Slashdot Mirror

← Back to Stories (view on slashdot.org)

What Kind Of Remote Authentication Do You Use?

Posted by Cliff on from the show-the-credentials-please dept.

Iphtashu Fitz asks: "I have worked for a number of companies that implement different types of security policies for remote access. This has ranged from simply setting up a PPTP server with static passwords to bastion hosts using authentication tokens like RSA Security's SecurID and CRYPTOCard's product by the same name. Most people agree that static passwords on a PPTP server aren't all that secure, and anyway it's not all that easy to integrate with Linux servers. SecurID and CRYPTOCard are much more secure because they use one-time passwords generated by hardware tokens. However, when I used SecurID it seemed that their tokens would regularly lose synchronization with the server (not to mention they would expire every two years or so and were expensive to replace). The CRYPTOCard keychain token doesn't have the synchronization problem that RSA's does but it's also a pain to use because of the way you enter a PIN into it. What kind of authentication system(s) do you use where you work? What do you like and hate about it? How would you make it better if you could?"

25 of 36 comments (clear)

  1. First Poem by Anonymous Coward · · Score: 3, Funny

    What's this error that I see?
    I do not like this 503.
    How can this have come to be,
    Using software that is free.

    1. Re:First Poem by oiarbovnb · · Score: 1

      awesome!

    2. Re:First Poem by consolidatedbord · · Score: 1

      danke

      --
      while true ; do echo this is my sig; done
  2. Army by rawgod0122 · · Score: 2, Informative

    The US Army uses SecureID and Kerbose. They also use a short timeout on the tickets. I have been using it for some time now and as an end user I like it.

    The system works on everything from linux, Unicos (Cray), AIX (IBM), Solaris (Sun), and every ones favorite Windows!

    1. Re:Army by dunng808 · · Score: 1

      Is SecureID the same as the Army's ID card SmartCard? By "Kerbose" do you mean the one in the Army-wide Active Directory?

      --

      Gary Dunn
      Open Slate Project

  3. authentication... by hatrisc · · Score: 1

    why I just use 'enter' it's easy to type and even easier to remember!

    --
    I write code.
  4. SecurID runs on lots of gadgets. by Anonymous Coward · · Score: 2, Informative

    One neat aspect of SecurID is they have it on lots of gadgets - aside from the tokens, you can run it on Palm, PocketPC, and Blackberry pagers. I just wish it ran on my phone. Then I wouldn't have to carry a keyfob token.

    1. Re:SecurID runs on lots of gadgets. by heydrick · · Score: 1

      SecurID for phones exists. You just have to have the right one.

  5. Safeword by austad · · Score: 3, Informative

    Here.

    I looked at this awhile back. It was cheaper and seemed more robust than the SecureID stuff. Plus, it's event based, not time based. You don't have to wait a minute before logging into another device, you just hit the button and take the next code. If it gets out of sync, just enter the next 5 codes in, and it syncs back up, no calling the IT dept or messing around with timing.

    --
    Need Free Juniper/NetScreen Support? JuniperForum
    1. Re:Safeword by cinnerz · · Score: 2, Informative

      I had to use this at a job once. They were too cheap to buy the hardware tokens and made us use the
      software tokens instead - which of course was only for Windows and I didn't have a Windows machine at home. Since there isn't a time component, I generated a whole bunch of passwords, but them on a piece of paper, and carried them around.

      While the time sync problem is annoying with SecurID, it does prevent users from doing things like printing out lists of the next tokens (or saving them in a file on their computer so they can automate their logins).

    2. Re:Safeword by Finni · · Score: 1

      Because the best security products get their names from BDSM play?

  6. Kerberos by finkployd · · Score: 4, Informative

    Kerberos is generally the standard among Higher Education. PKI Certificate authentication is also explored quite a bit, but it suffers from being an architecture written almost entirely in Powerpoint.

    We also use RSA Secure ID tokens, but only as a second form of auth and only required for highly sensitive operations.

    We are also rolling out a web single sign on system which build off of Kerberos called Cosign.

    Some of the more clueless departments (or those who simply do not know how to run anything else) are clamoring for a Windows Active Directory Domain, which we are going to provide, only it is going to be an authentication slave to our MIT Kerberos realm (There is no way in hell our access id and passwords will live on MS software)

    Finkployd

  7. my dream device.. by way2trivial · · Score: 2, Interesting
    a simple little box, that I buy, perhaps two, configure, and send one to my mom.. she plugs it into her router..


    bam- vpn.. Yes, she has three open ports on her wifi adapter, (ok, I'm out, but I'll put in an uplink or buy a new 8port)

    why can't someone make a cheap (*behind the router*) box that lets me VPN over the internet safely, at a reasonable pricepoint? no config required other than a 256 character matching password and the IP of the other machine? they talk to each other from behind the router, and act as if they were local computers for the lan?

