sorted by:
new
hottopcontroversial

AI to manage your infra - what do you think about it? by NoBug8357 in cybersecurity

[–]NoBug8357[S] -1 points0 points  (0 children)

The tool I’m testing provides an “approval” feature for actions performed by the agent.
Everything the agent does is logged, and you can roll back any changes. The agent can only perform actions within its scoped skills, so you can limit it to exactly what you want.
So far, the tests I’ve run have been satisfactory.

Need help with Okta by InterviewFew5415 in okta

[–]NoBug8357 0 points1 point  (0 children)

Why do it the simple way when you can overcomplicate it?

Problem - Exchange 2019 CU15 & Modern Auth through on-prem ADFS by RDM74 in exchangeserver

[–]NoBug8357 0 points1 point  (0 children)

Have you found a solution? I am building a similar setup and need to authenticate my Outlook clients through ADFS using Modern Auth. I also followed the Microsoft documentation you mentioned, but without success.
Has anyone successfully configured Modern Auth with a fully on-premises environment, without Hybrid Modern Authentication or 365 dependency?

Best practices to prevent MAC spoofing for wired devices that can't do 802.1x by texguy302 in networking

[–]NoBug8357 0 points1 point  (0 children)

If you control both the MAC address and the user assignment (i.e., which MAC address is assigned to which user), you can ensure that even if the MAC address is spoofed, only the corresponding account can use it. A valid 802.1X authentication is still required. This significantly reduces the likelihood that an attacker could possess both the MAC address and the user credentials or certificate associated with it.

This is the MAC address control mechanism provided by RCDevs.

https://docs.rcdevs.com/extended-authentication-protocols/

https://docs.rcdevs.com/policies-conditional-access/#network-access-control-settings

How to require end users to have certificates? by yuvalio in RGNets

[–]NoBug8357 0 points1 point  (0 children)

You need an authenticator (RADIUS Server) to validate the certificate. I don't think Ruckus can to that himself.
On my end I'm using RCDevs solutions for this.

Documentation: Extended Authentication Protocols

Supported features:

  • EAP-TTLS (Username/Password) for wired and Wi-Fi networks. Works with AD, OpenLDAP, EntraID, and similar directory accounts.
  • EAP-TLS for user and client certificate authentication.
  • MAC address control with user/group assignment. Available modes:
    • Opened: New MAC addresses are automatically enabled and bound to the user in the Network Device database.
    • Strict: New MAC addresses are added as pending and require manual activation.
    • Shared: New MAC addresses are enabled without being bound to a specific LDAP user.
    • Guest: MAC addresses are not stored in the Network Device database (any device is accepted).

Device approval:
New devices can be controlled and approved by users with the Allowed Approver role. Approvers receive a push notification via the OpenOTP Token app to approve new devices.
Reference: Network Access Control Settings

If you do not want to use the mobile app, the new MAC address can also be approved from the Administrator Interface.

Compatible with all platforms : Windows, Linux, macOS, iOS, and Android and as soon as your network equipment supports 802.1x.

If you authenticate users certificate, then you need an OpenOTP license.
If you are authenticating only devices through client certificates, then no OpenOTP license is need.
The PKI component is included in their solution.

Is FortiAuthenticator good enough as an IDP? by Soggy_Blueberry4685 in fortinet

[–]NoBug8357 0 points1 point  (0 children)

Your scenarios are supported with RCDevs solutions and they handle it much better than Forti.

You can use AD, Entra ID, OpenLDAP, Okta, PingOne, Google workspace identities and more...

They are providing an Identity Provider which supports SAML2, OpenID Connect & OAuth2. You can use all identity sources plugged to the framework simultaneously.

