[plug] security qn: auth from Windows clients to Linux server

[Quintin Lette]

> > Possible solution:
> > EAP-TLS seems like a Good Thing (tm) here... mutual authentication of the
> > client and authentication server machines using certificates, before any
> > connection is made to the interesting data.   If I have the correct
> > handle on this, even if a Bad Guy (tm) got wind of my username and
> > password he could not make use of it without also knowing the details of
> > my certificates on the Windows machine(s) that I would use; thus it would
> > be a case of needing both "something I know" plus "something I have" to
> > breach security and begin impersonating me.
> >
> > SecureID style gadgets not possible - do I hear the word "budget" echoing
> > down the corridor?
> >
> > Questions:
> > 1.  Am I overly worried about nothing (= threat from keystroke loggers)?
> > 2.  EAP-TLS is a reasonable plan?
> > 3.  Something simpler to consider?
> > 4.  Implementation... one Linux machine (which is NOT any of those
> > carrying sensitive data!) can do the EAP-TLS function?   Is this wise?
> > If so, authenticate to that machine and open ssh connection to a
> > sensitive host, from it.   Sensitive hosts would only allow ssh from that
> > "authentication server."
> > 5.  Weaknesses / holes in point 4, or anywhere else??

The only  problem with having certificates as the second factor is if
the attacker can get a keylogger on your system they can probably get
the certificate off too!.

How many systems are you talking, and more to the point how many
people will be accessing each. I often use SecureComputing Safeword
tokens which I find reliable although it might be a bit hard to
implement without a doze server somewhere (I use them for
authenticating remote Citrix users generally so its not an issue
there). They are able to utilise radius and I have used them to
authenticate ssh as well as Citrix WI connections on a Solaris 10 box.

Just my 2c