S/Key is fine for a low-cost OTP implementation.
If you're really worried about it, though, then worry also about your sessions being hijacked after they're initiated. In which case you might consider an SSH tunnel to encrypt your traffic. SSH also lends itself better to tunneling other applications through it once you set up your access. Finally, it you don't have an easy way to carry around an SSH client with you (or don't trust other people's SSH clients), there are a few web-based SSH clients that you could offer from your own server -- so it's under your control but available from any browser.
Not a button gizmo but you seed it and print off a list of one-time passwords to carry around with you. To make it work with a mixed env you'd need to get it working on your Windows box then get the Linux box to auth from that or (easier) get it working on Linux then link it to Samba so Windows can auth off it.
U'll need to make a program which will generate a password which will only be accepted by ur home system for a specific time-frame.
For ex. When you run the program the output will valid be for a specific time duration and
will be accepted by your home security system as the system will also generate the same output while matching the hash, the trick is to get the same hash at both the places.
As an addendum to renegadeMind's post one way to do this would be to have a program on both ends that generates a sequence of random numbers. A property of Pseudo-random number generators (PRNGs) is that if you start them with the same seed, they will continue to generate the same sequence of random numbers. So depending on your experience (or availability of technology) you could set your network up to generate a new password every x minutes. Then you could carry around a piece of software that would run on a phone or other embedded hardware that calculates what step in the sequence the PRNG is up to and then list the current password for you.
Having said that the security of your system would be limited to the seed you choose and the time you choose that each key is valid for.
In addition to this there is probably a software solution that will do this for you. IMHO it's better to take the existing implementation then reinventing the wheel.
Edit: Wikipedia has a good article here. The part on specific OTP technologies will probably be the most relevant.
The first thing you need to decide is what authentication protocol will be your standard. I recommend Radius, especially for two-factor authentication in the enterprise. Radius is supported by all the major VPN & networking providers as well as all the major 2FA providers.
发布评论
评论（5）
S/Key 非常适合低成本 OTP 实施。
不过，如果您真的担心这一点，那么还要担心您的会话在启动后会被劫持。 在这种情况下，您可能会考虑使用 SSH 隧道来加密您的流量。 一旦您设置了访问权限，SSH 还可以更好地通过它为其他应用程序建立隧道。 最后，如果您没有一种简单的方法来随身携带 SSH 客户端（或者不信任其他人的 SSH 客户端），您可以从自己的服务器提供一些基于 Web 的 SSH 客户端 -因此它在您的控制之下，但可以从任何浏览器访问。
S/Key is fine for a low-cost OTP implementation.
If you're really worried about it, though, then worry also about your sessions being hijacked after they're initiated. In which case you might consider an SSH tunnel to encrypt your traffic. SSH also lends itself better to tunneling other applications through it once you set up your access. Finally, it you don't have an easy way to carry around an SSH client with you (or don't trust other people's SSH clients), there are a few web-based SSH clients that you could offer from your own server -- so it's under your control but available from any browser.
在 Linux 上，它称为 S/Key：此处
不是按钮小玩意，而是您播种的并打印出一份一次性密码列表并随身携带。 要使其在混合环境中工作，您需要让它在 Windows 机器上工作，然后让 Linux 机器从中进行身份验证，或者（更简单）让它在 Linux 上工作，然后将其链接到 Samba，以便 Windows 可以对其进行身份验证。
谷歌是你的朋友。
On Linux it's called S/Key: here
Not a button gizmo but you seed it and print off a list of one-time passwords to carry around with you. To make it work with a mixed env you'd need to get it working on your Windows box then get the Linux box to auth from that or (easier) get it working on Linux then link it to Samba so Windows can auth off it.
Google is your friend.
一种方法如下： -
您需要制作一个程序来生成一个密码，该密码仅在特定时间范围内被您的家庭系统接受。
对于前。 当您运行程序时，输出将在特定的持续时间内有效，并且
将被您的家庭安全系统接受，因为系统在匹配哈希时也会生成相同的输出，技巧是在两个地方获得相同的哈希。
我想这需要更多的头脑风暴！
One approach could be as follows:-
U'll need to make a program which will generate a password which will only be accepted by ur home system for a specific time-frame.
