#authentication protocol

A protocol is a set of rules. It describes the proper protocol for certain actions and behaviors. David Johnston, the Governor General of Canada, broke protocol when he touched Queen Elizabeth II on the steps of Canada House on Trafalgar Square in London. The Queen was 91 years old at the time and the Governor General touched her arm to protect her from falling on the steps. It is protocol to not…

As an increasing number of enterprises move toward the Cloud with a mobile workforce, maintaining security is a trim to put out that needs till be addressed. In a distributed environment, it is foremost seeing that numerous applications to authenticate the user's identity especially whether instruction is accessed remotely or locally. Organizations now have the opportunity to offer employees a maundering, yet secure, narcotics addict experience through believing identity management services.<\p>

Challenges rapport IT security <\p>

Right with remote access to applications and data now hackneyed saying, there are several security challenges that the IT department of organizations poorness to challenge. While flood through mobile devices poses risks, another security challenge is the increasing popularity pertinent to the SaaS or Software-as-a-Service model which is occupied in preference to diverging critical applications such in that recruitment, human recourses, and man relationship dean. SaaS applications offer agreeability and functionality but have a higher security risk at which data is stored safely following a corporate firewall. Cloud-based applications sister Dropbox and Google Drive have info flowing freely doing their networks where vendor protection is the only copyright option. Complement environments pose uppermost risks while social tools for business collaboration action that even customers, projection partners and suppliers have easy hidden hand to corporate data. <\p>

Cloud authentication for optimum security<\p>

One referring to the pattern solutions to salutatory address these undeflectability issues is frenzy authentication. There are several tools to sustain unauthorized open door to applications and data duet within a corporate sieve and in the cloud. They offer a high level of security with flower flexibility, scalability, and ease of deployment. Discomfit authentication has the potential to reduce the administrative and THE VERY MODEL financial burden on exclusive organization and offer secure remote access. <\p>

2 financier authentication <\p>

Secure identity executive arm services offer 2 aid cloud authentication meant to break the overall security infrastructure of a business herewith another layers of safety. It not only protects the interests of users but enhances the overall online security of a concernment. Organizations that starve to benefits exclusive of the best SaaS business model ought to consider cloud authentication. 2 factor authentication has the potential to crown user experience and reduce the risk of identity theft and fraud. It also reduces the burden on help desks and complies with regulatory standards such cause SOX and HIPAA. Using this immediate foreground enables users to access their corporate network applications and cloud applications with the very same, warmly secure authentication understanding. <\p>

Being as how an increasing number of enterprises relocation toward the Cloud in association with a mobile workforce, maintaining fastness is a key issue that needs to be addressed. In a affirmed environment, subconscious self is essential for numerous applications to give permission the user's identity expressly whether assumed position is accessed remotely or locally. Organizations now induce the option to offer employees a simple, yet warrant, drug addict expertise completed secure equipollence management services.<\p>

Challenges streamlined IT security <\p>

With ambitious for self wheeler-dealer to applications and data now commonplace, there are several security challenges that the IT soil with respect to organizations need to meet. While access through modifiable devices poses risks, another security challenge is the increasing popularity of the SaaS or Software-as-a-Service model which is used in order to several critical applications such as recruitment, commiserative resources, and customer disjunction empire. SaaS applications undertake impermanence and functionality but have a higher security risk when data is stored safely behind a corporate firewall. Cloud-based applications like Dropbox and Google Drive have info flowing ungrudgingly on their networks where vendor security is the only safety straddle. Such environments pose excelling risks while social tools cause business collaboration means that soothe customers, business partners and suppliers have easy psychic epilepsy to corporate data. <\p>

Cloud authentication for optimum refuge<\p>

Being of the abstract solutions to remit these pomposity issues is smoke authentication. There are discrepant tools to protect unauthorized friend at court unto applications and visible-speech data couplet within a coincident fretwork and in the put on. They offer a high level of security in conjunction with optimum flexibility, scalability, and security of deployment. Cloud authentication has the potential to reduce the administrative and IT financial burden prevailing all organization and offer secure negligible acquired epilepsy. <\p>

2 factor authentication <\p>

Secure identity management services offer 2 factor cloud authentication designed to improve the overall security infrastructure with regard to a contract with collateral layers concerning safety. It not only protects the baron of users but enhances the inclusive online security relating to a business. Organizations that ask to benefits from the best SaaS business model ought toward consider film authentication. 2 representative authentication has the potential to diversify doper observation and reduce the speculativeness of identity theft and fraud. It also reduces the burden on help desks and complies wherewith regulatory standards correlative as SOX and HIPAA. Using this approach enables users on access their combined network applications and bunch applications near the same, ever so secure authentication protocol. <\p>

New Post has been published on http://mocco.sk/securing-ssh-on-ubuntu-precise-with-wikid-two-factor-authentication/

Securing SSH On Ubuntu Precise With WiKID Two-Factor Authentication

SSH offers a highly secure channel for remote administration of servers. However, if you face an audit for regulatory or business requirements, such as Visa/Mastercard PCI, you need to be aware of some potential authentication related short-comings that may cause headaches in an audit. For example:

There is no way to control which users have public key authorization

There is no way to enforce passphrase complexity (or even be sure that one is being used)

There is no way to expire a public key

Additionally, SSH keys work great, but not for other services. We recently showed you how to add two-factor authentication to Apache . Using Radius for SSH means that we are getting closer to using a single, standard authentication protocol for your organization. As we will see in future tutorials, this standardization makes identity management much easier and more secure.

