🚀 go-pugleaf

In article <brady-161292075059@jbrady.aero.org>, brady@osiapps.aero.org
(John Brady) wrote:
> 
> Has anyone tried using an in-line authentication box (like the
> Digital Pathways Defender 5000) with ARA?
> 
> An in-line authentication box would sit between the answering
> modem and the ARA server.  The user would have to prove his or her
> identity before the authentication box would complete the connection
> to the ARA server.  I guess the real question is can the ARA client
> software support this dialog prior to completion of the ARAP connection.
> 
Why would you want to do that since on an ARA dial-in the user has to
provide a valid username and password. Seems kind of redundant.

*******************************************************************
Peter Haase                                   haase@meediv.lanl.gov
Los Alamos National Laboratory                Applelink: HAASE
Mechanical Electronic Engineering Division    505-667-2684

In article <haase-161292215606@mac_dialin1.meediv.lanl.gov>,
haase@meediv.lanl.gov (Peter Haase) wrote:
> 
> In article <brady-161292075059@jbrady.aero.org>, brady@osiapps.aero.org
> (John Brady) wrote:
> > 
> > Has anyone tried using an in-line authentication box (like the
> > Digital Pathways Defender 5000) with ARA?
> > 
> > An in-line authentication box would sit between the answering
> > modem and the ARA server.  The user would have to prove his or her
> > identity before the authentication box would complete the connection
> > to the ARA server.  I guess the real question is can the ARA client
> > software support this dialog prior to completion of the ARAP connection.
> > 
> Why would you want to do that since on an ARA dial-in the user has to
> provide a valid username and password. Seems kind of redundant.
> 
> *******************************************************************
> Peter Haase                                   haase@meediv.lanl.gov
> Los Alamos National Laboratory                Applelink: HAASE
> Mechanical Electronic Engineering Division    505-667-2684

Reasons for needing external authentication:

1 -- We provide five different dial-in services for our employees and
would prefer not to enter and maintain account information in more that
one place.  That one place is the Defender 5000.

2 -- Simple passwords have been deemed unacceptable (by our security
folks),
so we use a little calculator-like device to generate a psuedo-random
sequence of passwords which is matched against an identically seeded
psuedo-random sequence.

3 -- Bureaucratic policy.

Enough reasons... Can any ARA experts out there pass judgement on whether
or not ARA will support in-line authentication?

John Brady                  **  brady@osiapps.aero.org
Network Engineer            **
The Aerospace Corporation   **  (310) 336-2220 (work)
P.O. Box 92957              **  (310) 336-7505 (fax @ work)
Los Angeles, CA 90009-2957  **  (310) 372-6793 (home)

haase@meediv.lanl.gov (Peter Haase) writes:

>In article <brady-161292075059@jbrady.aero.org>, brady@osiapps.aero.org
>(John Brady) wrote:
>> 
>> Has anyone tried using an in-line authentication box (like the
>> Digital Pathways Defender 5000) with ARA?
>> 
>> An in-line authentication box would sit between the answering
>> modem and the ARA server.  The user would have to prove his or her
>> identity before the authentication box would complete the connection
>> to the ARA server.  I guess the real question is can the ARA client
>> software support this dialog prior to completion of the ARAP connection.
>> 
>Why would you want to do that since on an ARA dial-in the user has to
>provide a valid username and password. Seems kind of redundant.

Usernames and passwords do not provide physical authentication of the user
(i.e. anyone could call up with a valid username and password).  Security
Dynamics makes a product in which each authorized user gets a 'smart card'
which displays a constantly changing key number.  By requiring the user to
type in the key number along with name and password, the system can be
assured with a great degree of certainty that the person logging in is in
posession of the card.  Key numbers are only good once, so even if someone is
eavesdropping and manages to replay the session, the login would still fail.
There are a number of other options depending on security requirements.
 
I know that they are planning an ARA interface for this product, but am not
sure if it has been released yet.
 
