3

Greetings.

I am the webmaster for a small, growing industrial association. Soon, I will have to implement a restricted, members-only section for the website.

The problem is that our organization membership both includes big companies as well as amateur “clubs” (it's a relatively new industry…).

It is clear that those clubs will share the login ID they will use to log onto our website. The problem is to detect whether one of their members will share the login credentials with people who would not normally supposed to be accessing the website (there is no objection for such a club to have all it’s members get on the website).

I have thought about logging along with each sign-on the IP address as well as the OS and the browser used; if the OS/Browser stays constant and there are no more than, say, 10 different IP addresses, the account is clearly used by very few different computers.

But if there are 50 OS/Browser combination and 150 different IPs, the credentials have obviously been disseminated far, and there would be then cause for action, such as modifying the password.

Of course, it is extremely annoying when your password is being unilaterally changed. So, for this problem, I thought about allowing the “clubs” to manage their own list of sub-accounts, and therefore if abuse is suspected, the user responsible would be easily pinned-down, and this “sub-member” alone would face the annoyance of a password change.

Question: What potential problems would anyone see with such an approach?

2 Answers 2

1

You are creating a lot of police work for yourself. I would delegate.

Make one person at each organisation responsible for registering their members. Give them easy to use tools to do this. The registration should then record both the member details and the member's organisation. The registration process should make the member accept terms of use that include protecting and not sharing credentials. If there are complaints or evidence of abuse, make the relevant organisation's contact/registrar responsible for dealing with it. If an organisation fails to respond, you have the sanction of withdrawing access for all members of that organisation.

0

This may be what you are looking for.

http://www.ossec.net

You must log in to answer this question.