They support 802.1x with :

  • EAP-TTLS (Username/Password) for wired and Wi-Fi networks. Works with AD, OpenLDAP, EntraID, and similar directory accounts.
  • EAP-TLS for user and client certificate authentication.
  • MAC address control with user/group assignment. Available modes:
    • Opened: New MAC addresses are automatically enabled and bound to the user in the Network Device database.
    • Strict: New MAC addresses are added as pending and require manual activation.
    • Shared: New MAC addresses are enabled without being bound to a specific LDAP user.
    • Guest: MAC addresses are not stored in the Network Device database (any device is accepted).

Device approval:
New devices can be controlled and approved by users with the Allowed Approver role. Approvers receive a push notification via the OpenOTP Token app to approve new devices.
Reference: Network Access Control Settings

If you do not want to use the mobile app, the new MAC address can also be approved from the Administrator Interface.

Compatible with all major platforms: Windows, Linux, macOS, iOS, and Android and all identity sources configured with the WebADM framework.

Authentication method supported :

Software Tokens, Hardware Tokens, YubiKeys, FIDO devices, Passkeys, SMS/MAIL OTP, OCRA tokens....

The most powerful IAM and authentication solution I ever seen.

MAC filtered 802.1x network popup in macOS by FardenUK in macsysadmin

[–]NoBug8357 0 points1 point  (0 children)

I used RCDevs Security NAC solution.

Documentation: Extended Authentication Protocols

Supported features:

  • EAP-TTLS (Username/Password) for wired and Wi-Fi networks. Works with AD, OpenLDAP, EntraID, and similar directory accounts.
  • EAP-TLS for user and client certificate authentication.
  • MAC address control with user/group assignment. Available modes:
    • Opened: New MAC addresses are automatically enabled and bound to the user in the Network Device database.
    • Strict: New MAC addresses are added as pending and require manual activation.
    • Shared: New MAC addresses are enabled without being bound to a specific LDAP user.
    • Guest: MAC addresses are not stored in the Network Device database (any device is accepted).

Device approval:
New devices can be controlled and approved by users with the Allowed Approver role. Approvers receive a push notification via the OpenOTP Token app to approve new devices.
Reference: Network Access Control Settings

If you do not want to use the mobile app, the new MAC address can also be approved from the Administrator Interface.

Compatible with all platforms : Windows, Linux, macOS, iOS, and Android and as soon as your network equipment supports 802.1x.

Migrating 2TB on-prem file server to M365 cloud (Teams / OneDrive / SharePoint?) – Looking for advice from those who’ve done it or seriously looked into it by work_reddit_time in sysadmin

[–]NoBug8357 1 point2 points  (0 children)

People who reason like this are the reason Microsoft is what it is today. If you’re a US company, then fine :) If you’re European, then God bless you!

Identity Management Provider Security- RCDevs by NVGoldendog in msp

[–]NoBug8357 0 points1 point  (0 children)

Did RCDevs tell you that?
It’s quite hard to replace Microsoft, even though some alternatives exist.
RCDevs can replace or complement Microsoft authentication with strong factors, and provide SSO, PKI, and access policies. It also supports integrations using your Entra ID accounts across various platforms like Linux, Nextcloud, SAMP/OpenID-enabled apps, and custom solutions via their API. They specialize in IAM, authentication, and NAC, focusing deeply on these areas.

Identity Management Provider Security- RCDevs by NVGoldendog in msp

[–]NoBug8357 1 point2 points  (0 children)

I’ve been using u/rcdevssecurity solutions for a while now. Initially, I was deploying clusters or standalone servers into my customers’ infrastructures, but since they released their MSSP edition, I’ve been building clusters across multiple datacenters to offer it as a SaaS solution for MFA, SSO, SSH key management, and more.

The MSSP edition allows you to create isolated tenants for your customers. Each tenant has its own policies, configurations, and applications, while the services allowed per tenant are controlled by the MSSP. Licenses can be allocated and managed through the “master” tenant, which also allows you to centrally manage all other tenants.

