Author: sparks Date: 2011-04-02 23:43:46 +0000 (Sat, 02 Apr 2011) New Revision: 704
Added: community/trunk/en-US/Yubikey.xml community/trunk/en-US/Yubikey.xml.patch Removed: community/trunk/en-US/Yubikey.xml Modified: community/trunk/en-US/Encryption.xml community/trunk/en-US/Secure_Network.xml Log: Moved VPN under the Encryption section
Modified: community/trunk/en-US/Encryption.xml =================================================================== --- community/trunk/en-US/Encryption.xml 2010-11-27 08:35:11 UTC (rev 703) +++ community/trunk/en-US/Encryption.xml 2011-04-02 23:43:46 UTC (rev 704) @@ -12,7 +12,6 @@ <para> Data at rest is data that is stored on a hard drive, tape, CD, DVD, disk, or other media. This information's biggest threat comes from being physically stolen. Laptops in airports, CDs going through the mail, and backup tapes that get left in the wrong places are all examples of events where data can be compromised through theft. If the data was encrypted on the media then you wouldn't have to worry as much about the data being compromised. </para> - </section> <section id="sect-Security_Guide-Encryption-Protecting_Data_at_Rest-Full_Disk_Encryption"> <title>Full Disk Encryption</title> <para> @@ -34,6 +33,7 @@ File based encryption is intended to protect a file after it has left your computer, such as when you send a CD through the mail. Some file based encryption solutions will leave remnants of the encrypted files that an attacker who has physical access to your computer can recover under some circumstances. To protect the contents of those files from attackers who may have access to your computer, use file based encryption combined with another solution such as full disk encryption. </para> </section> + </section> <section id="Security_Guide-Encryption-Data_in_Motion"> <title>Data in Motion</title> <para> @@ -42,13 +42,7 @@ <para> Data in motion is particularly vulnerable to attackers because the attacker does not have to be near the computer in which the data is being stored rather they only have to be somewhere along the path. Encryption tunnels can protect data along the path of communications. </para> - </section> - <section id="Security_Guide-Encryption-Data_in_Motion-Virtual_Private_Networks"> - <title>Virtual Private Networks</title> - <para> - Virtual Private Networks (VPN) provide encrypted tunnels between computers or networks of computers across all ports. With a VPN in place, all network traffic from the client is forwarded to the server through the encrypted tunnel. This means that the client is logically on the same network as the server it is connected to via the VPN. VPNs are very common and are simple to use and setup. - </para> - </section> + <xi:include href="VPN.xml" xmlns:xi="http://www.w3.org/2001/XInclude%22%3E</xi:include> <section id="Security_Guide-Encryption-Data_in_Motion-Secure_Shell"> <title>Secure Shell</title> <para>Secure Shell (SSH) is a powerful network protocol used to communicate with another system over a secure channel. The transmissions over SSH are encrypted and protected from interception. Cryptographic log-on can also be utilized to provide a better authentication method over traditional usernames and passwords. @@ -63,4 +57,5 @@ <xi:include href="LUKSDiskEncryption.xml" xmlns:xi="http://www.w3.org/2001/XInclude%22%3E</xi:include> <xi:include href="7_Zip.xml" xmlns:xi="http://www.w3.org/2001/XInclude%22%3E</xi:include> <xi:include href="Using_GPG.xml" xmlns:xi="http://www.w3.org/2001/XInclude%22%3E</xi:include> + </section> </chapter>
Modified: community/trunk/en-US/Secure_Network.xml =================================================================== --- community/trunk/en-US/Secure_Network.xml 2010-11-27 08:35:11 UTC (rev 703) +++ community/trunk/en-US/Secure_Network.xml 2011-04-02 23:43:46 UTC (rev 704) @@ -7,11 +7,13 @@ <xi:include href="Wstation.xml" xmlns:xi="http://www.w3.org/2001/XInclude%22%3E</xi:include> <xi:include href="Server.xml" xmlns:xi="http://www.w3.org/2001/XInclude%22%3E</xi:include> <xi:include href="SSO_Overview.xml" xmlns:xi="http://www.w3.org/2001/XInclude%22%3E</xi:include> - <xi:include href="Yubikey.xml" xmlns:xi="http://www.w3.org/2001/XInclude%22%3E</xi:include> +<!-- Not ready for production + <xi:include href="Yubikey.xml" xmlns:xi="http://www.w3.org/2001/XInclude"></xi:include> --> <xi:include href="Pam.xml" xmlns:xi="http://www.w3.org/2001/XInclude%22%3E</xi:include> <xi:include href="Tcp_Wrappers.xml" xmlns:xi="http://www.w3.org/2001/XInclude%22%3E</xi:include> <xi:include href="Kerberos.xml" xmlns:xi="http://www.w3.org/2001/XInclude%22%3E</xi:include> - <xi:include href="VPN.xml" xmlns:xi="http://www.w3.org/2001/XInclude%22%3E</xi:include> +<!-- Moved VPN.xml to Encryption.xml + <xi:include href="VPN.xml" xmlns:xi="http://www.w3.org/2001/XInclude"></xi:include> --> <xi:include href="Firewall.xml" xmlns:xi="http://www.w3.org/2001/XInclude%22%3E</xi:include> <xi:include href="IP_Tables.xml" xmlns:xi="http://www.w3.org/2001/XInclude%22%3E</xi:include> </chapter>
