Secure baseboard management controller (BMC) login by implementing multifactor authentication (MFA)

Introduction

In today's world, securing your system from a malicious attack is a key customer requirement. Using a real-time authentication method along with user credentials gains the customer's trust for a secured login process. The multifactor authentication (MFA) mechanism is one such solution to provide an extra layer of protection by verifying users using the time-based one-time password (TOTP) login method.

MFA increases security because even if one credential becomes compromised, unauthorized users will be unable to meet the second authentication requirement and will not be able to access the targeted physical space, computing device, network, or database.

This tutorial provides information on BMC supported authenticators and guides users to set up MFA on BMC using both, GUI and Redfish API. Also, it explains how to bypass MFA for a specific user and clear the secret key for the user.

Prerequisites for MFA setup and TOTP login

Make sure that the following prerequisites are fulfilled before setting up MFA and to log in using TOTP:

• Install a security application (for example, Google Authenticator, Microsoft Authenticator, and so on) on trusted devices.
• Verify that the baseboard management controller (BMC) system's time is properly synchronized with a reliable Network Time Protocol (NTP) server or an equivalent time source. If the time on the BMC system is incorrect or out of sync, it may cause the TOTP to fail, resulting in login issues.
• Ensure that the authenticator app (such as Google Authenticator, Microsoft Authenticator, and so on) on the user's device is set to the correct time zone and has access to network time updates.
• Generated time-based one-time password (TOTP) must be used during MFA setup and sign-in process and it is valid for current session.
• Users must provide a one-time passcode in addition to the traditional password for every login.

MFA supported users

The following table lists the user types and privilege provided for each user type to set up MFA.

Set up MFA and TOTP Login

Perform the following steps to set up MFA and TOTP login using the BMC GUI.

Step 1. Enable MFA TOTP authentication as an admin user

1. Sign in to the BMC GUI with your login credentials.
2. In the navigation panel, click Security and access and then open the User management page.
3. Set MFA TOTP authentication to Enabled.
4. After enabling, a pop-up notification indicating that MFA is successfully enabled is displayed and all the existing sessions that are associated with that user gets logged out immediately.

Step 2. Log in as a MFA user for the first time

1. Log in to the BMC using the username and password of the MFA-enabled user.
2. Notice that the BMC displays a QR code and a shared secret with the TOTP field.
3. Scan the QR code by using the Google Authenticator app that generates a TOTP setup on the user's mobile device.
4. Enter the TOTP code in the TOTP field that is generated by the Google Authenticator app.
5. Click Log In to complete the MFA set up.
6. For subsequent log in attempts, as a MFA user, use a TOTP along with username and password.

Set up MFA bypass for users

By default, the MFA Bypass option is disabled. In case, a user prefers not to use MFA, then enable MFA Bypass for that specific user. From the next login attempt, the specific user need not provide TOTP for BMC login.

1. Enable MFA bypass for the selected user using the BMC GUI.
2. Notice that the user is able to log in without a TOTP from the next login.

Clear a user's MFA secret key

In case the user lost the device that is containing the security key setup, then there is a provision to clear the user’s MFA secret key using the BMC GUI.

Note: Admins cannot clear their own secret key, and can perform the task only for other users.

1. Log in to the BMC GUI with an admin account that has the necessary privileges to manage MFA settings for other users.
2. Click Clear to reset the MFA secret key for the selected user.
3. Ensure the secret key is cleared for the user. Success pop message is created, and clear button will be greyed out after this operation. Note: After the secret key is cleared, the user must complete the MFA setup process during their next login attempt with a new generated secret key.

Configure MFA TOTP authentication for BMC using API

Perform the following steps to configure MFA TOTP authentication for BMC using Redfish API:

Note: User must provide BMC IP and BMC token to implement MFA setup using the Redfish API.

1. Get the BMC supported authenticators.

   curl -k -H "X-Auth-Token: <token>" -X GET https://<BMC_IP>/redfish/v1/AccountService/
   

2. Configure MFA TOTP authentication.

   curl -k -H "X-Auth-Token: <token>" -H "Content-Type: application/json" -X PATCH -d '{"MultiFactorAuth":{"GoogleAuthenticator":{"Enabled":true}}}' https://<BMC_IP>/redfish/v1/AccountService
   

3. Generate a shared secret key.

   curl -k -H "X-Auth-Token: <token>" -H "Content-Type: application/json" -X POST https://<BMC_IP>/redfish/v1/AccountService/Accounts/<username> /Actions/ManagerAccount.GenerateSecretKey
   

4. Verify TOTP.

   curl -k -H "X-Auth-Token: <token>" -H "Content-Type: application/json" -X POST https://<BMC_IP>/redfish/v1/AccountService/Accounts/<username>  /Actions/ManagerAccount.VerifyTimeBasedOneTimePassword
   -d '{"TimeBasedOneTimePassword":<TOTP>}'
   

5. Login with the TOTP.

   curl --insecure -X POST -D headers.txt  -H "Content-Type: application/json" https://<BMC_IP>/redfish/v1/SessionService/Sessions
   -d '{"UserName":<username>, Password":<password>, "Token": <TOTP>}'
   

Conclusion

By following the steps covered in this tutorial, users can now enable BMC with the MFA mechanism providing a crucial security measure which ensure that even if a password is compromised, any unauthorized access can still be prevented.