Scorpion Software Blog

Using AuthAnvil Password Solutions with Kaseya

With the recent release of Kaseya 6.3 it would seem like a good time to talk about how Scorpion Software helps to protect Kaseya with our AuthAnvil products and services. We have been offering varying levels of support for Kaseya for many years now, but recently have seen some confusion on what we offer for free, and what is part of our paid addins. This blog post is designed to help clarify that, and help you decide which solution best fits your needs. First though, a quick video to show how it all works.

By the way, if you ever want to track our work with Kaseya, you can do so at www.scorpionsoft.com/kaseya.

Now a bit of background. There are two different products that we offer for Kaseya. The first is the “AuthAnvil Management Pack”. This is a set of importable agent procedures, eventsets and code additions that offers you the ability to enforce AuthAnvil’s two-factor authentication on the logon to the Kaseya Management Portal. It includes scripts that you can use to automate the deployment of our Windows logon agents, and setup Kaseya to monitor the health of the AuthAnvil authentication subsystem on your client networks. All the scripts and code is available to you, but you have to specifically schedule and run these when you want to use them.

Below is a video I did several years back explaining what it does.

The AuthAnvil Management Pack for Kaseya is FREE, and is available for download for all our customers.

The second product we have is the AuthAnvil Addins for Kaseya.

This is a set of addins that have been specifically programmed against Kaseya’s Third Party APIs to allow us to automate even the setup and configuration of the AuthAnvil Management Pack scripts, as well as add much more functionality. As an example, we also:

• Offers AuthAnvil backchannel single sign-on (SSO) so when you log into Kaseya you automatically log into the AuthAnvil Password Server (if configured). This allows you to access all your passwords stored right inside of Kaseya in the “Password Server” tab.
• Offers a “Two Factor Auth” tab that gives a visual UI to all components of the AuthAnvil Management Pack.
• Offers support for “AuthAnvil Agent Groups”, which provides cross domain security policy management based on AuthAnvil protection scopes, allowing you to automatically deploy the AuthAnvil Credential Provider (logon agent) and monitor it in a few clicks. Updating agents and changing settings is just as easy.
• Offers AuthAnvil Two Factor Auth enforcement to Kaseya Live Connect (KLC), providing selective identity assurance proofs when trying to access KLC. This is useful for compliance purposes when needing to access sensitive agents like POS terminals and ATMs that Kaseya agents may reside on.
• Offers deep audit logging of all actions taken inside of Kaseya Live Connect, for compliance reporting and audit tracking.
• Allows you to apply Kaseya Security Roles through the Kaseya Security Auditor to refine access control to particular functions in the AuthAnvil Addins by role.
• Provides IP and username whitelisting for selective two-factor authentication
• Automatically setup monitoring and alerting in accordance with our best practice guidance.
• Can systematically scan and builds an AuthAnvil asset inventory list describing all agent versions and settings across all the Kaseya agents that you manage. This turns your Kaseya agents into beacons of discovery that collects all the required authentication subsystem information and centrally displays them in the Kaseya Management console.
• More detailed AuthAnvil audit logging directly in the Kaseya management console.
• And much more. Like password override reset workflow. Alarms. Event based script execution. etc etc

For early adopters, the AuthAnvil Addins for Kaseya were made available free for the first year. That ended in the summer of 2012, when we began to charge $100/month for this additional functionality. New customers in our Advantage or Advantage+ bundles continue to receive the first year of the AuthAnvil Addins for free.

So there you have it. You can always use the AuthAnvil Management Pack for FREE, that provides all the agent procedure scripts in an importable fashion, and offers the ability to add two-factor authentication to the login to Kaseya. Or for $100 a month, you can have our addins do all the heavy lifting for you, and add a whole bunch of extra capabilities like integration to the AuthAnvil Password Server at the same time. Choose the option that best fits your needs and budget.

If you have upgraded to Kaseya 6.3 you will need to contact our Customer Service team to get access to the new addins that support it. This is free to all paying customers of the AuthAnvil Addins for Kaseya.

 

AuthAnvil + LiquidFiles = Tip for sending sensitive large files across the Internet safely

It amazes me how many people think email is a great way to send sensitive documents across the Internet. Besides the fact it isn’t safe since email is not encrypted, the fact is most mail servers are limited in the size of attachments that you can send. If an architect has an enormous AutoCad file that the builder needs it just won’t make it through email. Or when a doctor needs to exchange patient X-ray data with a secondary hospital. Or when an IT team needs to move a virtual server VHD across a DMZ. There are lots of scenarios where you need a better way.

So what is a good way to share files, so you can be sure your colleagues, peers and clients can access large sensitive files securely? Everyone has their favorite cloud solutions, like SkyDrive, Dropbox, Citrix ShareFile or Box.net. Each one of these solutions has benefits and drawbacks, mostly around custodial control over the data while at rest, and the permission based system to access the information when it is stored in the Cloud. They work really well, and are relatively inexpensive. Sometimes free. But you still aren’t in control of the data.

We recently had a customer come to us needing even greater control. They wanted a solution that they could control on servers they manage, but through commercial software designed for sharing files on the Internet. And they wanted an identity proof through AuthAnvil Two Factor Auth before they could access the information. The simpler, the better.

