SecurID Token Auth Emulator?

Last week I talked about the fact there was a nice OpenSSH patch for SecurID , but that it wasn't that useful without an Ace/Server.

Well, it got me to thinking. About three years ago I wrote an Ace/Server emulator that used part of an old algorithm I found on BugTraq to be able to authenticate my tokens through a Java server. It didn't use Ace/Agents and was only designed to authenticate access to the Java app. Worked really well. I never released it publically out of respect for RSA and for the fact that I was an RSA partner.

Well, I have been rethinking the idea of releasing a similar token validation emulator.

Now, typically if I ask a question on the blog most people email me privately because they don't want to register their name, email etc. I respect your privacy, and I am ok with that approach. However, I am hoping what I am about to ask will get some public responses so I may gauge accordingly.

I am thinking of porting my Java code to Perl and posting it up on Sourceforge. The idea would be to create a pure perl server that could allow for small businesses like my own to use the powers of RSA's two factor authentication without the need to spend thousands upon thousands of dollars for an Ace/Server, and who do not need such functionality of a real Ace/Server.

The idea would be to make an emulator that could expose functions similar to an Ace/Agent (or perhaps even use an Ace/Agent) to authenticate to the Perl Server and expose 2 factor auth to OpenSSH and Apache. The feature-set would be limited to:

• New Pin Mode
  
• Token Resync (via Next Token) for Timing Drift
  
• Normal Passcode
  
• Token import (via RSA diskette)
  
• Token Revocation
  

To maintain cross platform use and minimize the installation complexity I would use flat files for config and logs. This means it should work unaltered in most Unix environments, and on Windows. This also lets me limit the feature set in a way to provide a clean upgrade path to a real Ace/Server. I think its only fair that if you are going to really take advantage of RSA's technology in your environment that you buy their product for the advanced functionality.

These restrictions would be put on the server:

• Limited set of tokens. (Maybe MAX of 25 tokens)
  
• Would not support RSA's new AES-based tokens
  
• Logs would stay in a flat format to allow for basic auditing and searching
  
• The perl will be functional and fast, but will not be optomized like the Ace/Server
  

Now to my questions for the group. Quite frankly, my concern is that I do not wish to cause myself grief with RSA with such open source code. I decided to not release my code years ago because the Ace/Server was RSA's bread and butter, and I didn't feel right in providing a free alternative which could be abused by others. However, now that RSA has released new AES-based tokens and phasing out the old RSA proprietary tokens, this seems to be an optimum time to reuse some older tokens before they die out.

I have emailed RSA twice and no one wishes to respond on how the company would feel about such a code release. Until I hear otherwise, I am going to guess that no one knows how to respond to this, and perhaps they are just waiting to see what the response is. So, with that in mind my questions to you:

1. Would you install and use a a free perl token auth-emulator?
   
2. Do you own any SecurID tokens?
   
3. Would you buy any/more SecurID tokens to use this?
   
4. Would you use it with OpenSSH?
   
5. Would you use it with Apache?
   
6. Would you use it with other Ace/Agents?
   
7. Do you think there is value in releasing this code?
   
8. Do you think RSA will pull a SCO and start chasing you (or me) down for a license?

I would really appreciate any comments, feedback and discussion from the group of people that read my blog. Again, I am fine knowing most of you would rather email me privately about this, but if you can consider posting in the comments so others can see your views. I look forward to hearing the thoughts of the community on this.

Posted by SilverStr at October 5, 2003 07:44 AM | TrackBack