[plug] security qn: auth from Windows clients to Linux server

[Shayne O'Neill]

Not entirely paranoid. My friends in the Cat collective in sydeny (a
community free hosting mob) got hosed for a few grand of bandwidth after a
kid at a uni over there used a keystroke logger to grab the passwords for
a box after an admin used putty from a library to fix some stuff.

--
Freedom's just another word for something new to regulate

On Sat, 30 Jul 2005 dsbrown at cyllene.uwa.edu.au wrote:

> Dear PLUG list members,
>
> A security question :-)   I want to avoid collateral damage from
> inadvertently having keystroke loggers grab authentication details from a
> compromised Windows machine, when used to remotely administer Linux
> machines hosting senmsitive data.
>
> Background:
> In my travels I remotely administer linux servers and workstations.   In
> some cases these Linux machines carry quite sensitive information.
> Security on those, per se, is not the problem.   SSH connections provide
> the transport layer security I need, but I am concerned with the prospect
> of keystroke loggers being planted on the Windows machines and reporting
> my authentication details back to a malicious third party.
>
> Possible solution:
> EAP-TLS seems like a Good Thing (tm) here... mutual authentication of the
> client and authentication server machines using certificates, before any
> connection is made to the interesting data.   If I have the correct
> handle on this, even if a Bad Guy (tm) got wind of my username and
> password he could not make use of it without also knowing the details of
> my certificates on the Windows machine(s) that I would use; thus it would
> be a case of needing both "something I know" plus "something I have" to
> breach security and begin impersonating me.
>
> SecureID style gadgets not possible - do I hear the word "budget" echoing
> down the corridor?
>
> Questions:
> 1.  Am I overly worried about nothing (= threat from keystroke loggers)?
> 2.  EAP-TLS is a reasonable plan?
> 3.  Something simpler to consider?
> 4.  Implementation... one Linux machine (which is NOT any of those
> carrying sensitive data!) can do the EAP-TLS function?   Is this wise?
> If so, authenticate to that machine and open ssh connection to a
> sensitive host, from it.   Sensitive hosts would only allow ssh from that
> "authentication server."
> 5.  Weaknesses / holes in point 4, or anywhere else??
>
> TIA,
> Denis
>
>
> ----------------------------------------------------------------
> This message was sent using the University of Western Australia
> Webmail system, based on the Horde/IMP framework.
> Students and staff - via https://webmail.uwa.edu.au/
> _______________________________________________
> PLUG discussion list: plug at plug.org.au
> http://www.plug.org.au/mailman/listinfo/plug
> Committee e-mail: committee at plug.linux.org.au
>