Skip to main content

11 Top tips for two-factor authentication

Posted by: admin 12 years, 1 month ago

For a long time I have been meaning to pull together some of the top tips when setting up two-factor authentication. I expect this will be a moving target. Obviously, two-factor authentication is central to your network deployment, so even if that PCI QSA is breathing down your throat, take some time to do a bit of planning!

The Basics

  1. Read the fine manual. While we certainly cater to a quick install with our cheat-sheet, our installation manual is quite short too. You'll avoid some misteps.
  2. If you don't know what it does, you can probably leave it blank. A good example is Radius return attributes. Just forget about them if you're not using them. Another is the Registered URL - it is only used for mutual https authentication.
  3. Start simple. We highly recommend you route your two-factor authentication through a radius server such as NPS or Freeradius to separate authorization from authentication. This adds security in the long run. In the short run, it's extra complexity. Start by testing seeing if your network client (VPN, Webapp, SSH, e.g.) can talk Radius to WiKID directly, then add complexity.
  4. Test the server using the example.jsp page. This will let you know if you have a working server and it will expose you to the functionality in our API.

The next level

  1. Turn on debugging and see what is going on. Better to be familiar with this now when you don't need it. Chances are you will need to maintain your logs for compliance reasons. We recommend you not keep the logs in debug mode when in production though as they can quickly get big. Test archiving the logs,
  2. Check out the ADRegister scripts. They allow users to add their own tokens after they authenticate with their AD credentials. You'll want to set this up in your own directory or back it up. RPM updates may overwrite any changes you make.
  3. Separate Authentication and authorization using NPS or Freeradius. The WiKID server is not a real "radius server". It just talks radius to perform authentication.
  4. Configure the server to start automatically using the provided script and setting the server passphrase in /etc/WiKID/security

The Big Time.

  1. See what you can do with a custom jw.properties file for the PC token. (Hint: run in debug mode, limit the token to a single domain, configure pre-registration, etc.)
  2. Write your own WiKID software token a la Hurricane Labs!
  3. Write your own Network Client code using one of our wAuth components!
Current rating: 1

Recent Posts

Archive

2024
2022
2021
2019
2018
2017
2016
2015
2014
2013
2012
2011
2010
2009
2008

Categories

Tags

Authors

Feeds

RSS / Atom