault/
01-12-2024 12:55 PM
01-14-2024 04:41 AM
I can confirm that this is exactly the case why callback-node was created and you can find the examples in the dev guides that you saw abocve.. I would not call what you described as MFA but rather an external vault or password storage as you are not providing any second piece of evidence.
01-14-2024 08:36 AM
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide