What Kind Of Remote Authentication Do You Use? 36
Iphtashu Fitz asks: "I have worked for a number of companies that implement different types of security policies for remote access. This has ranged from simply setting up a PPTP server with static passwords to bastion hosts using authentication tokens like RSA Security's SecurID and CRYPTOCard's product by the same name. Most people agree that static passwords on a PPTP server aren't all that secure, and anyway it's not all that easy to integrate with Linux servers. SecurID and CRYPTOCard are much more secure because they use one-time passwords generated by hardware tokens. However, when I used SecurID it seemed that their tokens would regularly lose synchronization with the server (not to mention they would expire every two years or so and were expensive to replace). The CRYPTOCard keychain token doesn't have the synchronization problem that RSA's does but it's also a pain to use because of the way you enter a PIN into it. What kind of authentication system(s) do you use where you work? What do you like and hate about it? How would you make it better if you could?"
First Poem (Score:3, Funny)
I do not like this 503.
How can this have come to be,
Using software that is free.
Re:First Poem (Score:1)
Re:First Poem (Score:1)
Army (Score:2, Informative)
The system works on everything from linux, Unicos (Cray), AIX (IBM), Solaris (Sun), and every ones favorite Windows!
Re:Army (Score:1)
authentication... (Score:1)
SecurID runs on lots of gadgets. (Score:2, Informative)
Re:SecurID runs on lots of gadgets. (Score:1)
Comment removed (Score:4, Informative)
Re:Safeword (Score:2, Informative)
software tokens instead - which of course was only for Windows and I didn't have a Windows machine at home. Since there isn't a time component, I generated a whole bunch of passwords, but them on a piece of paper, and carried them around.
While the time sync problem is annoying with SecurID, it does prevent users from doing things like printing out lists of the next tokens (or saving them in a file on their
Re:Safeword (Score:2)
Comment removed (Score:5, Informative)
my dream device.. (Score:3, Interesting)
bam- vpn.. Yes, she has three open ports on her wifi adapter, (ok, I'm out, but I'll put in an uplink or buy a new 8port)
why can't someone make a cheap (*behind the router*) box that lets me VPN over the internet safely, at a reasonable pricepoint? no config required other than a 256 character matching password and the IP of the other machine? they talk to each other from behind the router, and act as if they were local computers for the lan?
Re:my dream device.. (Score:2)
Re:my dream device.. (Score:2)
The problem is that he is asking for the impossible, given that both ends use NAT, and neither end is technical enough to reconfigure their NAT-devide/gateway.
Re:my dream device.. (Score:2)
I have to reply twice, as I forgot to say how I manage to communicate securely with my parrents computers.
Both use SuSE Linux, I just SSH into my account, which works perfectly. I've also got the root passwords, so that I can do remote maintainance of both machines. Really nice.
It's not as if they're on the same LAN, but that could be fixed with the VPN-over-SSH howto, if I really wanted. :
Re:my dream device.. (Score:1)
I currently use (Score:2, Interesting)
ActivCard (Score:2)
RSA fixed the problem... (Score:2)
Yes, I had that problem repeatedly when a large client first went to this system. But it quit doing that at least a year ago.
Re:RSA fixed the problem... (Score:4, Interesting)
Sucks for RSA. We switched over to CRYPTOCard almost 2 years ago now. The constant loss of synchronization was a huge factor since we have remote offices all over the place and constantly having to resync remote users was a real pan in the ass.
Of course the cost is still a major issue. RSA's licenses are a lot more expensive than most other alternatives. Their support contracts are very expensive. Their tokens expire every 2 years which adds yet another cost (esp. when dealing with all our remote users). Many of the other alternatives don't have tokens that expire, thus saving a lot of time & money down the line.
Re:RSA fixed the problem... (Score:2)
My SecurID token doesn expire for another 3+ years, and I've had it more than a year. The one before this had a four-year expiration, I think.
I haven't had to re-syncronize in years.
Milalwi
Wikid alternative. (Score:1)
There are also any number of cert. based authentication like Permeo.com and Aventail.com. Cheers, -Pk
SecurID (Score:2)
Cryptocard Card (Score:2)
We use the Cryptocard card token. It is more convenient than the keychain token because you have a calculator-style keypad to enter your PIN.
That said, it is still remarkably difficult to purchase and use any of these tokens in a small shop (or home environment). Cryptocard is more small-business friendly than SecurID, but both are mainly targeted at the large enterprise.