Tag Archives: two-factor authentication

Two-factor SSH authentication via Google secures Linux logins

If you use Google Apps and have Linux machines you access via SSH, this is a handy method to add two-factor authentication to your environment:

When Google introduced two-factor authentication for the Google and Google Apps accounts, they also created a pluggable authentication module PAM for Linux. This is great news for people running Linux servers who want to protect their remotely-accessible SSH accounts with two-factor authentication. For free.

via Two-factor SSH authentication via Google secures Linux logins | TechRepublic.

RSA finally comes clean: SecurID is compromised

This is colossally bad for RSA and users of their SecurID tokens:

RSA Security is to replace virtually every one of the 40 million SecurID tokens currently in use as a result of the hacking attack the company disclosed back in March. The EMC subsidiary issued a letter to customers acknowledging that SecurID failed to protect defense contractor Lockheed Martin, which last month reported a hack attempt.

SecurID tokens are used in two-factor authentication systems. Each user account is linked to a token, and each token generates a pseudo-random number that changes periodically, typically every 30 or 60 seconds. To log in, the user enters a username, password, and the number shown on their token. The authentication server knows what number a particular token should be showing, and so uses this number to prove that the user is in possession of their token.

The exact sequence of numbers that a token generates is determined by a secret RSA-developed algorthm, and a seed value used to initialize the token. Each token has a different seed, and it’s this seed that is linked to each user account. If the algorithm and seed are disclosed, the token itself becomes worthless; the numbers can be calculated in just the same way that the authentication server calculates them.

via RSA finally comes clean: SecurID is compromised.