Creating an Administrator Account with SecurID Authentication

SecurID requires administrators to possess a token authenticator and to supply a PIN or password. Token authenticators generate one-time passwords that are synchronized to an RSA Authentication Manager (AM) and may come in the form of hardware or software. Hardware tokens are key-ring or credit card-sized devices. Software tokens reside on the PC or device from which the administrator wants to authenticate. All tokens generate a random, one-time use access code that changes approximately every minute. When an administrator attempts to authenticate to a protected resource, the AM must validate the one-time use code.

The Security Management ServerClosed Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. forwards SecurID authentication requests by remote administrators to the AM. The AM manages the database of the RSA users and their assigned hard or soft tokens. The Security Management ServerClosed Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. act as an AM Agent and directs all access requests to the RSA AM for authentication. For additional information on agent configuration, refer to the RSA Authentication Manager documentation.

There are no specific parameters required for the SecurID authentication method. Authentication requests can be sent over SDK-supported API or through REST API.

To learn how to configure a SecurID server, refer to the vendor documentation.

After you configure SecurID authentication, you can, in addition, configure authentication with a certificate file. The administrator can then authenticate to SmartConsoleClosed Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. with SecurID authentication or the certificate file.

You create the certificate file in SmartConsole. The administrator can use the certificate to log in to SmartConsole in two ways:

  • Log in to SmartConsole with the Certificate File option. The administrator must provide the password to use the certificate file.

  • You can import the certificate file to the Windows Certificate Store on the Microsoft Windows SmartConsole computer. The administrator can use this stored certificate to log in to SmartConsole with the CAPI Certificate option. The administrator does not need to provide a password to log in.

The administrator can also give the certificate to other administrators to log in to SmartConsole with no administrator account of their own.

Prerequiste:

Make sure you configured the required Permission ProfileClosed Predefined group of SmartConsole access permissions assigned to Domains and administrators. With this feature you can configure complex permissions for many administrators with one definition.. See Assigning Permission Profiles to Administrators.

To configure SecurID authentication for an administrator

    1. Connect to the command line on the Security Management Server.

    2. Log in to the Expert mode.

    3. Copy the sdconf.rec file to the /var/ace/ directory.

      If the /var/ace/ directory does not exist, create it with this command:

      mkdir -v /var/ace/

    4. Assign all permissions to the sdconf.rec file:

      chmod -v 777 /var/ace/sdconf.rec

    1. Add a new SecurID server object:

      Go to the Object Explorer and select New > More > Server > New SecurID.

    2. In the top field, enter the applicable object name.

    3. Optional: Enter the comment.

    4. This step applies only to SDK-supported API:

      Click Browse and select the sdconf.rec file.

      This must be a copy of the file that is located on the Security Management Server.

    5. Click OK.

    1. From the left navigation panel, click Manage & Settings..

    2. Expand Permissions & Administrators > click Administrators.

    3. From the top toolbar, click the icon (New) > click New Administrator.

      The New Administrator window opens and shows the General page.

    4. In the top field, enter the applicable object name.

    5. Optional: Enter the comment.

    6. In Authentication method, select SecurID.

    7. Optional: Create a certificate for this administrator:

      1. In the Certificate Information field, click Create.

      2. In the Password field, enter the password.

        A password is required to protect the sensitive data in the certificate file.

      3. In the Confirm field, enter the same password.

      4. Click OK.

      5. Wait for the Save As window to open.

      6. In the File name field, make sure to include the username.

      7. In the Save as type field, select Certificate Files (*p12).

        The certificate file is in the PKCS #12 format, and has a .p12 extension.

      8. Browse to a secure location on the SmartConsole computer.

      9. Click Save.

      Notes:

      • After you save the certificate file, give the administrator this file and password.

        The administrator can then authenticate with the certificate when they log in with SmartConsole to the Security Management Server.

      • You can revoke this certificate at any time. Select the certificate and click Revoke.

    8. In the Permission Profile field, select the applicable profile.

    9. In the Expiration section, configure the required valid expiration date.

    10. Optional: On the Additional Info page, configure:

      • Phone Number

      • Contact Details

      • Email

    11. Click OK.

    12. Publish the SmartConsole session.

  		4.

    Note - This procedure applies if you create a certificate authentication in the administrator object, and you log in to SmartConsole with the CAPI Certificate option.

    1. Right-click the *.p12 file you saved when you created the required administrator, and click Install PFX.

      The Certificate Import Wizard opens.

    2. In the Store Location section, select the applicable option:

      • Current User (this is the default)

      • Local Machine

    3. Click Next.

    4. Enter the same certificate password you used when you created the required administrator certificate.

    5. Clear Enable strong private key protection.

    6. Select Mark this key as exportable.

    7. Click Next.

    8. Select Place all certificates in the following store, click Browse > Personal > OK.

    9. Click Next.

    10. Click Finish.