unified authentication

From: Jesse Guardiani (jesse_at_wingnet.net)
Date: 09/24/03

  • Next message: Jacques A. Vidrine: "Re: OpenSSH: multiple vulnerabilities in the new PAM code" 
    To: freebsd-security@freebsd.org
Date: Wed, 24 Sep 2003 10:27:37 -0400

    Howdy list,

    Sorry if this is a frequently discussed topic,
    or an off-topic question, but I couldn't find much
    info about my question by performing quick searches
    in the archives, and my question is pretty tightly
    related to security...

    Background:
    ===========
    I have a number of FreeBSD machines. Most are 4.x,
    but a few are 5.x (mainly the testing/devel machines).

    I also have a single Red Hat Linux machine (mostly
    a former employee's play toy), a legacy BSDi 4.1
    machine, and a single Windows 2000 Server.

    And, of coarse, I have a number of Cisco routers of
    all shapes, sizes, and capacities.

    I have recently been plagued by the security audit
    woes, as employees have left the company and new
    employees have come in. The former Sys Admin didn't
    keep a list of places where passwords are stored,
    and the company really has very little in the way
    of a security policy, so I'm having to audit and
    document as I go.

    The motivation behind this email is simply that I am
    seeking to end my security woes. I'd like to be able
    to quickly (10-30 minutes) setup and remove employees
    from the various servers/routers and have the knowledge
    that I haven't missed anything.

    I've been thinking about it, and it seems like it
    would be beneficial to define "security clearances"
    and possibly different passwords for each employee
    at each security clearance level. That way, if one
    password was somehow sniffed or stolen, the security
    breach might stand a better chance of being contained.

    Software:
    =========
    Here is a quick summary of the software we use:

    Mail Server:
    ------------
    qmail-1.03
    MySQL (for vpopmail authentication)
    vpopmail
    qmailadmin
    sqwebmail
    Apache 1.3.28 (PHP4, mod_perl)

    Web Server:
    -----------
    Apache 1.3.28 (PHP4, mod_perl)
    MySQL

    The mail server already has a robust, tightly integrated,
    and very fast authentication system with vpopmail + MySQL.
    And we are currently working on integrating this
    authentication system into our billing system.

    These facts lead me to believe that I would like
    our mail server's auth system to be totally separate
    from the "corporate" auth system. If we want an
    employee to have an email account, we will either
    set up an internal mail server, add the employee
    to the billing system with a free rate code, or develop
    some sort of automation system that takes the corporate
    auth database and merges it with the billing system.

    The web server, on the other hand, is a different
    matter altogether. I would like to see some meshing
    of the "corporate" auth system and the web server.

    This way, I could define a certain website or web
    page to be within a certain security clearance for
    read access and/or write access, and the employee would
    automatically have the appropriate access based on
    security clearance.

    Questions:
    ==========
    Anyway, I'm seeking more of a discussion than a single
    definitive answer at this point. I'm ashamed to admit
    it, but I'm really not aware of what my options are,
    or what the strengths and weeknesses of each option
    might be.

    Listed below are the buzz words I've heard which I
    think might be possible options:

    1.) Kerberos
    2.) PAM (Seems to be more of a library than a complete
        solution.)
    3.) LDAP
    4.) RADIUS
    5.) NIS/NIS+

    We already use RADIUS to authenticate our dialup
    pool, and I wouldn't mind using it to authenticate
    employees, but I'm not sure if I can use RADIUS to
    authenticate FreeBSD system logins and such. The rest
    of the above items are relatively foreign to me.

    At first, I thought Kerberos sounded like the best
    solution, but the more I read about it, the more I
    start to think it may be an aging solution and that
    I might be better served to go with something else.

    Then again, I think I've seen kerberos authentication
    options in my Cisco routers... so maybe it's a good
    choice after all...

    In conclusion, I'd love to hear how other people have
    defined and implemented their organization's security
    model. Any personal stories, website links, or advice
    would be welcome.

    Thanks! 

    -- 
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v)  423-559-5145 (f)
http://www.wingnet.net
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"
  • Next message: Jacques A. Vidrine: "Re: OpenSSH: multiple vulnerabilities in the new PAM code"

    Relevant Pages

    • Re: Access Denied to share with anonymous access disabled
      ... > Integrated Windows authentication, then you are looking at the classic ... > server, why should the server automatically be able to use your ... > ASPNet local user account full access to the share. ... > anonymous access with integrated windows security on the web site. ...
      (microsoft.public.inetserver.iis.security)
    • Re: Potential vulnerabilities of the Microsoft RVP-based Instant Messaging
      ... >> Further to Greg's comments about this Encode Security Labs ... >> NTLM for authentication, ... > NTLM is a unilateral authentication protocol where the server ...
      (NT-Bugtraq)
    • Re: WCF security advice (and clarification) needed
      ... You, the client, resolve the foo.mycompany.com hostname within your ... TCP/IP) with that ticket as the security token. ... There are two parties participating in a security scenario, the server ... HTTP supports other authentication ...
      (microsoft.public.dotnet.framework.webservices)
    • RE: ASP.NET + SQL Server Windows authentication
      ... The problem is actually related to ASP.NET security. ... | Trying to understand why I can not get SQL server to trust my IIS server. ... | applications access to the DB server via NT Authentication. ... Basic Authentication will transfer the PW ...
      (microsoft.public.sqlserver.security)
    • Re: Seucity audit
      ... Your security issues are not your server. ... In SBS land that $8,000 would be a waste of time because Foundstone ... You don't need to spend your security dollars on a security audit in SBS ... Buy employees a copy of Trend Micro's pccillian for home use, ...
      (microsoft.public.windows.server.sbs)