    --
    every day http://en.wikipedia.org/wiki/Special:Random
    1. Re:my dream device.. by arcade · · Score: 1

      Because most home users seem to be behind NATs these days, and thus it's not very easy to make a "behind the router"-box.

      --
      "Rune Kristian Viken" - http://www.nwo.no - arca
    2. Re:my dream device.. by arcade · · Score: 1

      a simple little box, that I buy, perhaps two, configure, and send one to my mom.. she plugs it into her router..

      I have to reply twice, as I forgot to say how I manage to communicate securely with my parrents computers.

      Both use SuSE Linux, I just SSH into my account, which works perfectly. I've also got the root passwords, so that I can do remote maintainance of both machines. Really nice.

      It's not as if they're on the same LAN, but that could be fixed with the VPN-over-SSH howto, if I really wanted. :)

      --
      "Rune Kristian Viken" - http://www.nwo.no - arca
    3. Re:my dream device.. by arcade · · Score: 1

      It will require one to reconfigure the gateway, which isn't something his mom could do - thus not interesting in this case.

      The problem is that he is asking for the impossible, given that both ends use NAT, and neither end is technical enough to reconfigure their NAT-devide/gateway.

      --
      "Rune Kristian Viken" - http://www.nwo.no - arca
    4. Re:my dream device.. by jthuck · · Score: 1

      Better yet, why not make it the router? Check out DLink's DFL-80 ($170) or DFL-300

  8. I currently use by Marxist+Hacker+42 · · Score: 1, Interesting

    Keyfobs with customized VPN software on them. Downside is you need Linux or Windows to use it. What I'd LIKE to see- is customized VPN software that runs on a variety of machines, with both USB and SD interfaces (for handhelds and phones and such) combined with a thumbprint or retina scanner- biometrics baby, it's the only way to be sure the guy logging on is who he says he is.

    --
    SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
  9. ActivCard by klui · · Score: 1

    I use ActivCard. Basically the same as SecurID, but the credit card-based smartcard can be read in a USB card reader w/ appropriate software or a standalone card reader. No need to change cards after 2 years. You can also store your own digital certicates on the card.

  10. RSA fixed the problem... by sribe · · Score: 1

    However, when I used SecurID it seemed that their tokens would regularly lose synchronization with the server (not to mention they would expire every two years or so and were expensive to replace).

    Yes, I had that problem repeatedly when a large client first went to this system. But it quit doing that at least a year ago.

    1. Re:RSA fixed the problem... by Iphtashu+Fitz · · Score: 3, Interesting

      Yes, I had that problem repeatedly when a large client first went to this system. But it quit doing that at least a year ago.

      Sucks for RSA. We switched over to CRYPTOCard almost 2 years ago now. The constant loss of synchronization was a huge factor since we have remote offices all over the place and constantly having to resync remote users was a real pan in the ass.

      Of course the cost is still a major issue. RSA's licenses are a lot more expensive than most other alternatives. Their support contracts are very expensive. Their tokens expire every 2 years which adds yet another cost (esp. when dealing with all our remote users). Many of the other alternatives don't have tokens that expire, thus saving a lot of time & money down the line.

    2. Re:RSA fixed the problem... by Milalwi · · Score: 1

      Their tokens expire every 2 years which adds yet another cost...

      My SecurID token doesn expire for another 3+ years, and I've had it more than a year. The one before this had a four-year expiration, I think.

      I haven't had to re-syncronize in years.

      Milalwi
  11. Wikid alternative. by packetknife · · Score: 1
    I haven't gotten a chance to play with it myself but you might want to look at Wikidsystems.com.

    There are also any number of cert. based authentication like Permeo.com and Aventail.com. Cheers, -Pk

  12. SecurID by Suppafly · · Score: 1

    SecurID tokens last 5 years and the software version lasts 10 years.

  13. Cryptocard Card by lal · · Score: 1

    We use the Cryptocard card token. It is more convenient than the keychain token because you have a calculator-style keypad to enter your PIN.

    That said, it is still remarkably difficult to purchase and use any of these tokens in a small shop (or home environment). Cryptocard is more small-business friendly than SecurID, but both are mainly targeted at the large enterprise.