Sponsored Content
Special Forums Cybersecurity Two Factor Authentication – Best for the UNIX/Linux Server Security Post 302998267 by bakunin on Sunday 28th of May 2017 06:21:06 PM
Old 05-28-2017
Quote:
Originally Posted by reve-secure
What is your thinking..??
OK, I'll have a take at it. A word of caution up front, though: we are a discussion forum. If you are genuinely interested in a discussion about security matters you are welcome whatever will make your stay here more enjoyable you may ask for. If, on the opposite, you think that just because you got some answer here you can use us as a free advertisement vehicle - think twice. You will be banned faster than you can spell "2FA" and we will close this thread after writing some rather negative comments about the business practices of your company (yes, we are well aware that you seem to represent a company - that is absolutely OK with us as long as you abide by the rules). These comments will stay here and will probably not have an advertising but rather the opposite effect. So, it is in your own as well as your companies interest that we get along fine.

Now, after this long introduction, lets get to the theme of the thread:

I think there are some misconceptions about "security" in general and UNIX/Linux security in particular. First, there is the "much helps much" misconception. If a 6-character password is good, then a 8-character password must be better. Or maybe would 12-characters be even better yet? And if changing the password regularly is good, wouldn't changing it more often be even better?

The usual outcome is: everybody needs to have a 12-character password with at least 7 special characters, one for every system and has to change it every other day, otherwise the account gets locked. This is so secure that it usually ends with most people having a piece of paper with their passwords under the keyboard - little unknown fact: nobody is able to memorise such password-monsters anew every second day.

Second: the "compliance"-fallacy. Instead of measuring "security" most often a system is tested to be "compliant" against some arbitrary standard, usually set forth by someone with no idea about the OS. I once had a customer who had a password rule that any password had to consist of at least three out of the four character classes: upper case, lower case, numbers, special chars.

Then they needed to audit and in the security standard it was declared that a "secure password" would consist of at least two of the character classes "upper case", "lower case" and "numbers". So, in fact they already had a system in place that guaranteed more complex passwords than were asked for. Guess what - this resulted in a "security finding" and they had to water down their rules to be "compliant". I leave it to the imagination of the reader if the purpose of security was served well with this.

Finally, and this is related to the first mentioned problem: if entering a password (or doing whatever else instead) is good, wouldn't be entering it twice be even better? When i log on to the customers site i work for right now, i have to enter: the password to log on to the client computer, then the passowrd again when i open the mail client, the the password again for the Jabber tool they are using. I might be mistaken but: let's suppose i obtained the password fraudulently - would entering the compromised password thrice instead of once slow me down in my criminal activity one bit?

bakunin
 

6 More Discussions You Might Find Interesting

1. Red Hat

microsoft Server 2008 Active authentication to a linux server

Hi, Please could someone advise I'm trying to use winscp from a Window server 2008 R2, but i need to add the authentication key to access the linux rh 5.4 servers ? What is the best way of approaching this ? If there are any web links that could help me do this, that would be good. ... (1 Reply)
Discussion started by: venhart
1 Replies

2. HP-UX

Multi-factor authentication

Is anyone here familiar with implementing multi-factor authentication on HP-UX 11.31? Either with a PIV card, or with an RSA token? We've been tasked with implementing this on our servers, but I'm not finding much in the way of products or information. To complicate matters, our servers are... (6 Replies)
Discussion started by: lupin..the..3rd
6 Replies

3. Linux

How to connect Linux server (configure two way authentication) with Windows server?

Hi my name is Manju. ->I have configure the two way authentication on my linux server. ->Now I am able to apply two way authenticator on particuler user. ->Now I want to map this linux server to my AD server. ->Kindly tell me how to map AD(Active Directory) with this linux server. ... (0 Replies)
Discussion started by: manjusharma128
0 Replies

4. UNIX and Linux Applications

UNIX and Linux authentication middleware or tools

Hi, We are looking for UNIX and Linux authentication middleware/tools which can replace our existing RSA SecurID - Two-Factor Authentication. Any suggestions or recommendations. Thanks, Gabar (2 Replies)
Discussion started by: Gabar Singh
2 Replies

5. Linux

Customized Linux Operating System with Security Authentication

Dear Gurus/Experts of UNIX/LINUX, Im Isravel from India, I've customized CentOS Installation ISO as per my new product requirements. I want to give serial key authentication to the clients who all are trying to install ISO file. Can anyone guide me how to create serial key authentication... (1 Reply)
Discussion started by: isravelraja
1 Replies

6. Solaris

User authentication failed while log in Solaris 8 client on Linux NIS server.

