Two factor authentication solution

[wrights]

Hi,

 

I hope this won't be regarded as advertising (as I'm not charging anything).

 

I've been into loads of schools in the last few years installing XenApp / XenDesktop and two factor authentication seems pretty rare (despite BECTA saying it was a requirement if SIMS and similar were published). My guess is that this is down to costs - £45 - £110 per user isn't going to fly if you have 100 members of staff and 2,000 kids.

 

To solve the above I've written a two factor platform that you're welcome to install for free. It works on XenApp/XenDesktop, SonicWall, etc (pretty much anything. The website is WrightCCS - - Citrix two factor authentication

 

As above, no cost, install it, use it, don't pay for it. It supports hardware tokens (I got mine from Gooze.eu for about 9Euro), software tokens on the iPhone/Android/Blackberry (free), text message (you pay for the texts - the beta version will allow you to use any provider), and in the beta release it also supports voice call authentication (via Twilio).

The admin interface does single signon and runs over the network so you'd install the software and publish it via XenApp (or install it anywhere you want) and logged-on users can update their own details.

 

If anyone is interested let me know and I'll give you some help to get it installed (free).

 

Steve

[FN-GM]

That does deserve a thanked post. Would be good to have it for Windows Login as well

[wrights]

I've never used it but pGina allows you to use RADIUS for Windows Login, so this should work perfectly with SMS2.

If you setup pgina let me know - I'd love to document it and put that on the site for everyone else interested.

[plexer]

Could you provide support for yubikey as an authentication device?

 

Thanks

 

Ben

[Gatt]

That does deserve a thanked post. Would be good to have it for Windows Login as well

I use these guys for Windows Logins over RDP: https://www.duosecurity.com/

Nice little Android/iPhone App too...

[Steven_Cleaver]

Hi,

 

I hope this won't be regarded as advertising (as I'm not charging anything).

 

I've been into loads of schools in the last few years installing XenApp / XenDesktop and two factor authentication seems pretty rare (despite BECTA saying it was a requirement if SIMS and similar were published). My guess is that this is down to costs - £45 - £110 per user isn't going to fly if you have 100 members of staff and 2,000 kids.

 

 

To solve the above I've written a two factor platform that you're welcome to install for free. It works on XenApp/XenDesktop, SonicWall, etc (pretty much anything. The website is WrightCCS - - Citrix two factor authentication

 

As above, no cost, install it, use it, don't pay for it. It supports hardware tokens (I got mine from Gooze.eu for about 9Euro), software tokens on the iPhone/Android/Blackberry (free), text message (you pay for the texts - the beta version will allow you to use any provider), and in the beta release it also supports voice call authentication (via Twilio).

The admin interface does single signon and runs over the network so you'd install the software and publish it via XenApp (or install it anywhere you want) and logged-on users can update their own details.

 

If anyone is interested let me know and I'll give you some help to get it installed (free).

 

Steve

 

Completely agree with your comments as regards two Factor Authentication so have built this into our Gateway solution for access for Staff to MIS systems using an Encrypted App. I like the idea of staff and students accessing all resources remotely but it always worried me if a student got hold of staff logins and issues with MIS systems. As you say have seen a few systems where no Dual factor access to access to MIS systems and this always worried me.

[lmgtfy]

I use these guys for Windows Logins over RDP: https://www.duosecurity.com/

Nice little Android/iPhone App too...

 

Looks good do you remember how much it cost your school? It mentions $3 Per user per month so I'm hoping they have education pricing otherwise that's going to get expensive for us.

[Gatt]

I'm using it at home, so I'm on a free plan - get unlimited instances and about 1000 sms/calls free

But by using PUSH notifications or the phone app to generate a passcode that's keyed to my account - I dont even use them.

[wrights]

Yubikey should work fine as an authentication device. Using the admin console in SMS2 you can specify a manual OATH-TOTP shared secret, using the Yubikey personalisation tool you can load the same shared secret on your Yubikey.

 

As I understand it you'd need the Yubikey TOTP application installed on the PC, when you reached an authentication screen (in my case the Citrix Web Interface logon screen) you'd doubleclick the Yubikey TOTP application in the system tray and it would query the key and paste the correct code into the token box on the screen.

 

Steve

[wrights]

>https://www.duosecurity.com

 

 

SMS2 will do exactly the same functionality for free, Remote Desktop Services will require either pGINA as a linked to above (also free) or Microsoft's Threat Management Gateway software.

[plexer]

Yubikey should work fine as an authentication device. Using the admin console in SMS2 you can specify a manual OATH-TOTP shared secret, using the Yubikey personalisation tool you can load the same shared secret on your Yubikey.

 

As I understand it you'd need the Yubikey TOTP application installed on the PC, when you reached an authentication screen (in my case the Citrix Web Interface logon screen) you'd doubleclick the Yubikey TOTP application in the system tray and it would query the key and paste the correct code into the token box on the screen.

 

Steve

 

Hi Steve,

 

Thanks for that I guess I was thinking about yubikeys in normal mode forgot that new ones can do oath.

 

Ben

[Abe]

>https://www.duosecurity.com

 

 

SMS2 will do exactly the same functionality for free, Remote Desktop Services will require either pGINA as a linked to above (also free) or Microsoft's Threat Management Gateway software.

 

Are you (or anybody else) able to provide a any pointers on where to start with integrating SMS2 and pGINA for Remote Desktop Services authentication?

 

Cheers,

[Brixy]

SMS is possibly the weakest option as an authentication factor. The issue isn't even just the standard attack (sim swaps allow SMS messages to be redirected), but also there are now attacks possible on the SS7 network itself (the SS7 network is the internal communications that take place between the mobile phone operators, and on top of this SMS messages are sent in plain text).

[PotNoodleTech]

SMS is possibly the weakest option as an authentication factor. The issue isn't even just the standard attack (sim swaps allow SMS messages to be redirected), but also there are now attacks possible on the SS7 network itself (the SS7 network is the internal communications that take place between the mobile phone operators, and on top of this SMS messages are sent in plain text).

 

Are you a bot or something? Why are you replying to threads that have been dead for 15 years??

[jthompson]

Are you a bot or something? Why are you replying to threads that have been dead for 15 years??

 

[...waits until 2039...]

[Brixy]

No I am not a bot

[synaesthesia]

No I am not a bot

 

So the question you were asked stands?

[Brixy]

same here