Ben, I'm using Google Authenticator for my google accounts, which is nice. I think only requirement is to have a iPhone or an android device. I think it's reasonable. Yubikey is also nice but costs us a bit? how about durability? I probably attach Yubikey to a key chain and put it into my pocket. I understand that he can not sudo in the default JLSE image unless he request his ALCF account. It would be nice if he can sudo on things. Can we boot one of the Things nodes from a local drive when he wants to use it? - kaz On 03/17/2015 02:49 PM, Allen, Benjamin S. wrote:

...

Does he need to request ALCF account (in order to obtain his crypto card)? or can JLSE provide a crypto card directly to him? We cannot use JLSE as a justification for creating him an ALCF account, so unless he has other ALCF project duties we'll have to use another second factor authentication method.

I assume he requires this for privileged access within JLSE? If not then he has no need for a cryptocard.

I've been investigating Google Authenticator style one time passwords as a second factor. We could also start supporting Yubikey with relative ease. I tend to like the idea of a soft token as with Google Authenticator, as there's no cost for physical tokens. On a per host basis, implementation is fairly easy, if we wanted a centralized, i.e. single token for all of JLSE per user, some implementation time would be needed. It would also start out as, "come see Ben for your special QR code or shared key", as there's no integration into Userbase (accounts.jlse.anl.gov) for this type of credential.

Ben

...

On Mar 17, 2015, at 1:56 PM, Kazutomo Yoshii <[email protected]> wrote:

Hi,

Pablo Llopis, a student who works with me this summer, has requested his JLSE account, selecting Rajeev as a sponsor.

Does he need to request ALCF account (in order to obtain his crypto card)? or can JLSE provide a crypto card directly to him?

- kaz

_______________________________________________ Admins mailing list [email protected] https://lists.jlse.anl.gov/mailman/listinfo/admins