Based on the NIS migration tests I did and another question I posted earlier on. https://www.unix.com/solaris/272021-solaris-8-md5-encryption-support.html I tried to downgrade NIS linux encryption to DES to support solaris connection. So I modified /etc/pam.d/system-auth as below, password... (0 Replies)
Discussion started by: bestard
0 Replies
nfssec(5)																 nfssec(5)

NAME
nfssec - overview of NFS security modes The mount_nfs(1M) and share_nfs(1M) commands each provide a way to specify the security mode to be used on an NFS file system through the sec=mode option. mode can be sys, dh, krb5, krb5i, krb5p, or none. These security modes can also be added to the automount maps. Note that mount_nfs(1M) and automount(1M) do not support sec=none at this time. mount_nfs(1M) allows you to specify a single security mode; share_nfs(1M) allows you to specify multiple modes (or none). With multiple modes, an NFS client can choose any of the modes in the list. The sec=mode option on the share_nfs(1M) command line establishes the security mode of NFS servers. If the NFS connection uses the NFS Ver- sion 3 protocol, the NFS clients must query the server for the appropriate mode to use. If the NFS connection uses the NFS Version 2 proto- col, then the NFS client uses the default security mode, which is currently sys. NFS clients may force the use of a specific security mode by specifying the sec=mode option on the command line. However, if the file system on the server is not shared with that security mode, the client may be denied access. If the NFS client wants to authenticate the NFS server using a particular (stronger) security mode, the client wants to specify the secu- rity mode to be used, even if the connection uses the NFS Version 3 protocol. This guarantees that an attacker masquerading as the server does not compromise the client. The NFS security modes are described below. Of these, the krb5, krb5i, krb5p modes use the Kerberos V5 protocol for authenticating and pro- tecting the shared filesystems. Before these can be used, the system must be configured to be part of a Kerberos realm. See SEAM(5). sys Use AUTH_SYS authentication. The user's UNIX user-id and group-ids are passed in the clear on the network, unauthenticated by the NFS server. This is the simplest security method and requires no additional administration. It is the default used by Solaris NFS Version 2 clients and Solaris NFS servers. dh Use a Diffie-Hellman public key system (AUTH_DES, which is referred to as AUTH_DH in the forthcoming Internet RFC). krb5 Use Kerberos V5 protocol to authenticate users before granting access to the shared filesystem. krb5i Use Kerberos V5 authentication with integrity checking (checksums) to verify that the data has not been tampered with. krb5p User Kerberos V5 authentication, integrity checksums, and privacy protection (encryption) on the shared filesystem. This provides the most secure filesystem sharing, as all traffic is encrypted. It should be noted that performance might suffer on some systems when using krb5p, depending on the computational intensity of the encryption algorithm and the amount of data being transferred. none Use null authentication (AUTH_NONE). NFS clients using AUTH_NONE have no identity and are mapped to the anonymous user nobody by NFS servers. A client using a security mode other than the one with which a Solaris NFS server shares the file system has its security mode mapped to AUTH_NONE. In this case, if the file system is shared with sec=none, users from the client are mapped to the anonymous user. The NFS security mode none is supported by share_nfs(1M), but not by mount_nfs(1M) or automount(1M). /etc/nfssec.conf NFS security service configuration file See attributes(5) for descriptions of the following attributes: +-----------------------------+-----------------------------+ | ATTRIBUTE TYPE | ATTRIBUTE VALUE | |Availability |SUNWnfscr | +-----------------------------+-----------------------------+ automount(1M), mount_nfs(1M), share_nfs(1M), rpc_clnt_auth(3NSL), secure_rpc(3NSL), nfssec.conf(4), attributes(5) /etc/nfssec.conf lists the NFS security services. Do not edit this file. It is not intended to be user-configurable. 13 Apr 2005 nfssec(5)
All times are GMT -4. The time now is 01:20 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy