A process of proving that an entity (commonly a user or organization) is who they claim to be, or who they were previously identified as being. Authentication does not guarantee that particular entity's identity absolutely, it just proves that they are the same agent that has previously successfully ...
33
votes
9answers
5k views
Why is SSH password authentication a security risk?
Most guides for OpenSSH configuration advise to disable password authentication in favor of key-based authentication. But in my opinion password authentication has a significant advantage: an ability ...
32
votes
5answers
2k views
Is it valid to have part of an IPv4 address set to zero?
I am working on a change in a Java EE application that would authenticate based on the user's IP address using ServletRequest.getRemoteAddr. We store IP address ranges (FROM_IP and TO_IP) in a ...
32
votes
5answers
5k views
Best system for managing ssh keys?
I've got several client computers (i.e. laptops, desktops, etc.), and I connect to several server machines that I manage, and I log into them all via SSH. I can imagine several schemes of managing ...
23
votes
6answers
2k views
SSH: Two Factor Authentication
I currently have a Ubuntu Server 12.04 running OpenSSH along with Samba and a few other services. At the current time I have public key authentication set up, and I'm wondering if it's possible to set ...
20
votes
22answers
3k views
Leaving my wifi open for the world
For my home I want to be a nice neighbor actually I have let my wifi open for the past maybe 6 or 7 years. I know that WEP, etc can be cracked within a couple of minutes but my neighbors son who works ...
19
votes
2answers
3k views
Authenticating OpenBSD against Active Directory
Edit: Reformatted this as Q&A. If anyone can change this from Community Wiki to a typical question, that's probably more appropriate as well.
How can I authenticate OpenBSD against Active ...
18
votes
2answers
31k views
Howt to grant network access to LocalSystem account?
How do you grant access to network resources to the LocalSystem (NT AUTHORITY\SYSTEM) account?
Background
When accessing the network, the LocalSystem account acts as the computer on the network:
...
17
votes
2answers
6k views
Setting Mercurial with Active Directory authentication and authorisation
I am evaluating the possibilities of moving my organisation to Mercurial, however I am stumbling on two basic requirements which I can't find proper pointers to.
How do I set up Mercurial's central ...
16
votes
6answers
21k views
Google Chrome: passthrough Windows authentication
The I.T. dept is considering allowing installation and automated deployment of Google Chrome browser to 100+ desktops. One of the requirements is for domain credentials to be passed through. The ...
16
votes
6answers
1k views
Is OpenID this easy to hack or am I missing something?
For those Relying Parties (RP) that allow the user to specify the OpenID Provider (OP), it seems to me than anyone that knows or guesses your OpenID could
Enter their own OP address.
Have it ...
15
votes
6answers
34k views
How to configure basic authentication in Apache httpd virtual hosts?
I'm trying to configure mercurial access using Apache http.
It requires authentication. My /etc/apache2/sites-enabled/mercurial looks like this:
NameVirtualHost *:8080
<VirtualHost *:8080>
...
13
votes
14answers
13k views
Alternatives to RSA SecurID? [closed]
Have you used, and would recommend, an alternative to RSA SecurID for two-factor authentication?
13
votes
7answers
3k views
Should we disable the root user?
Should we remove the root password, disable remote login and basically require adminstrators to use sudo to perform administrative actions?
12
votes
2answers
3k views
Public key authentication or similar over HTTP/HTTPS?
Is it possible to configure Apache, or some other web server, to use some kind of public-key authentication?
What I would like, ideally, is to be able to give users access to a site without the need ...
12
votes
2answers
165 views
SSH only works after intentionally failed password
So, I'm having a rather weird problem. I have a server, that when I try to SSH into, immediately closes the connection if I type in the correct password on the first attempt. However, if I ...
12
votes
4answers
2k views
OpenLDAP, Samba and password aging
I'm configuring a system in which all IT resources are available through a single user-password pair, be it access to shell on the servers, logging to Samba domain, WiFi, OpenVPN, Mantis, etc. (with ...
11
votes
1answer
12k views
Troubleshooting Windows Authentication problems (no challenge) in IIS 7.5?
I know that there are thousands of reports of people having trouble getting Integrated Windows Authentication to work with IIS, but they all seem to lead to web pages that don't apply or solutions ...
11
votes
2answers
2k views
The Story of secure user-authentication in squid
once upon a time, there was a beautiful warm virtual-jungle in south america, and a squid server lived there. here is an perceptual image of the network:
<the Internet>
...
10
votes
2answers
9k views
How to stop Outlook 2007 asking for credentials when using RPC over HTTPS
I've configured several of our outlook 2007 clients (connected to Exchange 2003) to use RPC over HTTPS. This allows our users to connect to the Exchange server remotely without having to connect using ...
9
votes
7answers
955 views
is it okay to use random URLs instead of passwords? [closed]
Is it considered "safe" to use URL constructed from random characters like this?
http://example.com/EU3uc654/Photos
I'd like to put some files/picture galleries on a webserver that are only to be ...
9
votes
9answers
14k views
How to create an SHA-512 hashed password for shadow?
The previous SF questions I've seen have lead to answers that produce MD5 hashed password.
Does anyone have a suggestion on to produce an SHA-512 hashed password? I'd prefer a one liner instead of a ...
9
votes
4answers
3k views
How practical is it to authenticate a Linux server against AD?
We utilise both Windows and Linux server at our software development company.
One of the friction points with this setup is that we don't have a single sign-on solution. Being more of a Microsoft ...
9
votes
1answer
4k views
Why is Mac OSX Lion losing login/network credentials?
Symptoms
At work we have OSX 10.7.3 installed and every once in a while I will see the following behaviors:
If the the screen is locked, then multiple tries of the same user/pass are not accepted.
...
9
votes
3answers
1k views
Web Deploy to IIS 7 with Pass-through authentication
After much trial and error configuration, I'm currently able to script msdeploy.exe to deploy a package built in Visual Studio 2010 to a remote server running IIS 7.5 with a command line like:
Basic ...
8
votes
2answers
3k views
Is SSH Key Exchange more secure than password authentication?
Remote users connect to several services at our main office over the internet using SSH. The SSH password is synched with their LAN A/D account.
Would having users bring a copy of an SSH key home ...
8
votes
2answers
6k views
public key authentication fails ONLY when sshd is daemon
(This question had been erroneously asked in stack overflow -- I'm sorry for that -- and closed as "off topic")
I have no clue on how this happens. The distro is Scientific Linux 6.1 and everything ...
8
votes
2answers
15k views
LDAP authentication for SonicWALL VPN
I'm trying to configure my SonicWALL to allow LDAP authentication for VPN users. I've done this before with another device, and I remember it being pretty simple. But I can't get it to work this ...
8
votes
4answers
3k views
Good Shibboleth tutorials out there?
I am looking into using Shibboleth for authentication of webapplications at my organisation. I am very new to this subject and would like to read through some good tutorials, hands-on-lessons or ...
8
votes
3answers
303 views
Join ActiveDirectory (Win 2k8R2) to OpenDirectory(Snow Leopard)
The vast majority of questions and so on regarding the interoperability of Active and Open directories involves getting Mac clients to see an AD and auth against it.
What we'd like to do is get a ...
7
votes
7answers
17k views
Web interface to allow users to change their Active Directory password
I have a few web applications that use Active Directory to authenticate. What I would like to be able to do is provide a simple web page that would allow users to update their AD password.
This ...
7
votes
2answers
1k views
Can a Mac with OS X 10.5 (Leopard) authenticate with a Windows 2008 domain?
I would like to have my MacBook Pro authenticate against Active Directory running on Windows 2008. A couple of years ago I tried to set this up between OS X 10.4 and Windows 2003 but I wasn't ...
7
votes
3answers
276 views
Does a CA require a full-time administrator?
At my place of employment, we have skated by over the years without having an internal Certificate Authority. This has worked for us because there was no visible impact by not having trusted entities. ...
7
votes
1answer
1k views
Best practice for authenticating DMZ against AD in LAN
We have few customer facing servers in DMZ that also have user accounts , all accounts are in shadow password file.
I am trying to consolidate user logons and thinking about letting LAN users to ...
7
votes
4answers
2k views
Linux Central Authentication/Authorization Methods
I have a small but growing network of Linux servers. Ideally I'd like a central place to control User Access, change passwords, etc... I've read a lot about LDAP servers, but I'm still confused about ...
7
votes
2answers
1k views
How does Kerberos work with SSH?
Suppose I have four computers, Laptop, Server1, Server2, Kerberos server:
I log in using PuTTY or SSH from L to S1, giving my username / password
From S1 I then SSH to S2. No password is needed as ...
7
votes
1answer
765 views
802.1x computer authentication using hostname instead of cert
My configuration includes: Cisco ACS as RADIUS server, MS AD, MS PKI, Cisco 2960G switches. Workstations are 95% XP Pro SP3 fully patched, some 7 pro fully patched.
Computer cert autoenrollment ...
6
votes
4answers
12k views
How can I set up Redmine => Active Directory authentication?
First, I'm not an AD admin on site, but my manager has asked me to try to get my personal Redmine installation to integrate with ActiveDirectory in order to test-drive it for a larger-scale rollout.
...
6
votes
2answers
17k views
Can you pass user/pass for HTTP Basic Authentication in URL parameters?
I believe this is not possible, but someone I know insisted that it works. I don't even know what parameters to try, and I haven't found this documented anywhere.
I tried ...
6
votes
2answers
813 views
How To Organize and Use Multiple RSA Keys On Local Machine?
I have Server_A, Server_B, and Server_C.
I want to generate unique authentication keys for each, and organize them on my local machine running Lion like so:
Put server_A keys in ...
6
votes
5answers
12k views
How do I remove login credentials for a network location in Win7?
I just tried to access a folder like so:
\\somecomputeronmynetwork\somelocation$
When going to this location I'm prompted for a user name and password.
I put one in, and it let me in fine.
Now I ...
6
votes
2answers
381 views
How to set up SSH passwordless key authentication for remote access only, allowing local users to use passwords
I am trying to get an SSH server running Ubuntu 10.04 to allow password logons only when coming from the local network. For all other users, especially those logging in from the internet via the ...
6
votes
12answers
8k views
can't figure out why apache LDAP auth fails
Suddenly, yesterday, one of my apache servers became unable to connect to my LDAP (AD) server. I have two sites running on that server, both of which use LDAP to auth against my AD server when a user ...
6
votes
6answers
266 views
Certificate Authentication
I am currently working on deploying a website for staff to use remotely and would like to make sure it is secure.
I was thinking would it be possible to set up some kind of certificate ...
6
votes
2answers
2k views
Windows Authentication behaves oddly when VPN'd
We've got a few apps that rely on windows authentication - a couple of web apps with AD auth turned on and we usually connect to our SQL servers with windows auth. This normally runs without a hitch. ...
6
votes
1answer
347 views
WPA2 Enterprise without a Client-End Certificate
This question is practically identical to this question, but the difference being that the authentication server is freeRADIUS on Ubuntu and the access-points are DD-WRT.
Additionally, I would like ...
6
votes
3answers
623 views
How to create a Linux user without a password but being able to set it?
I have a username and an SSH key for a (hypothetical) guy and I need to give him admin access to a Linux (Ubuntu) server.
I want him to be able to log in via SSH and then set his password by himself ...
6
votes
1answer
1k views
Authenticate http requests EXCEPT for from this IP
I've got Nagios running on a server here (CentOS 5.3 w/ Apache 2.2.3-22.el5.centos) authenticating to my LDAP server, and all works well. However, I'd like to have some IP able to see the Nagios ...
6
votes
1answer
215 views
AD Cross-forest authentication - groups missing from PAC
I have an Active Directory setup consisting of 2 forests:
1 multi-domain forest with 1 forest root domain, and 2 direct child domains
1 single-domain forest for DMZ publishing purposes
I have ...
6
votes
1answer
106 views
Time taken for authentication to work again after changing system time
One of our domain controllers clock drifted way out of sync with the rest of the network (thanks to me forgetting to turn off VMWare's time synchronisation), which caused a whole bunch of servers to ...
6
votes
2answers
697 views
IIS Digest repeatedly asking for authentication
I have a development copy of an ASP.NET intranet site checked out and running on my local machine. We're using digest authentication to allow users to log in using their active directory accounts.
...