They had been using LiquidFiles for some time, but knew the solution did not support AuthAnvil, or any kind of two-factor authentication. This is a hardened SELinux virtual appliance that has a custom web interface that allows you to share files from your DMZ, assigning access privileges on a per user basis, temporarily or permanently. The also support public access as necessary. All protected with traditional passwords. The client needed a stronger solution and didn’t want to manage client passwords, and asked Scorpion Software to work with LiquidFiles to find a solution.

Our recommendation to LiquidFiles was to consider implementing SAML, and pointed them to our Developer Center for further resources. And they did just that. In less than two weeks they implemented, tested, and released an update that supports single sign-on (SSO). This allows them the ability to expand support to any authentication vendor that uses the industry standards of SAML, and allows our mutual client to implement LiquidFiles with AuthAnvil. Since AuthAnvil Single Sign On (which works with SAML) uses AuthAnvil Two Factor Auth for strong two-factor authentication, our client was able to get the added benefit of the identity assurance proof that they need when allowing their clients and partners access to sensitive files without having to know or remember another password that could be shared, stolen or guessed.

Kudos to the team at LiquidFiles for turning around this implementation so quickly. We have published an implementation guide that explains how easy it is to configure AuthAnvil Single Sign On to work with LiquidFiles. So if you need to share sensitive files across the Internet and want to stay in control of the data, consider looking at the use of LiquidFiles with AuthAnvil.

Enjoy.

New versions of AuthAnvil Two Factor Auth and Single Sign On now available!

We are pleased to announce the general availability of AuthAnvil Two Factor Auth 5.0 and AuthAnvil Single Sign On 3.6!

AuthAnvil Two Factor Auth has went through a major architectural change. This gives us the ability to better scale the solution for some of our larger clients that are rolling AuthAnvil out for protection of cloud services like Office 365.

Here is a list of the key changes:

• Better redundancy support. We now support full clustering and the ability of using teamed web servers with Network Load Balancing (NLB).
• Introduction of support for Windows Azure VMs. The backend now supports the ability to roll out Azure instances of AuthAnvil on Windows Server 2012 virtual machines. More details will following in the coming months on how you can build a highly reliable, redundant AuthAnvil environment in Windows Azure for less than the cost of a typical hosted colo box.
• SQL Auth. We have updated our SQL support to use SQL authentication, allowing you to use services like SQL Azure to get cloud based database clustering if you so desire.
• .NET 4.0. We have taken advantage of Microsoft's .NET Framework 4.0 which has allowed us access to new functionality and capabilities in our code base, reducing some more complex code we used to have to manage.
• Windows Server 2003 no longer supported going forward. As of v5.0, we no longer are testing against Windows Server 2003 for the Server components. Agents will continue to be supported. You will need to continue to use AuthAnvil Two Factor Auth v4.6 if you wish to have AuthAnvil run in Windows Server 2003 environments.
• Legacy URL removed. v5.0 now removes backwards URL compatibility for older installations. If you use software that hardcodes paths, you will need to ensure you download our documentation on how to repair this.

The last two bullets are extremely important. We have decided based on the metrics we are seeing that continuing to support Windows Server 2003 and .NET 2.0 did not make sense to us. From a security perspective and usability perspecting the newer generations of Windows Server with .NET 4.0 is by far a better solution. We will continue to support AuthAnvil Two Factor Auth 4.6 for three more release cycles, allowing customers to migrate off to newer servers in the next year or so as required. We will NOT support new installations of the server components onto Windows Server 2003.

If the legacy URL affects you (most Autotask users would be a good example), we have you covered with some repair scripts. Please look at our warning about this change for more information. We have been telling you for some time now to stop using the old URLs. With this release we have finally removed it.

AuthAnvil Single Sign On has went through some major changes itself. These include:

• Better support for Lync clients in Office 365. There were some issues with how this was functioning, and we have resolved that with the introduction of ActiveSync keys for Lync.
• Support for Internet Explorer 10. We have updated the SSO Portal to support IE10 rendering to allow for a better touch experience.
• Office 365 is now easily "detachable". We have made it easy to detach federation from Office 365 with the click of a single button. Now you can easily try AuthAnvil with your Office 365 account and remove it with little risk. No special PowerShell management required.
• Huge performance improvements. We have updated the management of SSO to better handle thousands of concurrent users, deemed required when used with cloud services like Office 365, MS Dynamics Online and Salesforce.com.

There are several other performance enhancements and bug fixes to both products that have also been rolled up to make your experience with our software better. All of this is rolled up in the main installers. If you need any questions or need assistance in upgrading, please visit www.scorpionsoft.com/help.

Let us know what you think of the new updates!

