Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

my question is this:

Is there a way (software,hardware/token or web-ware) to use One Time Passwords in the following scenarios:

  • Logon to my pc/laptop (windows or ubuntu)
  • Logon to sites with OTP (without having an out-of-the-box support for OTP, which AFAIK non of them has).

Do you use any OTP solution ? Experiences so far ? I'm interested in both freeware/opensource and commercial (paid) solutions. Thanks in advance !!

share|improve this question
2  
The way the question reads to me is "can I use a one time password without ont-time password infrastructure" - to which the answer would be No. –  Rory Alsop Jan 17 '11 at 16:19
    
I don't understand your second scenario. "out of the box" refers to products, not sites. Though you can install opie-server and opie-client on any Ubuntu box. And I bet there are web hosting companies that offer out-of-the-box support for products like the RSA key fob. –  nealmcb Jan 17 '11 at 16:38
    
Updated to change wording to application. But in general, it depends on what the OP means by Out of the box. If using a hosting company, it could mean does their service offer it? If implementing your own website, yep - put on something like opie –  Rory Alsop Jan 17 '11 at 16:49
add comment

6 Answers

up vote 2 down vote accepted

Thanks for the mention, Tate. This is a great question. I interpret it as "how can I start moving toward stronger forms of authentication." There are a lot of parts to this question and some good answers, some ... still waiting for better answers.

Some background:

Protocols: Radius, LDAP, SAML, OATH. Radius is great for internal use (ldap is more of a directory protocol than an auth, IMO) and the last two are designed for external/internet auth. Choose an internal protocol and then an external method. Limiting yourself in this way keeps it clean and helps you to learn.

First, ubuntu: that's easy. you just need to learn a little bit about PAM - the Pluggable authentication module. PAM supports a bunch of protocols. Build the library for your protocol and then edit the services files in /etc/pam.d/. So, sshd, login, su, sudo, whatever. Here's a doc on how to add two-factor authentication to SSH: http://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-secure-ssh-with-two-factor-authentication-from-wikid/. Just do the same for login, and you should be good. One caveat: leave a way to get in! You don't want to be locked out. This is one reason why most companies only worry about remote access and not local access.

Windows login: This means changing the windows login or GINA. Do this at your own risk as well. Check out the opensource pgina project. I tested this with WiKID using radius on windows xp a long time ago and it worked great. But none of our customers implemented this because of the risk of lock-out and potential support costs.

Websites: Increasingly companies are separating "login creds" from "accounts" and seeing that they can get more of the latter if they let someone else handle the former. Hooray. However, not all the authenticating parties are doing two-factor auth. Google is the only one. You may not be comfortable with google knowing your every login, though and you might want a server that you can control and use for other services too.

If so, our open-source version includes a plugin for GoogleSSO for Google Domains: http://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-wikid-strong-authentication-to-google-apps-for-your-domain/.

Good luck! HTH,

share|improve this answer
    
Thanks for the great resources !!! –  labmice Mar 1 '11 at 6:14
add comment

OPIE Authentication System ("One time Passwords In Everything") works on most any BSD/Linux/Unix system - e.g. opie-server and opie-client packages under Ubuntu. It can be used e.g. in PAM authentication or for web servers. There are clients (at least) for Windows and MacOS also.

If a site is a "relying party" for some sort of federated authentication (e.g. OAuth, OpenID, Shibboleth, SAML) you can use OTP once to log in to an identity provider that supports it, and use what are essentially one-time credentials from them to log in to the site.

share|improve this answer
add comment

You could try a Yubikey (http://www.yubico.com/yubikey) as a reasonably priced alternative for the second of your problems, provided the site supports OAUTH. This is a OTP solution, keyed off an AES counter, that is implemented as a USB keyboard (so drivers are seldom needed).

share|improve this answer
add comment

This is how tokens such as the ubiquitous RSA key fob work. The number generated is effectively a one-time password (okay, it isn't really, but the level of entropy means that for most purposes you can use it as a one-time password)

Works with Windows and Linux and various other setups.

Many web applications use it, but they have to have support for it, as for any OTP solution you need to have coordination between the password you provide and the one the site/application expects.

share|improve this answer
add comment

You may also check out http://www.wikidsystems.com/

The WiKID Strong Authentication System is a patented dual-source, software-based two-factor authentication system designed to be less expensive and more extensible than hardware tokens.

"Fundamentally, WiKID Strong Authentication works this way: A user selects the domain they wish to use and enters the PIN into their WiKID Two-factor client. It is encrypted with the WiKID Server's public key - assuring that only that server can decrypt it with its private key. If the server can decrypt the PIN and it is correct and the account is active, it generates the one-time passcode (OTP) and encrypts it with the client's public key. The user then enters their username and the OTP into whatever service they are using, a VPN e.g., which forwards it to the WiKID Server for validation."

share|improve this answer
2  
In what sense is this a "two factor" authn system? Besides the PIN, what other token-like factor does the user have? –  nealmcb Jan 18 '11 at 1:32
1  
It is a software-based system, but unlike most that use shared-secrets, WiKID uses public keys. The user enters a PIN into the token; it's encrypted by the user's private key and sent to the server. If the PIN is correct, the account valid etc, an OTP is generated on the server, encrypted and returned to the user. Think of is like certs, except: there is an extra check - the PIN on the server; there is an OTP, so it works on many UIs; and it will run on wireless devices as well as PCs. –  nowen Mar 8 '11 at 15:17
add comment

For basic OTP implementations I've been looking at AuthAnvil (http://www.scorpionsoft.com/) lately. It works for Windows, and can tie into IIS very easily.

However, I'm pretty sure it doesn't support any Linux variants.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.