For ex. When you run the program the output will valid be for a specific time duration and
will be accepted by your home security system as the system will also generate the same output while matching the hash, the trick is to get the same hash at both the places.
I guess this will need more brainstorming!!!!
作为 renegadeMind 帖子的附录，一种方法是在两端都有一个生成随机数序列的程序。 伪随机数生成器 (PRNG) 的一个特性是，如果您使用相同的种子启动它们，它们将继续生成相同的随机数序列。 因此，根据您的经验（或技术的可用性），您可以将网络设置为每 x 分钟生成一个新密码。 然后，您可以随身携带一个在手机或其他嵌入式硬件上运行的软件，该软件可以计算 PRNG 执行到序列中的哪一步，然后为您列出当前密码。
话虽如此，您的系统的安全性将仅限于您选择的种子和您选择的每个密钥的有效时间。
除此之外，可能还有一个软件解决方案可以为您完成此操作。 恕我直言，最好采用现有的实现，然后重新发明轮子。
编辑：维基百科有一篇很好的文章这里。 关于特定 OTP 技术的部分可能是最相关的。
不过祝你好运！
关于 PRNG 的 wiki 文章
As an addendum to renegadeMind's post one way to do this would be to have a program on both ends that generates a sequence of random numbers. A property of Pseudo-random number generators (PRNGs) is that if you start them with the same seed, they will continue to generate the same sequence of random numbers. So depending on your experience (or availability of technology) you could set your network up to generate a new password every x minutes. Then you could carry around a piece of software that would run on a phone or other embedded hardware that calculates what step in the sequence the PRNG is up to and then list the current password for you.
Having said that the security of your system would be limited to the seed you choose and the time you choose that each key is valid for.
In addition to this there is probably a software solution that will do this for you. IMHO it's better to take the existing implementation then reinventing the wheel.
Edit: Wikipedia has a good article here. The part on specific OTP technologies will probably be the most relevant.
Good luck though!
wiki article on PRNG
您需要决定的第一件事是哪种身份验证协议将成为您的标准。 我推荐 Radius，特别是对于企业中的双因素身份验证。 Radius 受到所有主要 VPN 和 VPN 的支持。 网络提供商以及所有主要 2FA 提供商。
然后，考虑您想要保护的服务。 对于 Linux，这通常意味着 PAM。 幸运的是，通过 pam 将 2FA 添加到 Linux 非常轻松： http://www.wikidsystems.com/support/wikid-support-center/how-to/pam-radius-how-to/。 对于 Windows 服务，您需要通过 ISA 或 VPN 路由它们。
您可以使用 MS radius 插件 IAS/NPS 将所有 Radius 请求配置为通过 AD。 http:// www.networkworld.com/news/2010/050710-two-factor-authentication-through-windows-server.html?source=nww_rss
最后，在选择 2FA 解决方案时，只需确保它们支持 Radius 即可。
至于 SDK，这是每个供应商的情况。 这是我们的链接：http://www.wikidsystems.com/downloads/network-clients< /a>
hth，尼克
The first thing you need to decide is what authentication protocol will be your standard. I recommend Radius, especially for two-factor authentication in the enterprise. Radius is supported by all the major VPN & networking providers as well as all the major 2FA providers.
Then, consider the services you want to protect. For linux, this usually means PAM. Luckily, adding 2FA to linux via pam is pretty painless: http://www.wikidsystems.com/support/wikid-support-center/how-to/pam-radius-how-to/. For windows services, you will want to route them through ISA or the VPN.
You can configure all your radius requests to go through AD using the MS radius plugin IAS/NPS. http://www.networkworld.com/news/2010/050710-two-factor-authentication-through-windows-server.html?source=nww_rss
Finally, when choosing your 2FA solution, just make sure they support radius.
As for SDKs, that is a per-vendor situation. Here's a link to ours: http://www.wikidsystems.com/downloads/network-clients
hth, nick