3 ms·

My problem is that Microsoft doesn't allow swapping in and out of authentication plugins like PAM. I work primarily in a Windows shop, and I got the other co-w

My problem is that Microsoft doesn't allow swapping in and out of authentication plugins like PAM. I work primarily in a Windows shop, and I got the other co-workers in Linux because PAM supports seamless multi-factor auth. I would have went Windows, but its too obfuscated or hard to do that. LinOTP works very well. And LinOTP works with a wide variety of tokens. Don't be locked to a single vendor.

ShroudedNight 8y ago
> Microsoft doesn't allow swapping in and out of authentication plugins like PAM. FWIW, that's not strictly true. See: https://msdn.microsoft.com/en-us/library/windows/desktop/mt158211(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/desktop/mt1... I don't have enough experience to comment one way or the other about its difficulty.
- crankylinuxuser 8y ago
  Well, this certainly surprises me. I know last I looked, there was some discussion about MFA and requiring Azure. In the environment I work in, I'm not able to use services outside a very limited list, or I have to roll my own using established technologies (FedRAMP). So Azure is right out. So was using Amazon Directory Services. I know my colleagues are much more familiar with Windows, whereas I.. (look at username, relevant!). My solution, after assessing that Windows couldn't do 2 (or 3) factor, and it was stuck at login/password and some firewall blocking IP's, I knew what I had to do. And that meant Linux for the bastions, and LinOTP and appropriate config options to make it work. I was kind, and didn't inflict a AAA stack of "kerb, ldap, radius, and shib" on the Windows admins :) Well, that and I didn't want to be the sole maintainer of that system.
  - ShroudedNight 8y ago
    To be fair, the only reason I knew of this at all is because of a brief patronage of a library in Belgium during a trip I took in the summer of '99. The computer systems of said library used a bizarre system of time-limited authentication tokens stored on floppy disks that were used during the Windows log-on process. I was curious how it might have worked.
youdontknowtho 8y ago
You have to write a dll. It's not that big of a deal. That being said, I doubt there's much benefit to it when everything is said and done. (From a windows client perspective.)
- crankylinuxuser 8y ago
  "Not that big of a deal." you say? Then why is the documentation how to do this very sparse, and only for Win10? And if it's not a big deal, why is YubiKey making such a big deal? Well, because in the Windows world, switching in/out authentication subsystems is a arduous task surmountable by primarily Microsoft. And what would that be good for? Well, simply put would be a nice addition to a Windows Terminal Server. Turn a Windows TS into a proper bastion that requires 2fa. Us Linux admins have that with PAM. Sure would be nice to do the same for Windows. But right now, Windows is grossly deficient.
beagle3 8y ago
Back in the Win2000 days, we had GINA[0]; still worked on XP sans fast-user-switching, but killed on Vista+7+8+10 ; The wikipedia page says "credential providers" gives some of the functionality on those OSes though. I like Linux better too. [0] https://en.wikipedia.org/wiki/Graphical_identification_and_authentication https://en.wikipedia.org/wiki/Graphical_identification_and_a...

ShroudedNight 8y ago

> Microsoft doesn't allow swapping in and out of authentication plugins like PAM. FWIW, that's not strictly true. See: https://msdn.microsoft.com/en-us/library/windows/desktop/mt158211(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/desktop/mt1... I don't have enough experience to comment one way or the other about its difficulty.

crankylinuxuser 8y ago
Well, this certainly surprises me. I know last I looked, there was some discussion about MFA and requiring Azure. In the environment I work in, I'm not able to use services outside a very limited list, or I have to roll my own using established technologies (FedRAMP). So Azure is right out. So was using Amazon Directory Services. I know my colleagues are much more familiar with Windows, whereas I.. (look at username, relevant!). My solution, after assessing that Windows couldn't do 2 (or 3) factor, and it was stuck at login/password and some firewall blocking IP's, I knew what I had to do. And that meant Linux for the bastions, and LinOTP and appropriate config options to make it work. I was kind, and didn't inflict a AAA stack of "kerb, ldap, radius, and shib" on the Windows admins :) Well, that and I didn't want to be the sole maintainer of that system.
- ShroudedNight 8y ago
  To be fair, the only reason I knew of this at all is because of a brief patronage of a library in Belgium during a trip I took in the summer of '99. The computer systems of said library used a bizarre system of time-limited authentication tokens stored on floppy disks that were used during the Windows log-on process. I was curious how it might have worked.

youdontknowtho 8y ago

You have to write a dll. It's not that big of a deal. That being said, I doubt there's much benefit to it when everything is said and done. (From a windows client perspective.)

crankylinuxuser 8y ago
"Not that big of a deal." you say? Then why is the documentation how to do this very sparse, and only for Win10? And if it's not a big deal, why is YubiKey making such a big deal? Well, because in the Windows world, switching in/out authentication subsystems is a arduous task surmountable by primarily Microsoft. And what would that be good for? Well, simply put would be a nice addition to a Windows Terminal Server. Turn a Windows TS into a proper bastion that requires 2fa. Us Linux admins have that with PAM. Sure would be nice to do the same for Windows. But right now, Windows is grossly deficient.

beagle3 8y ago

Back in the Win2000 days, we had GINA[0]; still worked on XP sans fast-user-switching, but killed on Vista+7+8+10 ; The wikipedia page says "credential providers" gives some of the functionality on those OSes though. I like Linux better too. [0] https://en.wikipedia.org/wiki/Graphical_identification_and_authentication https://en.wikipedia.org/wiki/Graphical_identification_and_a...