-
Notifications
You must be signed in to change notification settings - Fork 8
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'main' into mar24-release-notes
- Loading branch information
Showing
12 changed files
with
212 additions
and
19 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,114 @@ | ||
| --8<-- "References/abbreviations.md" | ||
|
|
||
| # Local TLS Configuration with RPC-Go | ||
|
|
||
| !!! warning "Local TLS Configuration using RPC-Go is a Preview Feature" | ||
| Local TLS Configuration using RPC-Go is a Preview Feature and is subject to change. This means it has not been fully validated and cannot be guaranteed to work. There are still potential bugs and tweaks needed for a production-level feature standard. Interested in this feature and helping us test it? Reach out via GitHub. | ||
|
|
||
| The TLS protocol includes the following types of authentication: | ||
|
|
||
| - Server Authentication – Only the server is authenticated (i.e., its identity is ensured) while the client remains unauthenticated. This means that the end user (whether an individual or an application, such as a Web browser) can be sure with whom they are communicating. | ||
|
|
||
| - Mutual Authentication – The next level of security in which both ends of the “conversation” are sure with whom they are communicating. | ||
|
|
||
| When Intel AMT is configured for mutual authentication, it validates incoming client certificates based on the root of trust configured. | ||
|
|
||
| ## Overview | ||
|
|
||
| AMT can be configured to use TLS without the need for a remote server (i.e. RPS). RPC-Go can directly communicate with Enterprise Assistant to perform the configuration. | ||
|
|
||
| The following steps highlight how to: | ||
|
|
||
| - Configure the connection of EA and RPC-Go | ||
| - Run TLS configuration using RPC-Go | ||
|
|
||
| ## Prerequisites | ||
|
|
||
| The following are requirements to configure and connect an AMT device using TLS. | ||
|
|
||
| - [Enterprise Assistant](overview.md) | ||
| - [RPC-Go](../../GetStarted/buildRPC.md) | ||
| - Management Tool supporting TLS (ex: [Meshcommander](https://www.meshcommander.com/meshcommander)) | ||
|
|
||
| This is not required for configuration and therefore not needed for this guide. However, a management tool will be needed if you want to manage the device post-configuration. | ||
|
|
||
| ### Services | ||
|
|
||
| The following services are assumed to be configured and running in your enterprise environment. | ||
|
|
||
| - Microsoft* Certificate Authority (CA) | ||
| - An AMT TLS Certificate template is required. See [TLS Certificate Template](tlsCertTemplate.md) for additional steps on creating a template. | ||
|
|
||
| - Microsoft* Active Directory (AD) | ||
|
|
||
| ## Configure Enterprise Assistant | ||
|
|
||
| 1. Run the Enterprise Assistant executable. | ||
|
|
||
| 2. Open the `File > Settings` menu to configure the RPC-Go connection. | ||
|
|
||
| <figure class="figure-image"> | ||
| <img src="..\..\..\assets\images\EA_SettingsEmpty.png" alt="Figure 1: Enterprise Assistant Settings Menu"> | ||
| <figcaption>Figure 1: Enterprise Assistant Settings Menu</figcaption> | ||
| </figure> | ||
|
|
||
| 3. Under **RPC Client** section, set a **Username** of your choice. | ||
|
|
||
| 4. Set a **Password** of your choice. | ||
|
|
||
| 5. Set an alpha-numeric **Security Key** of your choice. This key is used when generating JWT tokens for authentication between RPC-Go and EA communication. | ||
|
|
||
| 6. The `Device Name` is the name used to configure the domain controller for each device account. Using `Node Identifier` is more secure due to the inability to be tampered with but is less friendly to maintain as a user. | ||
|
|
||
| 7. `Security Groups` will list all of the security groups of the domain controller that have been created within the Computers group. When Enterprise Assistant creates a new Computer account (like a new AMT device), it will join the selected Security Groups. | ||
|
|
||
| 8. Provide the Certificate Authority and click the checkmark. | ||
|
|
||
| 9. It will then list the available Certificate Templates to choose from. This will let you select a template specifically created for AMT. See [TLS Certificate Template](tlsCertTemplate.md) for additional steps on creating a template. | ||
|
|
||
| 10. Choose how to issue the certificate. Typically, `SAM Account Name` is most commonly used as the `Common Name`. | ||
|
|
||
| !!! example "Example - Configured Settings" | ||
| <figure class="figure-image"> | ||
| <img src="..\..\..\assets\images\EA_RPCSettingsFull.png" alt="Figure 2: Enterprise Assistant RPC-Go Settings Example"> | ||
| <figcaption>Figure 2: Enterprise Assistant RPC-Go Settings Example</figcaption> | ||
| </figure> | ||
|
|
||
| 11. Press **OK** to save the Settings. | ||
|
|
||
| !!! success "Success - HTTP Server Started" | ||
| <figure class="figure-image"> | ||
| <img width=400px src="..\..\..\assets\images\EA_RPCHTTPStart.png" alt="Figure 3: HTTP Server Started Example"> | ||
| <figcaption>Figure 3: HTTP Server Started Example</figcaption> | ||
| </figure> | ||
|
|
||
| ## Configure the AMT Device | ||
|
|
||
| 1. Open Command Prompt as Administrator. | ||
|
|
||
| 2. Navigate to the directory with RPC-Go. | ||
|
|
||
| 3. Run the `rpc configure tls` command. Replace the [bracketed] values with your own. | ||
|
|
||
| ``` | ||
| rpc configure tls -mode [configurationMode] -password [AMTPassword] -eaAddress [IP-Address-or-FQDN] -eaUsername [myUsername] -eaPassword [myPassword] | ||
| ``` | ||
| The toolkit offers four configuration modes to support various usage models: | ||
| | CONFIGURATION MODE | DESCRIPTION | | ||
| | :---------------------| :----------------------------------------------------------------------------------------------------- | | ||
| | Server | The client authenticates the server request and accepts only those servers with a digital certificate. | | ||
| | ServerAndNonTLS | **Used primarily for testing.** The client authenticates the server request and accepts legitimate digital certificates from TLS-enabled servers. However, if the server is not TLS-enabled, the client defaults to a CIRA connection.| | ||
| | Mutual | Both client and server **must** have certs. The client cert is signed by the server cert. | | ||
| | MutualAndNonTLS | **Used primarily for testing.** Both client and server certs are expected. The client authenticates the server request and accepts legitimate digital certificates from TLS-enabled servers. However, if the server is not TLS-enabled, the client defaults to a CIRA connection. | | ||
| !!! success "Success - TLS Configured" | ||
| <figure class="figure-image"> | ||
| <img src="..\..\..\assets\images\RPC_EALocalTLSSuccess.png" alt="Figure 4: TLS Configured Example"> | ||
| <figcaption>Figure 4: TLS Configured Example</figcaption> | ||
| </figure> | ||
| 4. Now, the device is manageable via a TLS connection using the management tool of your choice! | ||
| <br><br> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| --8<-- "References/abbreviations.md" | ||
|
|
||
| This template is used by EA to request certificates on behalf of your AMT devices. These certificates will be installed into the AMT device firmware and used for traffic authentication. | ||
|
|
||
| ## Create AMT TLS Certificate Template | ||
|
|
||
| 1. On your Enterprise Subordinate CA server, open the Start menu. | ||
|
|
||
| 2. Choose Run, then enter `certtmpl.msc`. | ||
|
|
||
| 3. Right-click the certificate template named **Web Server** and choose **Duplicate**. | ||
|
|
||
| 4. Name the new template **AMT TLS Certificate**. | ||
|
|
||
| 5. Navigate to the **Request Handling** tab, and check the box labeled **Allow private key to be exported**. | ||
|
|
||
| 6. Navigate to the **Subject Name** tab, and ensure that the radio button **Supply in the request** is selected. | ||
|
|
||
| 7. Click **OK** to save the template. | ||
|
|
||
| ## Enable the Template | ||
|
|
||
| 1. On the Enterprise Subordinate CA server, run the **Certification Authority** tool. | ||
|
|
||
| 2. Navigate to the **Certificate Templates** folder on the left pane. | ||
|
|
||
| 3. Right-click the **Certificate Templates** folder and choose **New** -> **Certificate Template to Issue**. | ||
|
|
||
| 4. Choose the **AMT TLS Certificate** template. | ||
|
|
||
| 5. Click **OK**. | ||
|
|
||
|
|
||
| ## Select the Template in Enterprise Assistant | ||
|
|
||
| When configuring the Settings menu of Enterprise Assistant, choose the **AMT TLS Certificate** from the **TLS Template** drop down menu under **Certificate Authority**. | ||
|
|
||
| !!! example "Example - Configured TLS Template in Settings" | ||
| <figure class="figure-image"> | ||
| <img src="..\..\..\assets\images\EA_RPCSettings_TLSTemplate.png" alt="Figure 1: Enterprise Assistant Settings Example"> | ||
| <figcaption>Figure 1: Enterprise Assistant Settings Example</figcaption> | ||
| </figure> |
Oops, something went wrong.