Using MFA for OT/ICS Session Manager
Kron PAM’s built-in MFA can be used as an enhanced security level for the OT/ICS Session Manager, which forwards TCP traffic over an SSH tunnel. When users open the tunnel, they are asked for their Kron PAM credentials. If MFA is activated for the OT/ICS Session Manager, users are also asked for an MFA token before Kron PAM forwards traffic to the target device.
Unlike the other proxies, Kron PAM does not ask for the token at login time. The token is requested when the user connects an application through the tunnel, because the target device is not known while the tunnel is being opened. The tunnel therefore opens as usual, and Kron PAM allows or blocks each forwarded connection separately.
The token is requested only when both of the conditions below are true:
1. The user belongs to at least one user group that has OTP enabled.
2. The tcp.connection.otp.enabled parameter is set to true.
If the user is not a member of an MFA-enabled user group, or if the parameter is set to false, Kron PAM keeps the previous behavior and no token is requested.
To set up MFA for OT/ICS Session Manager connections, follow the steps below:
Admin and users must have the QR code, installed the Kron PAM Mobile Client Application, scanned the QR code with the Kron PAM Mobile Client Application, and MFA must be enabled for the user group that will be using MFA for OT/ICS Session Manager connections.The OT device must be defined with the TCP access protocol and matched with a user group in a realm. (See "OT/ICS Session Manager ConnectionOT/ICS Session Manager Configuration")
1. Log in to the Kron PAM Web GUI and navigate to Administration > Multi-factor Authentication.
2. Open the User Group Management tab, click the Option button, and select Enable OTP for the user group that will use the OT/ICS Session Manager.
3. Navigate to Administration > System Configuration Manager and set the parameters below:
tcp.connection.otp.enabled=true
tcp.otp.cache.seconds=600
Parameter | Default | Description |
|---|---|---|
tcp.connection.otp.enabled | false | Master switch. When set to true, an MFA token is requested for OT/ICS Session Manager (TCP Proxy) connections |
tcp.otp.cache.seconds | 600 | Defines how long Kron PAM keeps a successful token verification valid inside the same tunnel session, in seconds. When the period ends, Kron PAM closes the tunnel session, and the user opens a new tunnel and enters a new token. |
Kron PAM reads these parameters and the user group OTP setting every two minutes. Changes to the parameters and to the user group OTP setting apply to open tunnel sessions, so no proxy restart and no tunnel restart is needed.
The token verification is cached only inside the tunnel session that created it. A new tunnel session always requires a new token.
Connecting with a Token
After these settings, the connection flow is as follows:
1. The user opens the tunnel:
ssh -L [Local_Port]:[Target_IP]:[Target_Port] [PAM_User]@[PAM_IP] -p [PAM_SSH_Port]
2. The user enters the Kron PAM password.
3. The user connects the application to localhost:[Local_Port]. Kron PAM blocks the forwarded connection and writes the following messages to the gateway shell:
KronPAM: [SECURITY] Tunnel blocked.
[ACTION REQUIRED] Press ENTER to proceed to OTP step.
4. The user presses ENTER. Kron PAM writes the token prompt:
KronPAM: [SECURITY] Enter OTP:
5. The user enters the token generated by the Kron PAM Mobile Client Application, or the token received by SMS.
6. If the token is valid, Kron PAM forwards the connection to the target device. The user retries the connection if the client does not retry automatically.
The tunnel session must stay interactive, because the token prompt is written to the gateway shell and the token is read from the same shell. The -N option must not be used in the tunnel command.
If multitenancy is enabled, the tenant must be included in the user name, for example [PAM_User]@[Tenant]@[PAM_IP]. If the tenant is missing, token requests fail and Kron PAM closes the tunnel session.
If the user enters an invalid token, the forwarded connection stays blocked and the prompt is repeated. After the allowed number of failed attempts, Kron PAM closes the tunnel session.
Using Push Notification for OT/ICS Session Manager
When an external MFA provider is selected and its factor is configured as push, no token is requested. Kron PAM sends the MFA request to the provider and waits for the user to approve it in the mobile authenticator.
If the request is approved, Kron PAM forwards the connection to the target device. If the request is denied, or if the user does not respond within the provider timeout, the tunnel session is closed.
Push notification behavior depends on the global provider selection. For the provider parameters and the supported factors, see the External MFA Providers section.