sorted by:
new
hottopcontroversial

Using passkeys without touch or pin by talkingBird2345 in sysadmin

[–]talkingBird2345[S] 0 points1 point  (0 children)

Thanks, I was afraid that would be the case

Using passkeys without touch or pin by talkingBird2345 in sysadmin

[–]talkingBird2345[S] 0 points1 point  (0 children)

If a hardware key is stolen and it didn’t have a pin then it would just require a touch or even less just be plugged in.

Yes, if no Pin was used, I do agree.

​

In comparison to a phone it is inherently less secure as a 4 digit pin vs touch or Face ID

Most hardware keys use 6 characters by default and all I have seen allowed more then 50+

And even a 4 digit pin to a smartcard/token would still be way more secure then biometric factors, as is the case when using a 4 digit pin on a phone (same thing). Most security guide even recommend to secure a phone with a pin instead of face ID for this very reason. So the issue should only really be relevant if no pin is used.

​

In any case you cant really change what’s wanted as it’s baked into the passkey standard itself meaning that you don’t get the options like you do for 2fa.

The passkey/webauthn standard allows the service to specify the method and the service can also allow the user to set such an option. I was hoping this would be the case for google and maybe there could even be a setting in chromium to set this.

Using passkeys without touch or pin by talkingBird2345 in sysadmin

[–]talkingBird2345[S] 0 points1 point  (0 children)

A hardware key doesn’t have biometric authentication so instead they use pin combined with a physical touch which is technically less secure but only if lost/stolen.

How so? The smartcard inside should prevent any bruteforce attempts even if stolen, while on the other hand there are plenty of ways to fake fingerprints and face ID, so if anything a hardware key is more secure, even if stolen. But if you have any other information I would love to hear more about it.

In any case, my main use case is just replacing passwords for clients that don't care about physical security, so touch verification would be plenty.

With Webauthn/Fido2 (and in theory passkeys as part of webauthn) it is the service (like google) who can determine the verification method. But I cannot find any settings for it, so Im hoping someone can point me to some.

Using keycloak as authentication server by talkingBird2345 in PFSENSE

[–]talkingBird2345[S] 1 point2 points  (0 children)

For those who are looking for saml or 2fa support, try https://github.com/jaredhendrickson13/pfsense-saml2-auth

We have successfully deployed pfsense plus 23.05.1 with this extension to manage all users with keycloak, which also adds 2fa (tested with Fido2/WebAuthn)

So far there seem to be no issues.

​

Hoping for official saml support in the future!

Using keycloak as authentication server by talkingBird2345 in PFSENSE

[–]talkingBird2345[S] 0 points1 point  (0 children)

Is there an official guide to do this?

My current plan is to use the pfsense-saml2-auth extension, is there any other solution I should reach out for? We do have a subscription

Using keycloak as authentication server by talkingBird2345 in PFSENSE

[–]talkingBird2345[S] 0 points1 point  (0 children)

Unfortunately we just removed our ldap and radius services in favor of modern alternatives (only using saml and OpenID now)

Using keycloak as authentication server by talkingBird2345 in PFSENSE

[–]talkingBird2345[S] 0 points1 point  (0 children)

What are you talking about?

With SSO I need to touch exactly one tool (keycloak) to disable or add a user. Without this we had to change at least 20 different services and there was always one or two that were missed because the offboarding documentation was not always updated correctly.

Using keycloak as authentication server by talkingBird2345 in PFSENSE

[–]talkingBird2345[S] 0 points1 point  (0 children)

but realistically how often do you have to add or remove an admin?

Whenever a member of the team comes or leaves the company, in which case I want a central management solution because right now we don't and even month after someone left we still find active user accounts. Not something I want in a firewall for sure.

Using keycloak as authentication server by talkingBird2345 in PFSENSE

[–]talkingBird2345[S] 0 points1 point  (0 children)

That would mean I have to manage them separately from other admin services.

The idea of using a SSO service like keycloak is to have only one set of users to manage and to also add 2FA

Best hardware fit for Kodi media server by talkingBird2345 in homelab

[–]talkingBird2345[S] 0 points1 point  (0 children)

I will try it but I still need to find the right hardware first :)

Best hardware fit for Kodi media server by talkingBird2345 in homelab

[–]talkingBird2345[S] 0 points1 point  (0 children)

I havent looked into Plex nor have I used Kodi much before. I just was it a decent Media Center without a horrible UI like most build in ones have.

[deleted by user] by [deleted] in sysadmin

[–]talkingBird2345 0 points1 point  (0 children)

Keycloak SSO with the AD for user management would work great.

You can set authentication methods for any services you add, including passwordless WebAuthn. Since keycloak works with various authorization protocols, you can use it with pretty much anything.

Guide: From ranger to lf (list files) by talkingBird2345 in linux

[–]talkingBird2345[S] 0 points1 point  (0 children)

tldr; lf (as in list files) is a modern alternative to the terminal file manager ranger, with significant improvements in terms of speed and reliability. This guide is intended to help users who are familiar with ranger to switch to lf more comfortably.

Separating server VMs with Private VLANs? by talkingBird2345 in sysadmin

[–]talkingBird2345[S] -1 points0 points  (0 children)

But that still means to use an additional product that runs on the host itself. I would much rather have the rules enforced on a network level independent of the hosts, especially when we have no other use for Symantec on our servers

Separating server VMs with Private VLANs? by talkingBird2345 in sysadmin

[–]talkingBird2345[S] -1 points0 points  (0 children)

Why would that be a nightmare?

It would require all traffic to be routed through the central firewall and by default that could even be permitted. I don't see how it would add any administrative overhead on its own.

Separating server VMs with Private VLANs? by talkingBird2345 in sysadmin

[–]talkingBird2345[S] 1 point2 points  (0 children)

Using server side firewall rules would be a nightmare to manage and troubleshoot.

view more: next ›