commvault.com commvault.com
Solved

Multi Factor Authentication (MFA) Flaw

D
Rank
Badge +1

I started looking at the MFA on Command Centre and baffled as it is flawed. If my domain account has been compromised, I would be expecting the second factor to be the 2nd line of defence. But no, you can request a new pin that gets sent to your compromised domain account e-mail address. I then looked to see if I can amend my account by adding an external e-mail address, but LDAP pulls this from the domain and can not be edited. By editing the e-mail script we can omit the pin, but I think this hasn’t been thought through by Commvault, considering that backups are supposed to be the last line of defence against a cyber attack the two factor serves only to delay the time it takes for SMTP to deliver a new pin.

icon

Best answer by Anand 7 June 2021, 21:32

View original

29 replies

N
Rank
Userlevel 1
Badge

TFA email can be disabled using this Additional settings. If set at commcell level, it will disable for all the users that belongs to the commcell. 

Name: DisableTFAEmail

Category: CommServDB.Console

Type: Boolean

value: true

 

A
Rank
Userlevel 1
Badge +2

I started looking at the MFA on Command Centre and baffled as it is flawed. If my domain account has been compromised, I would be expecting the second factor to be the 2nd line of defence. But no, you can request a new pin that gets sent to your compromised domain account e-mail address. I then looked to see if I can amend my account by adding an external e-mail address, but LDAP pulls this from the domain and can not be edited. By editing the e-mail script we can omit the pin, but I think this hasn’t been thought through by Commvault, considering that backups are supposed to be the last line of defence against a cyber attack the two factor serves only to delay the time it takes for SMTP to deliver a new pin.

This is being worked on. 

  1. Option to block the pin to be sent in email.
  2. Option to set the email for the AD/LDAP account if user has rights.
A
Rank
Userlevel 1
Badge +2

We also just discovered disabling SSO has forced the java client to prompt for 2 factor auth. For wider community as I presume you know this.

Second factor is asked only when CV does the password authentication. When password is validated thru SSO or IDP, we act as relying party. 

dude
Rank
Badge +15

What I would do in this case, would talk to support in hopes that there is a qcommand / qscript that can disable the MFA Email notification and only allow the Apps. I would not be surprised if they have a way to do that.

Mohit Chordia
Rank
Userlevel 3
Badge +11

@dude :

Already did few months back they don't have any way apart from modifying the email template .

Mike Struening RETIRED
Rank
Userlevel 7
Badge +23

@dude , this is coming inFR25.

https://www.linkedin.com/in/michael-struening
MichaelCapon
Rank
Userlevel 6
Badge +14

This is an issue when using domain user accounts. - If you omit the PIN from the Email, you can use one of the supported App’s to generate the PIN.

For Domain accounts you could give a “View Only” role to avoid any compromised accounts making changes.


You could use a local user account (non-domain) that has privileges in the CommCell and add the users email address to that local account. 

Then to be compromised they would have to obtain the Commvault local credentials and the user’s domain credentials for the PIN email.

 

Best Regards,

Michael

Mike Struening RETIRED
Rank
Userlevel 7
Badge +23

@Dancer , I’ll speak to some internal folks about this.

https://www.linkedin.com/in/michael-struening
Mike Struening RETIRED
Rank
Userlevel 7
Badge +23

That was meant to say “considering backups is supposed to be the last line of defence”

I edited the original post for you :grin:

I have asked some devs to take a look at this thread as well!

https://www.linkedin.com/in/michael-struening
M
Rank
Badge

we are checking this internally with

 @Divya Trivedi@Tharun Pathepuram  @Anand 


we will get back on this.

D
Rank
Badge +1

Great stuff. Maybe the AD/LDAP email address should stay for the purpose of scheduled reports etc, but a 2nd e-mail field used exclusively for recovery purposes. Users should be flagged that their recovery email address is empty if MFA is enabled, and periodically prompted (6 months) to check their details are still correct. I also think any manual amending of the e-mail address be limited to the user, therefore a administrator can create\disable an account but not amend it.

D
Rank
Badge +1

We also just discovered disabling SSO has forced the java client to prompt for 2 factor auth. For wider community as I presume you know this.

Mohit Chordia
Rank
Userlevel 3
Badge +11

TFA email can be disabled using this Additional settings. If set at commcell level, it will disable for all the users that belongs to the commcell. 

Name: DisableTFAEmail

Category: CommServDB.Console

Type: Boolean

value: true

 

@Nipa 

Thank you . This is working.

dude
Rank
Badge +15

@Mike Struening just wondering if you would be able to look my question above about ADFS/Yubikey and check internally? Thanks

dude
Rank
Badge +15

@dude  In other words, yubikey option doesn’t get invoke, when we do SSO.  In case of ADFS, yubikey support need to be added in AD. When token comes back to us, user is already marked authenticated. Internally we have tried yubikey with Azure AD setup and it worked fine. Currently we are adding feature to allow local or direct AD user authentication with yubikey.

 

 

 

 

@Anand I`m not sure I understand. It is currently not supported but it is coming in future release? do you  know when?

dude
Rank
Badge +15

@dude , this is coming inFR25.

Thanks

Mike Struening RETIRED
Rank
Userlevel 7
Badge +23

Anytime, man!

https://www.linkedin.com/in/michael-struening
D
Rank
Badge +1

That was meant to say “considering backups is supposed to be the last line of defence”

Mike Struening RETIRED
Rank
Userlevel 7
Badge +23

@Mohit Chordia , if you open a support case, share it here and I’ll split your query into its own thread.

https://www.linkedin.com/in/michael-struening
A
Rank
Userlevel 1
Badge +2

Great stuff. Maybe the AD/LDAP email address should stay for the purpose of scheduled reports etc, but a 2nd e-mail field used exclusively for recovery purposes. Users should be flagged that their recovery email address is empty if MFA is enabled, and periodically prompted (6 months) to check their details are still correct. I also think any manual amending of the e-mail address be limited to the user, therefore a administrator can create\disable an account but not amend it.

I understand that you want end user to amend the email but admin may not like it. They would like to keep the user email same as AD email to avoid defragmentation, data leak or security issues. We are targeting to update the email only when it’s empty. Ex- service account, SAML account etc. 

dude
Rank
Badge +15

@Anand any way to get ADFS and allow Yubikeys?

Mike Struening RETIRED
Rank
Userlevel 7
Badge +23

Hey @Anand , do you have any ETA on release for @dude ?

https://www.linkedin.com/in/michael-struening
Mohit Chordia
Rank
Userlevel 3
Badge +11

@Mike Struening :

@dude 

@Anand 

Do we have the the option in FR25 now to disable PIN over email feature ? If yes , please share the documentation.

dude
Rank
Badge +15

@Mohit Chordia you do not need to use PIN over email. You have additional options such as Google Authenticator App, Microsoft Authenticar App, Commvault Token Desktop.

Refer to : https://documentation.commvault.com/11.24/expert/7935_pin_generating_tools.html

A
Rank
Userlevel 1
Badge +2

@dude  In other words, yubikey option doesn’t get invoke, when we do SSO.  In case of ADFS, yubikey support need to be added in AD. When token comes back to us, user is already marked authenticated. Internally we have tried yubikey with Azure AD setup and it worked fine. Currently we are adding feature to allow local or direct AD user authentication with yubikey.

Editing in FR25 to mark this as the best (and complete) answer.

 

 

 

 

Reply


Terms & ConditionsCookie settings