Deleted: community/trunk/en-US/Yubikey.xml =================================================================== --- community/trunk/en-US/Yubikey.xml 2010-11-27 08:35:11 UTC (rev 703) +++ community/trunk/en-US/Yubikey.xml 2011-04-02 23:43:46 UTC (rev 704) @@ -1,75 +0,0 @@ -<?xml version='1.0'?> -<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [ -]> - -<section id="sect-Security_Guide-Yubikey"> - <title>Yubikey</title> - <para> - Yubikey is a hardware authentication token that utilizes open source software to operate. This token is a simple USB device that appears as a keyboard to your computer. The single button on the token provides a one time password (OTP) with each push that can be used to authenticate a user. Currently there are several different implementations of this solution of which we'll cover here. - </para> - <section id="sect-Security_Guide-Yubikey-Centralized_Server"> - <title>Using Yubikey with a centralized server</title> - <para> - A PAM module already exists in the Fedora repositories that allow authentication of computers that can contact an authentication server. The server can either be setup at the domain level or the Yubico's servers can be utilized. This method of authentication is a great enterprise solution where multiple users may need access to multiple computers on the domain. The steps below describe this setup. - </para> - <procedure> - <step> - <para> - Install <package>pam_yubico</package> - </para> - </step> - <step> - <para> - For two factor authentication open <filename>/etc/pam.d/gdm-password</filename> and locate the following line: - </para> - <para> - <command>auth substack password-auth </command> - </para> - <para> - In a new line after this add: - </para> - <para> - <command>auth sufficient pam_yubico.so id=16</command> - </para> - </step> - <step> - <para> - To simple use the yubikey token without your password remove the first line from the step above and replace it with the second. - </para> - </step> - <step> - <para> - Locate the yubikey token for the first yubikey you will be adding. This can be done by looking at the first 12 characters of any OTP or visit <ulink url="http://radius.yubico.com/demo/Modhex_Calculator.php"><citetitle>http://radius.yubico.com/demo/Modhex_Calculator.php</citetitle></ulink> and copy the Modhex encoded string after you enter an OTP into the textbox on the page. - </para> - </step> - <step> - <para> - Add user's yubikeys to the config file. This can be done either globally in <filename>/etc/yubikey_mapping</filename> or by individual user in <filename>~/.yubico/authorized_yubikeys</filename>. The following is the syntax: - </para> - <para> - <command>username:yubikey_token:another_yubikey_token</command> - </para> - </step> - <step> - <para> - Logout, when you attempt to log back in you should either be prompted to enter both your password and your yubikey OTP or both depending on how you configured your system. - </para> - </step> - </procedure> - <note> - <para> - A connection to the authentication server is required or proper authentication will not occur. This can be detrimental to systems that do not have constant network connectivity. - </para> - </note> - </section> - <section id="sect-Security_Guide-Yubikey-Local_Authentication"> - <title>Authenticating locally on a workstation</title> - - </section> - <section id="sect-Security_Guide-Yubikey-Web_Sites"> - <title>Authenticating to websites with your Yubikey</title> - <para> - While outside the scope of this guide Yubikey allows you to authenticate to websites supporting this authentication method. These websites typically support Yubico's authentication servers but some can be setup similar to the above centralized authentication. Yubico also provides OpenID services that can be utilized with certain websites. - </para> - </section> -</section>
Added: community/trunk/en-US/Yubikey.xml =================================================================== --- community/trunk/en-US/Yubikey.xml (rev 0) +++ community/trunk/en-US/Yubikey.xml 2011-04-02 23:43:46 UTC (rev 704) @@ -0,0 +1,75 @@ +<?xml version='1.0'?> +<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [ +]> + +<section id="sect-Security_Guide-Yubikey"> + <title>Yubikey</title> + <para> + Yubikey is a hardware authentication token that utilizes open source software to operate. This token is a simple USB device that appears as a keyboard to your computer. The single button on the token provides a one time password (OTP) with each push that can be used to authenticate a user. Currently there are several different implementations of this solution of which we'll cover here. + </para> + <section id="sect-Security_Guide-Yubikey-Centralized_Server"> + <title>Using Yubikey with a centralized server</title> + <para> + A PAM module already exists in the Fedora repositories that allow authentication of computers that can contact an authentication server. The server can either be setup at the domain level or the Yubico's servers can be utilized. This method of authentication is a great enterprise solution where multiple users may need access to multiple computers on the domain. The steps below describe this setup. + </para> + <procedure> + <step> + <para> + Install <package>pam_yubico</package> + </para> + </step> + <step> + <para> + For two factor authentication open <filename>/etc/pam.d/gdm-password</filename> and locate the following line: + </para> + <para> + <command>auth substack password-auth </command> + </para> + <para> + In a new line after this add: + </para> + <para> + <command>auth sufficient pam_yubico.so id=16</command> + </para> + </step> + <step> + <para> + To simple use the