Tag Info

Hot answers tagged

42

If you have access, check the Security Event logs: eventvwr.msc . Look for failed logon events and you will see your password as an unknown user account if the logging is set up to record those kinds of events. EDIT I just tested this on Win7 SP1. It requires that Failure Auditing is enabled. I tried to log in with a bogus username, and this was the ...


17

Let me preface what will probably be a longish answer with "There is no simple solution". Solving this will take some strategic work (which is why I recommended not moving this to SF). Now I will explain why. Windows, at its core, is mostly based on the DAC model of access control. Everything in the OS is securable with an ACL - files, folders, ...


10

The question is a bit hard for me to decipher, but I am going to assume you are considering authenticating users by having the user present a username and password, and also having the user authenticate with a private key (client cert) that is stored on the user's device. Short answer: yes, this is generally beneficial. If the user authenticates by both a ...


10

You put in the DMZ the servers which must be accessed from the outside. Since they are reachable from the external World (which is assumed hostile), these servers are potentially subject to hijack by attackers. The DMZ is a containment area so that a subverted server does not gain immediate access to your most valuable data (which will be presumably kept in ...


8

Having done the same mistake myself a couple of years ago: Most protocols/software will return an error code if you try to login with a valid username (other than "anonymous") and an empty password. That is even true for most systems that allow some kind of anonymous usage without being logged in at all. For LDAP, however, the common case is that the ...


8

ARP poisoning and IP spoofing are one way to do this with nothing more than a node on the network. In general, what you end up doing is impersonating the AD server during negotiation. The technical details probably aren't interesting in this context, but if you pretend to be the AD server, you can do a lot of things. One of these things might be to ...


7

I believe you need to have the domain administrator credentials to join a domain (or an account which has been delegated this ability). It should not be possible for a user to just add their personal computer to a domain. You should not be giving users the ability to copy system files off their work pc to their home pc (do not give them local admin ...


5

I'm not sure your security expectations here are realistic. If someone gets access to your DC in such a way that allows them to change arbitrary account passwords, then you've got plenty of bigger problems to worry about. If they could re-boot the system in order to force their password change to take effect (after which point, your hypothetical additional ...


5

Assuming that the LDAPS server does not have security holes, exposing it to the wide Internet should be no more risky (and no less) than exposing a HTTPS Web server. With LDAPS (SSL outside, traditionally on port 636, LDAP protocol in it), the authentication requested by the server will be performed under the protection of SSL, so that's fine (provided that ...


5

You need to distinguish between two types of non-personal account: Generic accounts are accounts that multiple humans can login to. These are generally bad as you lose accountability. If John and Fred both have access, and a malicious event occurs, who do we blame - John or Fred? Service accounts are used by applications, not by humans. Provided these are ...


4

Most places use radius in combination with a backend authentication system. Freeradius could do the job and integrates with Active Directory: http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO Cisco ACS can do the job and also integrates with AD, though in my experience this can be cludgey. It supports policies and of course can ...


4

The answer to this depends on exactly how you'd like to see/manage this data. My recommendation would be PowerShell to get all of this. If you do choose to user PowerShell, you can either use the native AD Cmdlets or Quest's free Cmdlets (http://www.quest.com/powershell/activeroles-server.aspx). To use the native Cmdlets, you must have at least one ...


4

Microsoft Dynamic DNS allows hosts to request a specific host name they would like to use. (That's what the dynamic means!) As you'd expect, you can't use this feature to steal an existing host's name, but there's a related attack where you steal the name of a host that doesn't exist, but that clients look for as part of an autodiscovery protocol. For ...


4

In worst case an attacker can run query of his choice in LDAP directory. Results may differ but definitely you don't want attacker to do this. If you are using .NET framework, you could use AntiXSS library. I know that LDAP injection is not XSS, nevertheless XSS is also a form of injection and correct way to prevent this kind of vulnerabilities is to ...


4

It really depends on the technology you use to implement multifactor auth. If you use smartcards with Active Directory then you need to modify all client devices to support smart cards and configure each user account in AD for certificates. You don't have to modify IIS if you are planning on doing just Windows auth, but if you want mutual auth in IIS with ...