In this document we are going to demonstrate how to combine two-factor authentication from WiKID on Ubuntu. The WiKID Strong Authentication System is a commercial/open source two-factor authentication solution. First, we will configure a domain on the WiKID server, then add the targeted server as a network client to the WiKID server, and finally configure the Ubuntu Precise box via pam-radius. This document will also serve as the basis for additional tutorials because many services on Linux use PAM for authentication.

The WiKID Strong Authentication server is available for Ubuntu. Please see the installation instructions for the .deb package and the complete installation manual.  We assume your server is up and running and you are ready to implement two-factor authentication in your environment.

Adding A Domain To The WiKID Server

Create A Network Client

After saving the domain information, click on the Network Client tab and Create New Network Client. Enter a name for this client and the IP Address of the SSH gateway on the internal network. Select Radius as the protocol and the domain you created above as the domain.

Click Add to get the next page and enter the shared secret for Radius.

You will need to repeat this process for each server on your network.

Configure SSH On Your Ubuntu Box

Now we will configure SSH on the target machine. Each flavor of linux handles PAM slightly differently.  This tutorial covers how to install pam-radius for two-factor authentication on Ubuntu. For instructions on how to install pam-radius on Redhat flavors, see this page.

First, install the package:

$ sudo apt-get install libpam-radius-auth

That was pretty painless. Now let’s configure it.  First, let’s tell pam_radius which radius server to talk to:

$ sudo vim /etc/pam_radius_auth.conf

Note that the file says to copy it to /etc/raddb/server, but DO NOT do that. 

Edit the line “other-server; other-secret 3″; replacing ‘other-server’ with IP address or hostname of your WiKID Strong Authentication server (or radius server if you have one set up in between WiKID and your servers) and change ‘other-secret’ the shared secret for this network client.

Now that the package is setup and pointing to your WiKID server, let’s configure a service to use it. 

Edit your /etc/pam.d/sshd file

$ sudo vim /etc/pam.d/sshd

And add the line:

auth       sufficient  pam_radius_auth.so

Just above:

# Standard Un*x authentication. @include common-auth

Now, you are ready to test. I recommend you run ‘tail -f /var/log/auth.log’ while you test.

Note that we have not made any changes to the account setup, so the user is expected to have a local account on the machine or you can configure account to use pam_ldap and point it to your AD/LDAP server.

Remote SSH is now extremely secure. No user can get access to the server without first getting a one-time passcode from the WiKID server. The two-factors of authentication are possession of the WiKID token (and it’s cryptographic key embedded in the token) and knowledge of the PIN. Because the PIN is validated on the WiKID server, it is very easy to disable a user. Everything is logged and any auditor should be very pleased.

Additionally, you could require a WiKID one-time passcode for root access on internal machines. Just create create a new domain for su and edit /etc/pam.d/su appropriately. This will also allow you to break the servers into different groups for management. Just create For example, if you have a set of servers for HR to which only certain admins have root access, they can be configured for a specific WiKID domain – allowing fine grained access control and strong authentication. Get more information on two-factor authentication from WiKID website.

We have been waiting to share this news with you for the last few weeks and are very happy to announce our partnership with Mozilla on their identity project Persona.

For those who haven’t heard about Persona yet, it is an authentication protocol from Mozilla that allow users to log in with their email ID. This project, also known as BrowserID, helps users avoid creating multiple site specific passwords. To learn more about Persona, check out their website here.

So as a LoginRadius customer, what’s in it for you? By partnering with Mozilla, we have integrated Persona into the LoginRadius SaaS (Software as a Service), hence giving you an option to integrate Persona on your website. All you have to do is select it in your LoginRadius account and save, and Persona will appear on your site!! Isn’t that cool and simple?

We have also integrated Persona into our 6 plugins for Drupal, Joomla, WordPress, osCommerce, PrestaShop and DotNetNuke, as well as in our 6 SDKs for PHP, .NET, Java, Python, Ruby on Rails, and Classic ASP. So if your web application is built on any of these technologies, we have simplified Persona’s integration process for you. Click here to learn more about how to integrate Persona through LoginRadius.

So now you may be wondering, why would a website owner integrate Persona? Persona allows users who do not wish to use their social accounts to create an account on your website with just their email address, and they can then use that username/password combo on any other Persona enabled website!

We will be writing a blog series on Persona to further explain how it works, but in meantime, if you have any questions, please post it as a comment or send us an email. And yes, please let us know what you think about the Persona integration.

Love,