[已解] RSA Token passcode reuse

看板MIS (IT資訊人員)作者infosec (InfoSEC)時間10年前 (2014/12/17 09:43)推噓3(3推 0噓 13→)

留言16則, 4人參與討論串1/1

上週把ACS 5.6弄起來，把SWITCH AAA 導至ACS驗証 ACS上新增RSA Authentication Manager 用意是要登入switch時，用員編+token做one time password login 使用上也都正常，但是有個小問題，就是無法在短時間內登入多台設備也就是說，同組passcode只能登入一台設備，下一台設備要等passcode 變成另一組才能登入，不然會驗証失敗，去查RSA Log 會出現 Passcode reuse or previous token code detected for user "xxxxx"的訊息我不是很清楚這是RSA的限制或是哪方面設定要修正還需再找資料看看，假若這是RSA的限制，萬一碰到需要除錯的情境可能需要登入多台設備交互查找問題時，顯然會是個問題.. 不知各位前輩有沒有經驗可以分享？ CISCO Catalyst Switch -> CISCO Secure ACS -> RSA Authentication Manager (AAA) (TACACS+) 剛剛另一位大神指點在ACS 5.6中 RSA SecurID Token Server的設定裡有一個選項叫 Passcode caching enables the user to perform more than one authentication using the same passcode. □ Enable passcode caching Aging Time: _30_ seconds 這個功能如果勾選的話，第一次驗証會去問RSA AM，然後30秒內用同個passcode去登入其它設備，是不會再去問RSA AM，而是直接給予放行這樣也就解了我一開始的問題~ 這是ACS的功能，OTP依舊是OTP ACS中間做了手腳就方便網管做事 CISCO ACS的Release Notes如下 ACS 5.5 provides a new feature called passcode caching, where ACS 5.5 stores user credentials and their passcodes in a cache. The passcode cache in ACS is available for a configurable amount of time from 1 to 300 seconds. After a first successful authentication against an RSA Secure ID token server, ACS stores the user credentials in its cache. The RSA passcode cache will be available for the amount of time that you have configured. If the user accesses the network within this time period again, ACS checks for the user credentials in its cache and processes the request. 分享給大家 -- ※ 發信站: 批踢踢實業坊(ptt.cc), 來自: 211.21.123.187 ※ 文章網址: http://www.ptt.cc/bbs/MIS/M.1418780626.A.ABE.html

→

infosec

12/17 10:05, , 1^F

12/17 10:05, 1^F

→

infosec

12/17 10:08, , 2^F

12/17 10:08, 2^F

→

deadwood

12/17 10:11, , 3^F

12/17 10:11, 3^F

→

deadwood

12/17 10:11, , 4^F

12/17 10:11, 4^F

→

deadwood

12/17 10:12, , 5^F

12/17 10:12, 5^F

→

deadwood

12/17 10:13, , 6^F

12/17 10:13, 6^F

→

infosec

12/17 10:16, , 7^F

12/17 10:16, 7^F

※ 編輯: infosec (211.21.123.187), 12/17/2014 16:20:52 ※ 編輯: infosec (211.21.123.187), 12/17/2014 16:29:30 ※ 編輯: infosec (211.21.123.187), 12/17/2014 16:30:28

→

deadwood

12/17 19:00, , 8^F

12/17 19:00, 8^F

推

asdfghjklasd

12/17 19:06, , 9^F

12/17 19:06, 9^F

推

advicer

12/18 10:20, , 10^F

12/18 10:20, 10^F