4

The answer is simple: do not allow Domain Admins. Give access to specific functions to specific people who are in the job of administration. The "Domain Admin" group should be empty with alerts when a user is added to this group. In small teams, this might be a little tricky, but you can include people outside of the IT admin staff for oversight, and you ...


4

1- Is it possible to force actions like "reset password" to require the approval of more than a single administrator? Its good idea to separate the creation of users from password reset, you could assign user creation to an admin, and leave the password reset to Help Desk for example. In active directory you don't need domain admin to create users, you ...


4

The biggest reason I can think of as to why they might want to use RC4 is because of compatibility with Jira (and or this custom auth backend that we cannot vet.) AES128 support was introduced along with Server 2008 and Vista, and AES256 with 2008 R2 and Win7. However, the KDC will automatically negotiate down to (for instance) RC4 when talking to, say, a ...


4

I would not say it is common to expose LDAP services to the internett. What business case do you have to do this? Is is much like you do not want to expose your database server to the Internett. It is usually access only via. DMZ services, while your LDAP rests on the internal network. If I do Shodan search for port:389 I get no results, compared to MySQL ...


4

Several cloud vendors require LDAP access to AD in order to authenticate users... I can name 10 off the top of my head; so it's not uncommon in a limited scope. I would say it is unwise to open up LDAP to the broad internet (no IP filter) without additional controls (VPN, authentication,etc) Since you're exposing your LDAP server to additional load, I ...


4

The only way to have a secure authentication system for a company that can still function while the corporate network is unavailable, is to not use the corporate network. Consider hosting this service in the cloud, or having a cloud based hot-backup. Having a copy of the authentication database on each device is vulnerability, and a clear violation of ...


3

I'm not sure what OAuth gives you that can't be accomplished using other means. WCF + Rest works very well with claims based authentication bundled in WIF. Since WCF implies you're using ASP.NET I recommend using Windows Identity Foundation (WIF) on the server side. Check out this ebook for more info. Next you need a way to expose AD to your app. You ...


3

Assuming all your accounts are stored in Active Directory, and only AD, and you will not accept any account registered at an external provider, it's hard to see additional benefit of simply using OAuth solely as the protocol to authenticate* users registered on your AD. OAuth has a different use-case, it is designed to fit for federation scenarios: ...


3

Honestly, I don't know. What you could do is log in to a computer requiring a network connection to log on (no offline profiles), make some test connections to show that the token is working. Then lock the computer remove the network connection and log back on. Turn off your domain controller, and If you cant get onto any network shares then the computer had ...


3

The historical password hashes are stored in the SAM along with your current one, so are certainly equally breakable. I used to run password strength audits for large financials, and part of the output would be analysis of the number of individuals who reused passwords with just a change to the final digit (guess how large a percentage does it!) PWDump and ...


3

Years ago I worked at a school board of 40,000+ users/staff, and each user had an AD account. There was an Identity Management System in place, so the student records would populate AD. As long as the records were in the student system in a given state, the students existed in AD, but disabled if they had graduated, or whatever. Once the state of the ...


3

If there is a trust relationship already established Kerberos is used. NTLM is used when authenticating to a machine using an IP address if the machine is in a different forest that is using NTLM the target machine isn't in the domain the machines are not on the domain if firewalls block the kerberos traffic Microsoft has information on their use of ...


3

Mitigation 1: Use two-factor authentication, for logging into admin accounts. Mitigation 2: Give helpdesk staff a tablet or netbook that they can carry with them. Instead of typing their password into the user's machine, they could log into their tablet/netbook and use the internal remote administration services to administer the user's machine. Make this ...


3

Besides the very basic rule of "don't store credentials in configuration files"... I'm not entirely sure what the development team was thinking, but you can use Forms Authentication with SSRS: http://technet.microsoft.com/en-us/library/ms152899.aspx. It is a pretty hairy design, especially if its designed to continue using SQL to store the users. Now, ...


3

No, because the accountability is too low and chances are high your WPA2 password would leak out. When using RADIUS all users have their own password and usernames to authenticate to the AP. Chances of users sharing the WPA2 password to the wifi network is larger than them sharing their own personal username and passwords. This increases security in two ...



Only top voted, non community-wiki answers of a minimum length are eligible