Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I know about smart cards for login in to active directory enabled computers, but was wondering if there is an less restrictive (and less expensive) solution.

I am looking for something like an utility that lets me generate signed "login files", then I can just copy these files to any usb disk. When the user wants to login, they can just plug in the usb key with the file on it and are automatically logged in.

Obviously I (as the admin) could simply revoke these signed files and generate new signed ones whenever needed.

Is there such an utility / solution?

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

Not exactly. You can't use any old storage medium. They do make USB Smart Sticks (Smart card in usb stick form really). The problem is in how verification with smart cards works.

This is the generic/simplified version of the process: The "server" application knows the smart card's public cert. It creates a nonce and encrypts it with the public cert. It then sends the encrypted nonce to the client; client forward it to the smart card. The smart card decrypts it with the private key; the nonce is then sent back to the server (usually re-encrypted, but that is trivial to this process).

Note that the client computer never sees the private certificate. This way the client computer can not make a copy of the private certificate and the token is always needed for authentication. If it could be copied then it would be insecure; a "criminal" could copy your card, return it, and you wouldn't know that they have your authentication mechanism.

Smart Cards for PKI Login (Windows AD Login) aren't terribly expensive* if you avoid the packaged solutions. Of course those packaged solutions make the whole process easier and require much less knowledge on your part.

*Athena makes a PKI Smart Card for $36 each (cheaper in bulk).
*Aladdin makes a eToken Pro USB for $65

Side note: I really wouldn't recommend using tokens to completely replace passwords. If nothing else I'd recommend issuing the private keys with a password and setting the expiry for a year; even a simple password would be very effective in this situation (though you should still avoid dictionary words and anything blatantly obvious).

share|improve this answer
add comment

If you are looking for other two-factor authentication system, there are a number of possibilities other than smart-card based ones such as HOTP ($5 or less).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.