Unix/Linux Go Back    


Security Discuss UNIX and Linux computer and network security, cyber security, cyber attacks, IT security, and more.

Two Factor Authentication – Best for the UNIX/Linux Server Security

Security


Tags
linux

Reply    
 
Thread Tools Search this Thread Display Modes
    #1  
Old Unix and Linux 3 Weeks Ago
reve-secure reve-secure is offline
Registered User
 
Join Date: Mar 2017
Last Activity: 7 June 2017, 6:23 AM EDT
Location: singapore
Posts: 1
Thanks: 0
Thanked 0 Times in 0 Posts
Two Factor Authentication – Best for the UNIX/Linux Server Security

The UNIX/Linux server security is challenging because these servers are at a risk of getting compromised at any point of time by the attackers. In today’s enterprise environment, the UNIX and Linux servers are growing popular. With their increased popularity, these servers have become the primary target of the attackers for security breaches. There have been numerous cases of harmful external security threats where the attackers have gained access to these servers; UNIX and Linux, through the Internet. The largest security threat to UNIX/Linux server is internal, not external. Therefore, it is must for the enterprises to improve their UNIX/Linux server security, so that comprising server becomes complicated for the hackers.

What is your thinking..??
Sponsored Links
    #2  
Old Unix and Linux 3 Weeks Ago
bakunin bakunin is offline Forum Staff  
Bughunter Extraordinaire
 
Join Date: May 2005
Last Activity: 22 June 2017, 5:05 AM EDT
Location: In the leftmost byte of /dev/kmem
Posts: 5,446
Thanks: 100
Thanked 1,509 Times in 1,119 Posts
Quote:
Originally Posted by reve-secure View Post
What is your thinking..??
OK, I'll have a take at it. A word of caution up front, though: we are a discussion forum. If you are genuinely interested in a discussion about security matters you are welcome whatever will make your stay here more enjoyable you may ask for. If, on the opposite, you think that just because you got some answer here you can use us as a free advertisement vehicle - think twice. You will be banned faster than you can spell "2FA" and we will close this thread after writing some rather negative comments about the business practices of your company (yes, we are well aware that you seem to represent a company - that is absolutely OK with us as long as you abide by the rules). These comments will stay here and will probably not have an advertising but rather the opposite effect. So, it is in your own as well as your companies interest that we get along fine.

Now, after this long introduction, lets get to the theme of the thread:

I think there are some misconceptions about "security" in general and UNIX/Linux security in particular. First, there is the "much helps much" misconception. If a 6-character password is good, then a 8-character password must be better. Or maybe would 12-characters be even better yet? And if changing the password regularly is good, wouldn't changing it more often be even better?

The usual outcome is: everybody needs to have a 12-character password with at least 7 special characters, one for every system and has to change it every other day, otherwise the account gets locked. This is so secure that it usually ends with most people having a piece of paper with their passwords under the keyboard - little unknown fact: nobody is able to memorise such password-monsters anew every second day.

Second: the "compliance"-fallacy. Instead of measuring "security" most often a system is tested to be "compliant" against some arbitrary standard, usually set forth by someone with no idea about the OS. I once had a customer who had a password rule that any password had to consist of at least three out of the four character classes: upper case, lower case, numbers, special chars.

Then they needed to audit and in the security standard it was declared that a "secure password" would consist of at least two of the character classes "upper case", "lower case" and "numbers". So, in fact they already had a system in place that guaranteed more complex passwords than were asked for. Guess what - this resulted in a "security finding" and they had to water down their rules to be "compliant". I leave it to the imagination of the reader if the purpose of security was served well with this.

Finally, and this is related to the first mentioned problem: if entering a password (or doing whatever else instead) is good, wouldn't be entering it twice be even better? When i log on to the customers site i work for right now, i have to enter: the password to log on to the client computer, then the passowrd again when i open the mail client, the the password again for the Jabber tool they are using. I might be mistaken but: let's suppose i obtained the password fraudulently - would entering the compromised password thrice instead of once slow me down in my criminal activity one bit?

bakunin
Sponsored Links
Reply

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Linux More UNIX and Linux Forum Topics You Might Find Helpful
Thread Thread Starter Forum Replies Last Post
Customized Linux Operating System with Security Authentication isravelraja Linux 1 05-15-2015 03:47 AM
Multi-factor authentication lupin..the..3rd HP-UX 6 03-12-2013 01:26 PM



All times are GMT -4. The time now is 09:55 AM.