Enhance Intel AMT Security with MeshCentral Satellite

Table of Contents

1. Introduction
2. What is MeshCentral Satellite?
3. Configuring Intel AMT with 802.1x
4. Basic Configuration of MeshCentral
5. Advanced Configuration with Domain Controllers
6. Windows Domain Radius Server
7. MeshCentral Satellite Tool
8. Setting up the MeshCentral Server
9. Configuring MeshCentral Satellite
10. Configuring AMT Devices with 802.1x and Certificates
11. Monitoring and Troubleshooting with MeshCentral
12. Conclusion

Introduction

In this article, we will explore MeshCentral satellite, an advanced configuration of Intel AMT with 802.1x. MeshCentral allows for the configuration and activation of Intel AMT, but it also enables configuration with 802.1x for network access. This article will focus on the advanced configuration of Intel AMT in domain controllers with more advanced radius servers.

What is MeshCentral Satellite?

MeshCentral satellite is a Windows tool that runs on the same domain as the radius server, domain controller, and certificate authority. It acts as a go-between, allowing the MeshCentral server to configure the domain controller with new AMT accounts and request certificates from the certificate authority for the AMT devices.

Configuring Intel AMT with 802.1x

802.1x is a network protocol that allows for secure network access. Normally, a device needs to authenticate with a radius server through the switch in order to gain network access. However, when it comes to Intel AMT, which functions as its own network stack, it also needs to authenticate with 802.1x for network access. MeshCentral allows for the configuration of AMT in such a way that it can authenticate with the radius server using 802.1x.

Basic Configuration of MeshCentral

In a previous video, we covered the basic configuration of MeshCentral with a simple radius server. We used a username and password for authentication, but this is not a realistic setup in terms of security. In this article, we will explore a more advanced configuration using Windows domain radius server. This setup includes a domain controller, certificate authority, and a more realistic corporate radius server.

Advanced Configuration with Domain Controllers

The advanced configuration of MeshCentral involves setting up a MeshCentral satellite tool, which acts as a proxy between the MeshCentral server and the domain controller. The satellite tool is a Windows application that sits on the domain and connects to the MeshCentral server. It allows for the configuration of the domain controller with new AMT accounts and facilitates certificate issuance for the AMT devices.

Windows Domain Radius Server

The Windows domain radius server is a more realistic corporate radius server that is connected to a domain controller and certificate authority. It provides more advanced authentication and authorization capabilities for AMT devices. The server is connected to MeshCentral satellite, which configures the domain controller and handles certificate issuance for the AMT devices.

MeshCentral Satellite Tool

The MeshCentral satellite tool is a Windows application that runs on the same domain as the radius server, domain controller, and certificate authority. It acts as a bridge between the MeshCentral server and the domain, facilitating the configuration of AMT devices and certificate issuance. It allows for the configuration of AMT accounts and the retrieval of certificates from the certificate authority.

Setting up the MeshCentral Server

To use MeshCentral satellite, you need to have a MeshCentral server set up. The server can run on a Linux computer and does not need to be on the domain. It can be hosted in the cloud on platforms like AWS or Azure. The server connects to MeshCentral satellite and sends requests for configuration changes or certificate issuance.

Configuring MeshCentral Satellite

To configure MeshCentral satellite, you need to provide the server's DNS name or IP address and your login credentials. Two-factor authentication is not supported, but you can generate a login token from your MeshCentral account and use it for authentication. You can also configure security groups, certificate authority, and logging settings within MeshCentral satellite.

Configuring AMT Devices with 802.1x and Certificates

Once everything is set up, MeshCentral will automatically configure AMT devices for 802.1x authentication and certificate usage. When an AMT device with an agent connects to MeshCentral, it will be configured to communicate with the radius server for authentication. MeshCentral satellite will issue certificates and configure the domain controller with new computer accounts for the AMT devices.

Monitoring and Troubleshooting with MeshCentral

To monitor the configuration and troubleshoot any issues, you can use the MeshCentral console. It provides information about the currently active Sessions and allows you to force a configuration update on AMT devices. You can also check the event viewer on the radius server to see if there are any authentication failures or issues with the AMT devices.

Conclusion

MeshCentral satellite is a powerful tool that enables the configuration of Intel AMT with 802.1x and certificate authentication in a corporate environment. By using MeshCentral satellite, domain controllers and radius servers can be properly configured to ensure secure network access for AMT devices.

Highlights

• MeshCentral satellite is an advanced configuration of Intel AMT with 802.1x.
• It allows for the configuration of AMT in domain controllers with more advanced radius servers.
• The satellite tool acts as a bridge between the MeshCentral server and the domain, facilitating configuration and certificate issuance.
• MeshCentral satellite can be configured to use certificate authentication for added security.
• Monitoring and troubleshooting can be done through the MeshCentral console and event viewer on the radius server.

FAQ

Q: Can MeshCentral satellite be run as a background service? A: Yes, MeshCentral satellite can be run as a background service once it is configured. This allows it to connect to the MeshCentral server and process requests without the need for the standalone app to be running.

Q: Is two-factor authentication supported in MeshCentral satellite? A: No, two-factor authentication is not supported in MeshCentral satellite. However, you can generate a login token from your MeshCentral account and use it for authentication instead of providing your username and password.

Q: Can MeshCentral satellite be run on a Linux computer? A: No, MeshCentral satellite is a Windows application that needs to run on the same domain as the radius server, domain controller, and certificate authority. However, the MeshCentral server can be run on a Linux computer.

Resources

• MeshCentral
• Intel AMT
• 802.1x