[SSSD] Remote user use-case

Simo Sorce ssorce at redhat.com
Sun Nov 7 13:10:40 UTC 2010


On Sun, 07 Nov 2010 07:16:24 -0500
Stephen Gallagher <sgallagh at redhat.com> wrote:

> I'm also wary of ever allowing an unauthenticated user access to a VPN
> shared secret, but if it was contacting a special VPN concentrator
> created for this purpose that only allowed authentication with
> one-time-passwords and only provided access to the LDAP server and
> authentication server, then I suppose I can live with that. But that's
> putting an awful lot of additional responsibility on the IT staff to
> make sure that connection is secure. As well as additional hardware.

Why do you say you are going to give an unauthenticated user access to
a shared secret ?

The best course of action would be for helpdesk to give a short lived
set of credentials to the user via telephone. This set of credentials
would be usable only to set up the VPN. Nothing shared, and they would
be expired as soon as helpdesk confirms you got access with your normal
credentials.

The only thing it requires is a way to call the VPN software from GDM.
But the only stuff you'd be allowed to set are your temporary
VPN username and password or OTP token, or ...

Once the VPN connection is established, you will try to login with your
username and the new password set by helpdesk (this will hopefully
force a password change too, but that's up to how helpdesk setup their
password change procedures). Once you are in, the helpdesk VPN can be
terminated.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York



More information about the sssd-devel mailing list