Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 6 replies
  • Subscribers 5 subscribers
  • Views 1143 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos UTM, OTP and AD authentication weakness

Michieletti Enrico

Hi to all...

I've dicovered a weakeness of the Sophos UTM OTP implementation, when integrated with Active Directory.

When a user connect with it's domain credentials (username/password) for the first time on the user portal page, a local user is created on the sophos, and is generated the QR for the authenticator app. For the subsequent accesses, the user must insert the domain password + OTP (if configured to use OTP on the user portal). If it tries to login with simple user/pass, the login fail. In this way the two way authentication is guaranteed,and all is safe

The problem is that, if as username we use "DOMAIN\username", the sophos allow to access (as it should, the AD authentication will succeed) but it create a NEW local user, with a new OTP.

So, if the user/pass are compromised, the domain can be guessed/compromised, the whole OTP can be bypassed.

Any thought on this?



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to BAlfson

    I think that this is a major flaw.

    Imagine this scenario:

    Configuration: AD backend with OTP - plus the certificate for the SSL connection (in theory, the maximum in therms of security)

    The first time that an user log on the user portal, can access with simple AD user/pass. Sophos create the certificate and OTP code. Once configured OTP, i can log on the user portal and download the certificate.

    From now, the user can connect to the network with certificate + user/pass + OTP.

    One day, the user/pass of the user is compromised, someone else try to log on the user portal with the same username/pass, but including the domain (the domain, on most cases, can be easily found with some tries).

    At this time, a new certificate is issued, and a new OTP code is generated. So someone else can access to the user portal and download it's certificate, and create a new OTP code, allowing access to the network.

    How i can inform the tech support about this issue?

  • 0 in reply to Michieletti Enrico

    You can open a ticket at https://support.sophos.com/.  If it's your first LOGIN to the Support system, you will need to create a Sophos ID.

    Cheers - Bob