It seems like your browser didn't download the required fonts. Please revise your security settings and try again.
Barracuda CloudGen Firewall

How to Configure Multi-Factor Authentication Using YubiKey

  • Last updated on

Some network environments require higher security levels to authenticate users when they access specific high-risk resources. YubiKey offers an effective method to additionally protect your company network from unwanted access. The tool, when enrolled and configured, adds an additional layer of authentication and works as part of an MFA process, based on a security token. All your end users have to do in order to access a resource is enter their self-configured pin during the authentication process and then touch the YubiKey inserted into their device.

yubi_manager_03.png

Before You Begin

Before implementing YubiKey in your network, consider the following steps:

  • Determine the users / user groups who should receive a YubiKey for authentication.

  • Distribute YubiKeys to the intended user group.

Download and install YubiKey Manager. You can manage certificates via YubiKey Manager > PIV and import them into the Firewall Control Center.

  1. Download YubiKey Manager: Go to https://www.yubico.com/support/download/yubikey-manager and select the applicable version under Downloads.

  2. Install YubiKey Manager on your operating system.

    yubi_manager_01.png

Set Up a YubiKey Certificate

  1. Launch YubiKey Manager on your desktop.

  2. Click Applications and select PIV.

    yubi_certs.png

  3. Select Configure Certificates.

  4. Select Key Management, and click Generate to create the certificate.

  5. Select Self-signed certificate.

  6. Adjust the settings according to your requirements and click Generate.

  7. Define a management key, or select Use default, and enter your PIN.

    yubi_mkey.png

  8. Generate the certificate.

You can now import this certificate on your Barracuda CloudGen Firewall.

Install the YubiKey Certificate on the Firewall

Import the YubiKey certificate on the Barracuda CloudGen Firewall using Barracuda Firewall Admin.

  1. Go to CONFIGURATION > Configuration Tree > Box > Administrative Settings.

  2. From the Configuration Mode menu, select Switch to Advanced View.

  3. In the left navigation pane, click Advanced System Access.

  4. Click Lock.

  5. Next to Root Public RSA, click Ex/Import.

  6. Select Import from Microsoft Certificate Management.

  7. The Certificate Selector window opens.

  8. From the Current Store drop-down list, select MY.

    yubi_import.png

  9. Locate your YubiKey certificate in the list and select the entry.

  10. Click Select Certificate to import the certificate.

  11. Click Send Changes and Activate.

Your users can now enroll themselves for authentication with their YubiKeys.

Enroll YubiKey in Your Network

Configure YubiKey on the end user devices.

The Security Key setup process is determined by the service provider, so setup instructions will vary slightly from service to service.

  1. Log into the My Sign-Ins portal: https://mysignins.microsoft.com/security-info

  2. Select + Add sign-in method.

  3. From drop down, select Security key.

    yubi_setup.png

  4. Click Add.

  5. As Security key type, select USB device.

  6. You will be prompted to have your key ready, click Next. You will be redirected to a new window to complete setup.

  7. Beneath the QR code that appears, select Use a different device.

  8. When prompted to Create a passkey, select USB security key.

  9. Plug in your YubiKey and then touch the logo circle.

  10. Set up a new PIN. A PIN may be as simple as a 4-digit numeric value. Choose a strong and memorable value that includes both letters and digits. The PIN should be distinct, and should not be a password that is reused on any site or service.

  11. When prompted, touch the logo circle on your YubiKey again to complete the request.

  12. When prompted with Allow this site to see your security key?, select Allow.

  13. When prompted to Set up a security key, sign in with two-factor authentication, select Next.

  14. Choose USB device at the next prompt.

  15. You will be asked to name your security key.

  16. After setting your name, you can now close the window. You will now see your security key listed underneath Security info.

sec_info.png

To authenticate using YubiKey, go to the security settings of a supported service and select two-factor authentication. When prompted, insert the YubiKey into a port on your device and touch it.

To configure FIDO2, OTP, and PIV on your YubiKey, use the YubiKey Manager. For more information, see https://www.yubico.com/support/download/yubikey-manager/