1. (Duo) Multifactor at Carleton College work in progress Rich Graves 8-28-14 1

2. Passwords Suck, and We Share Them 2 Since 2006, “carleton” not a valid password for most users, but…

3. “Policy” Background Since 2011, attempt to establish a norm that remote access to sensitive data requires two- factor authentication OpenVPN: certificate + password SSH: Duo (or RSA key) (key issues) Citrix: Duo for remote access only 3

4. 2-Factor for Web Applications “The new version of X won’t need a VPN anymore because it uses a secure web server instead of the old fat client” Some web applications limited to campus IPs Moving toward single sign-on with Shibboleth, Duo 2-factor authentication Duo supports ADFS, which is probably in our future To Datatel/Ellucian Colleague, “single sign-on” means a portal that caches your cleartext password and forwards it in a SOAP call 4

5. Wake Up! Hands-On Tech Time CentOS 6, Tomcat, Apache Shibboleth 2.4.1 Internet2 Multi Context Broker DuoSecurity web integration Thanks to InCommon and langedb (University of Chicago) for writing and packaging most of the code, making it “just a matter of following the directions” 5

6. Demo VM Download my OVF from DropBox: –http://preview.tinyurl.com/shib-centos6 –VM root login: root/shibboleth To play along and try Duo right now: –https://login.carleton-edu.com/ –user1/1 - user200/200 The password for “user101” is simply “101” 6

7. STRIDE Approach to SSO Threats From Adam Shostack’s book Threat Modeling and his card game “Elevation of Privilege” Spoofing & Tampering paramount here Key management may be your weak link Spoofing: Impersonating something or someone else. Tampering: Modifying data or code. Repudiation: Claiming to have not performed an action. Information Disclosure: Exposing info to someone not authorized. Denial of Service: Deny or degrade service to users. Elevation of Privilege: Gain capability without proper authorization. 7

8. Practical Complications Moodle, Zimbra email, and other applications have “local” users –Make them talk a protocol that JAAS can understand (LDAP, JODBC), add to login.config after LDAP/Kerberos Wholly proprietary web applications –ADFS+Duo handles some Microsoft stuff. –Or: reverse proxy, VPN, accept the risk. 8

9. User-Facing FAQs Work in progress https://wiki.carleton.edu/x/CI08AQ 9