Jeff


>*******************************************************************
>Peter Haase                                   haase@meediv.lanl.gov
>Los Alamos National Laboratory                Applelink: HAASE
>Mechanical Electronic Engineering Division    505-667-2684
-- 
Jeff Kyser      jkyser@netcom.com      {amdahl,apple,claris}!netcom!jkyser

In article <brady-161292075059@jbrady.aero.org>, brady@osiapps.aero.org
(John Brady) wrote:
> 
> Has anyone tried using an in-line authentication box (like the
> Digital Pathways Defender 5000) with ARA?
> 
> An in-line authentication box would sit between the answering
> modem and the ARA server.  The user would have to prove his or her
> identity before the authentication box would complete the connection
> to the ARA server.  I guess the real question is can the ARA client
> software support this dialog prior to completion of the ARAP connection.
> 
> 
>   Before authentication:
> 
>     ARA client --- Modem - - - - - - - - - Modem --- Defender 5000
> 
> 
>   After authentication (Defender finishes transparent connection):
> 
>     ARA client --- Modem - - - - - - - - - Modem ----- ARA server
> 																																																			^
>                                                    |
>                                                    |
>                                          The Defender is still
>                                          here, but "invisible"

I can't get into any specifics because my employeer would have to kill me
after I told you, but...

It is possible to do what you are asking. The ARA scripts have to be
modified to request the user's information that'd normally be provided to
your authentication system. By configuring the script to watch for the
Defender prompts, you can have ARA handle the login for your user.

We're not using the same hardware configuration or authentication system,
but
ours works. As a matter of fact, that's how I'm sending this note, via
NewsWatcher on top of MacTCP on top of ARA via a secured dial-in. AND I
LOVE IT!

Greg

Greg Ferguson
Programmer/Engineer
Desktop Networking System
SPS, World Marketing
Motorola, Inc.

In article <brady-161292075059@jbrady.aero.org> brady@osiapps.aero.org (John Brady) writes:

   Path: cayman!think.com!rpi!usc!news.aero.org!jbrady.aero.org!user
   From: brady@osiapps.aero.org (John Brady)
   Newsgroups: comp.protocols.appletalk
   Date: 16 Dec 92 16:04:16 GMT
   Followup-To: comp.protocols.appletalk
   Distribution: usa
   Organization: The Aerospace Corporation
   Lines: 35
   NNTP-Posting-Host: jbrady.aero.org

   Has anyone tried using an in-line authentication box (like the
   Digital Pathways Defender 5000) with ARA?

   An in-line authentication box would sit between the answering
   modem and the ARA server.  The user would have to prove his or her
   identity before the authentication box would complete the connection
   to the ARA server.  I guess the real question is can the ARA client
   software support this dialog prior to completion of the ARAP connection.


     Before authentication:

       ARA client --- Modem - - - - - - - - - Modem --- Defender 5000


     After authentication (Defender finishes transparent connection):

       ARA client --- Modem - - - - - - - - - Modem ----- ARA server
																																																			   ^
						      |
						      |
					    The Defender is still
					    here, but "invisible"


John,
	The GatorLink is currently being used in several environments that
do this. You can contact Security Dynamics at 617-547-7820 for information
about there hardware ACE server product. You can also contact LeeMah in
Hayward at 510-786-0790. The contact there was Norm Sutton. I am not sure
if anyone has used the Digital Pathways product but the concepts are so
similar that I doubt there would be any problem. Feel free to contact
sales@cayman.com for more information as they are pretty familiar with
what everyone is doing out there with the GatorLink.

								Ken
--
*******************************************************************************

 Ken Siegel                                           Internet: ken@cayman.com
 Cayman Systems, Inc                                     Phone: 617/494-1999
 26 Landsdowne Street                                      FAX: 617/494-9270
 Cambridge, MA 02139                                 AppleLink: D0523