What Kind Of Remote Authentication Do You Use?

Iphtashu Fitz asks: "I have worked for a number of companies that implement different types of security policies for remote access. This has ranged from simply setting up a PPTP server with static passwords to bastion hosts using authentication tokens like RSA Security's SecurID and CRYPTOCard's product by the same name. Most people agree that static passwords on a PPTP server aren't all that secure, and anyway it's not all that easy to integrate with Linux servers. SecurID and CRYPTOCard are much more secure because they use one-time passwords generated by hardware tokens. However, when I used SecurID it seemed that their tokens would regularly lose synchronization with the server (not to mention they would expire every two years or so and were expensive to replace). The CRYPTOCard keychain token doesn't have the synchronization problem that RSA's does but it's also a pain to use because of the way you enter a PIN into it. What kind of authentication system(s) do you use where you work? What do you like and hate about it? How would you make it better if you could?"

Comments

Army

[rawgod0122]

The US Army uses SecureID and Kerbose. They also use a short timeout on the tickets. I have been using it for some time now and as an end user I like it.

The system works on everything from linux, Unicos (Cray), AIX (IBM), Solaris (Sun), and every ones favorite Windows!

SecurID runs on lots of gadgets.

[Anonymous Coward]

One neat aspect of SecurID is they have it on lots of gadgets - aside from the tokens, you can run it on Palm, PocketPC, and Blackberry pagers. I just wish it ran on my phone. Then I wouldn't have to carry a keyfob token.

Safeword

[austad]

Here.

I looked at this awhile back. It was cheaper and seemed more robust than the SecureID stuff. Plus, it's event based, not time based. You don't have to wait a minute before logging into another device, you just hit the button and take the next code. If it gets out of sync, just enter the next 5 codes in, and it syncs back up, no calling the IT dept or messing around with timing.

Re:Safeword

[cinnerz]

I had to use this at a job once. They were too cheap to buy the hardware tokens and made us use the
software tokens instead - which of course was only for Windows and I didn't have a Windows machine at home. Since there isn't a time component, I generated a whole bunch of passwords, but them on a piece of paper, and carried them around.

While the time sync problem is annoying with SecurID, it does prevent users from doing things like printing out lists of the next tokens (or saving them in a file on their computer so they can automate their logins).

Kerberos

[finkployd]

Kerberos is generally the standard among Higher Education. PKI Certificate authentication is also explored quite a bit, but it suffers from being an architecture written almost entirely in Powerpoint.

We also use RSA Secure ID tokens, but only as a second form of auth and only required for highly sensitive operations.

We are also rolling out a web single sign on system which build off of Kerberos called Cosign.

Some of the more clueless departments (or those who simply do not know how to run anything else) are clamoring for a Windows Active Directory Domain, which we are going to provide, only it is going to be an authentication slave to our MIT Kerberos realm (There is no way in hell our access id and passwords will live on MS software)

Finkployd