yubikey token without your password remove the first line from the step above and replace it with the second. + </para> + </step> + <step> + <para> + Locate the yubikey token for the first yubikey you will be adding. This can be done by looking at the first 12 characters of any OTP or visit <ulink url="http://radius.yubico.com/demo/Modhex_Calculator.php"><citetitle>http://radius.yubico.com/demo/Modhex_Calculator.php</citetitle></ulink> and copy the Modhex encoded string after you enter an OTP into the textbox on the page. + </para> + </step> + <step> + <para> + Add user's yubikeys to the config file. This can be done either globally in <filename>/etc/yubikey_mapping</filename> or by individual user in <filename>~/.yubico/authorized_yubikeys</filename>. The following is the syntax: + </para> + <para> + <command>username:yubikey_token:another_yubikey_token</command> + </para> + </step> + <step> + <para> + Logout, when you attempt to log back in you should either be prompted to enter both your password and your yubikey OTP or both depending on how you configured your system. + </para> + </step> + </procedure> + <note> + <para> + A connection to the authentication server is required or proper authentication will not occur. This can be detrimental to systems that do not have constant network connectivity. + </para> + </note> + </section> + <section id="sect-Security_Guide-Yubikey-Local_Authentication"> + <title>Authenticating locally on a workstation</title> + + </section> + <section id="sect-Security_Guide-Yubikey-Web_Sites"> + <title>Authenticating to websites with your Yubikey</title> + <para> + While outside the scope of this guide Yubikey allows you to authenticate to websites supporting this authentication method. These websites typically support Yubico's authentication servers but some can be setup similar to the above centralized authentication. Yubico also provides OpenID services that can be utilized with certain websites. + </para> + </section> +</section>
Added: community/trunk/en-US/Yubikey.xml.patch =================================================================== --- community/trunk/en-US/Yubikey.xml.patch (rev 0) +++ community/trunk/en-US/Yubikey.xml.patch 2011-04-02 23:43:46 UTC (rev 704) @@ -0,0 +1,64 @@ +Index: trunk/en-US/Yubikey.xml +=================================================================== +--- trunk/en-US/Yubikey.xml (revision 688) ++++ trunk/en-US/Yubikey.xml (working copy) +@@ -21,11 +21,55 @@ + <section id="sect-Security_Guide-Yubikey-Local_Authentication"> + <title>Authenticating locally on a workstation</title> + <para> +- Another PAM module is available that allows local authentication to a computer without the need of an external server. This solution trades some security with the flexibility of not needing network connectivity to login to a computer. ++ Another PAM module is available that allows local authentication to a computer without the need of an external server. This solution trades some security with the flexibility of not needing network connectivity to login to a computer. The steps below describe this setup. + </para> ++ <procedure> ++ <step> ++ <para> ++ Install <package>pam_yubico</package> ++ </para> ++ </step> ++ <step> ++ <para> ++ For two factor authentication open <filename>/etc/pam.d/gdm-password</filename> and locate the following line: ++ </para> ++ <para> ++ <command>auth substack password-auth </command> ++ </para> ++ <para> ++ In a new line after this add: ++ </para> ++ <para> ++ <command>auth sufficient pam_yubico.so id=16</command> ++ </para> ++ </step> ++ <step> ++ <para> ++ To simple use the yubikey token without your password remove the first line from the step above and replace it with the second. ++ </para> ++ </step> ++ <step> ++ <para> ++ Locate the yubikey token for the first yubikey you will be adding. This can be done by looking at the first 12 characters of any OTP or visit <ulink url="http://radius.yubico.com/demo/Modhex_Calculator.php"><citetitle>http://radius.yubico.com/demo/Modhex_Calculator.php</citetitle></ulink> and copy the Modhex encoded string after you enter an OTP into the textbox on the page. ++ </para> ++ </step> ++ <step> ++ <para> ++ Add user's yubikeys to the config file. This can be done either globally in <filename>/etc/yubikey_mapping</filename> or by individual user in <filename>~/.yubico/authorized_yubikeys</filename>. The following is the syntax: ++ </para> ++ <para> ++ <command>username:yubikey_token:another_yubikey_token</command> ++ </para> ++ </step> ++ <step> ++ <para> ++ Logout, when you attempt to log back in you should either be prompted to enter both your password and your yubikey OTP or both depending on how you configured your system. ++ </para> ++ </step> ++ </procedure> + </section> + <section id="sect-Security_Guide-Yubikey-Web_Sites"> +- <title>Authenitcating to websites with your Yubikey</title> ++ <title>Authenticating to websites with your Yubikey</title> + <para> + While outside the scope of this guide Yubikey allows you to authenticate to websites supporting this authentication method. These websites typically support Yubico's authentication servers but some can be setup similar to the above centralized authentication. Yubico also provides OpenID services that can be utilized with certain websites. + </para> + +
docs-commits@lists.fedoraproject.org