Admin best practises + Yubikey

Kais_1

im a bit of a noob to pfsense...and i wanted to know what are the best things that i should do to secure the admin account and pfsense.

i have a yubikey to hand and wanted to know if this can be used in any way?

thanks in advance

Kais

Gertjan

@Kais_1 said in Admin best practises + Yubikey:

secure the admin account and pfsense.

Combine these tow methods : chose a good password and use LAN only for trusted devices - all other local users should be on a OPTx network that doesn't even allow GUI access (let the firewall protect itself).

Kais_1

tks for the info..

any ideas how to implement the yubikey?

Gertjan

@Kais_1 said in Admin best practises + Yubikey:

any ideas how to implement the yubikey?

noop. This Yubikey isn't known to pfSense. Check the manual ^^

But : this guy has all the knows answers and possibilities, as usual.

stephenw10

You might check out the user management hangout: https://youtu.be/5rj5ER_2xJE

I'm not aware of any specific way to use a Yubikey directly but you might be able to do something via an external radius server.

Steve

nzkiwi68

Yuibkey definitely supports anything via an external radius server, you could use that for 100% certain.

For your yubikeys, run an external RADIUS server;
FreeRADIUS on any Unix (external to pfSense) and and get the PAM (Pluggable Authentication Module)
https://developers.yubico.com/yubico-pam/YubiKey_and_FreeRADIUS_1FA_via_PAM.html
I've had good success with GreenRADIUS - paid software
https://www.greenrocketsecurity.com/greenradius/

On pfSense, setup an external radius server pointing to your external radius server;
System / User Manager / Authentication Servers / Edit
Make a new authentication server using the RADIUS server

Job done!

stephenw10

Ooo nice.