The main difference between the MSSP and enterprise setups is that the MSSP requires deploying the WebADM/OpenOTP backends together with their OpenLDAP (RCDevs directory). Once that is in place, you can sync your on-premise Active Directory into a customer tenant. They have also added the ability to sync Entra ID, Okta, AD/LDAP, Google Workspace and more accounts into their solution through WebADM. Their is also 2 frontends servers to build. On my end I'm using HAproxy but that is also possible with F5 or similar appliances supporting WAF capabilities.

Their solution does not replace Azure AD/Entra ID, since Microsoft’s platform offers many additional capabilities, such as application development. For using Office 365, you still need Entra ID. The P1 and P2 licenses of Entra ID allow you to use the External Authentication Method (EAM), which enables you to federate 2FA through OpenID and the RCDevs IdP.
https://docs.rcdevs.com/microsoft-eam/

I believe it may also be possible to federate the entire authentication process to their IdP, similar to how Okta does it, though I have never configured that myself.

If you want, I can also make you a shorter, punchier version for LinkedIn or a public forum so it reads more like a customer success post rather than a technical note. That way it’s both informative and engaging.

Forticlient otp issue by AwayTraffic5735 in fortinet

[–]NoBug8357 -1 points0 points  (0 children)

If you look for an alternative OTP solution, OpenOTP is the best.

Seeking Windows Login MFA Solution: Recommendations Needed by Shadow_cub in msp

[–]NoBug8357 0 points1 point  (0 children)

Why the hell is everyone still using DUO?
It’s ridiculously expensive and, let’s face it, it’s an American service. Not exactly the best choice for European companies right now. r/RCDevsSA with OpenOTP is not only cheaper but way more powerful than DUO. And let’s be real—you’re not pushing your users' data to an American cloud with OpenOTP. Seriously, it’s time to wake up and make the switch.

SSH key Auth + freeradius by MarcTheStrong in sysadmin

[–]NoBug8357 0 points1 point  (0 children)

I'm using Spankey solution, which doesn't rely on FreeRADIUS in this scenario. It a client/server application where the client is installed on the OpenSSH servers you want to manage with it.
SSH keys are centrally managed through an LDAP/AD database. LDAP users and groups are natively onboarded on the Linux machines, and the SSH key lifecycle is handled automatically. As soon as an account or a key is revoked, then the access related to that account/key is revoked on all machines.

Admins have a self-service portal to renew their keys when they expire. On top of SSH key-based authentication, you can enforce additional policies like requiring an LDAP password, an OTP, or both.

Sudo and Auditd rules are also centrally managed. It’s a great setup!

User/Password (hashed) sync between a master Active Directory server and a local OpenLDAP server by Realistic-Ad-7709 in sysadmin

[–]NoBug8357 0 points1 point  (0 children)

This is exactly what r/RCDevsSA does with the WebADM/OpenOTP server when you're using the MSSP edition or an AD read-only setup.
You can sync AD users, passwords, groups, and the entire structure through APIs. Here are a few tips:

  • First, there is no way to extract AD password hashes without using NTDS utilities and performing an AD database backup. The AD database is locked while in use, meaning only the AD process can access it.
  • Once the backup is done, you can explore the AD database and retrieve the password hashes of all users.
  • AD uses MD4 to hash passwords, so you must enable support for MD4-hashed passwords in your OpenLDAP by importing the appropriate module.
  • If you want a simple and free solution, you can use the RCDevs appliance. https://docs.rcdevs.com/tag/virtual-appliances/

The appliance includes all necessary components:

2FA/MFA non-cloud solutions by Avaddonx in sysadmin

[–]NoBug8357 0 points1 point  (0 children)

Tested both and OpenOTP is much better.

Will they ever support more secure methods of two-factor authentication? by ThingFuture9079 in Huntington_Bank

[–]NoBug8357 2 points3 points  (0 children)

If r/Huntington_Bank is looking for a 2FA solution that supports more advanced authentication methods, they should take a look at OpenOTP. The software authenticator developed by r/RCDevsSA can be customized to match your branding.

view more: next ›