11:00 AM
Paul B
 |
| Virtual Private Network site to site and from roaming users (Photo credit: Wikipedia) |
One of the problems with RRAS is that out of the box there isn't a real method for using two factor authentication. By two factor authentication it means you need to know something and your need to have something in order to gain access to the VPN tunnel. There are products out there like RSA tokens, but they can be pretty expensive. I found an alternative though.
It's a free tool called RAS-SMS. What it does is integrates with your RRAS service and provides a secondary method of authentication. The second method is a text message to your phone number with a code. If you enter the password correctly for VPN, a random code is then sent to the phone number associated with your account. You must then enter the code to gain access. Cool right?
From their page:
RAS-SMS is an extension (dll) for the Microsoft VPN / PPTP server also known as Remote Access Service (RAS). RAS is a standard component of the Microsoft Windows Server family. RAS can be configured to use the Microsoft Internet Access Service (IAS), also a standard light weight component, not to be confused with ISA. By default RAS uses windows authentication directly when checking credentials. When configured for IAS, the authentication is relayed to IAS. IAS can be extended with extra authentication functions. This project, RAS-SMS, is about inserting such an extra authentication function based on the idea that users should enter randomly generated codes that were sent to their personal cell-phone number. Codes are only generated if users entered their credentials correctly.
If someone shares their password with an unauthorized user, you no longer have to worry about that person gaining access. They will not be able to get in without the phone. Likewise, if the phone is lost or stolen, you don't have to worry because nobody will have the password. Seems pretty slick to me, and it doesn't really cost any extra money to implement.
What kind of VPN person are you? Appliance or Server? Do you use two factor authentication? What do you use? Let us know in the comments.