New version of AuthAnvil Password Server makes syncing better

Today AuthAnvil Password Server (v1.6.0.22) has received several updates to address customer needs in more complex environments. A few key areas we would like to focus on include:

• We have made domain and machine validation more flexible. We originally used Microsoft's Patterns & Practices guidance for the name validation in accordance to their recommendation. In the real world, many companies don't follow that. You can now have one or two letter domains if you like.
• We have updated the non-reputable logging algorithm, and updated how sync agent audit reporting works. We have encounterd something we didn't anticipate in the field. If you have hundreds of AuthAnvil Password Sync Agents pushed out through automation in RMM tools like Kaseya and configure it to check in more frequently, you could literally flood the SQL server with audit logs. We were seeing customers generating over half a million log entries a day which significantly slows down the audit reporting on top of the disk utilization of the period of the month. It got to a point that the audit hash checks that validate the integrity of the logging would fail to complete, locking down the Password Server in some cases. This has since been fixed.
• We have updated the "lockdown" condition email algorithm. With the audit hash failure condition mentioned in the last bullet, we came across a condition in which AuthAnvil administrators may receive many more alerts than anticiated when that is triggered. We have since updated how that validates a lock down condition, and an AuthAnvil administrator will receive a single consolidated alert for any lock down condition triggered.
• We have updated how we auto-generate digital certificates. One of the powerful capabilities in the AuthAnvil Password Server is its built in Certificate Authority to generate sync agent and client certs to provide mutual authentication between endpoints as well as end-to-end encryption, and for the PKI built in for Vault access control. As we generate these certificates on the fly using Microsoft's certificate APIs, there was an interesting artifact in which the CAPI from Microsoft was leaving around hundreds of thousands of machine keys on disk on some active deployments at any one time. Rumour has it a few customers were starting to see hundreds of gigabytes of wasted disk space with these keys. With help from our friends at Microsoft (thanks @blowdart), we have isolated the condition that was causing this and have remediated the problem.
• We have updated the charting. We are constantly evolving how we generate the audit reporting and analytics charting. This update includes several key changes behind the scenes to allow us to enhance charting in future releases.

There are several other performance enhancements and bug fixes that have also been rolled up to make your experience with our software better. All of this is rolled up in the main AuthAnvil Password Server installer. If you need any questions or need assistance in upgrading, please visit www.scorpionsoft.com/help.

Let us know what you think of the new updates!

 

Federation without the fuss for Microsoft Office 365

September 24^th, 2012 Chilliwack, BC – Scorpion Software announces the first strong, fully independent two-factor authentication and single sign-on solution for Office 365.

“Microsoft takes security seriously,” says Scorpion Software CEO Dana Epp. “But to get maximum security, companies need to protect the keys to the front door – the passwords people use to get in.”

Passwords are frail and vulnerable to human error. In the last year, major companies like Yahoo, LinkedIn, eHarmony, and Dropbox leaked millions of passwords. Because most people use the same password in a number of different places, just one stolen password could allow an intruder to access critical information stored in other Cloud services that may be used for work.

“AuthAnvil for Office 365 adds strong authentication and identity assurance, all while simplifying the user experience,” says Epp. “It eliminates the need to remember passwords, and allows users to login once to securely access all their email and business documents stored in the Cloud, from virtually any device.”

How does it work?

It’s simple really. Instead of using a static password that can be shared, stolen or easily guessed, users sign in once through two-factor authentication. With AuthAnvil, staff input a chosen PIN (what they know), and then a one-time password generated from an app on their smartphone (what they have). It’s similar to a bank card: they provide a card (what they have) and input a PIN (what they know). Essentially, they offer two factors to authenticate who they are to gain access. From there, staff can access everything without having to know a password.

“It doesn’t matter if a business is an enterprise bank or a small architect firm,” says Epp. “Every business needs to ensure that only the right people can get to their sensitive data in the Cloud. AuthAnvil for Office 365 is designed so that any size of company can easily implement stronger access security.”

What makes AuthAnvil different?

Microsoft offers federated single sign-on (SSO) to enterprise businesses, and uses ADFS and DirSync – a complex system that requires extra servers and many hours or days to implement.

AuthAnvil for Office 365 enhances businesses of all sizes, including the small business P1 and P2 plans, because of its direct federation capability to Microsoft’s Cloud Services. It helps companies save time and money because it works in minutes, not days – it doesn’t require extra software and server resources for ADFS or DirSync, or the time to implement them.

“Usually security and usability are at odds,” says Epp. “What’s great about AuthAnvil for Office 365 is that it actually simplifies how staff access Office 365. They can login once from anywhere, on almost any device, and get secure access to the Cloud. We’re excited to be able to make this available to all our customers who want simple, secure access to Office 365.”

AuthAnvil Single Sign On is now free

AuthAnvil for Office 365 combines the strong identity assurance of AuthAnvil Two Factor Auth and the work efficiency of AuthAnvil Single Sign On. To assist all our customers in securing a cost-effective solution, we are pleased to announce that AuthAnvil Single Sign On is now free with AuthAnvil Two Factor Auth. As of September 2012, all existing and future customers will receive the benefits of both products at $5/month or less per user.

Media contact:
Heather Murray
1-888-407-4285 ext.722
heather@scorpionsoft.com

Stay up-to-date with the latest advantages for AuthAnvil Single Sign On

September 10, 2012 Chilliwack, BC – AuthAnvil Single Sign On offers more benefits now than ever before, including additional user features and integrated applications.

“It’s important for us to keep improving our software,” says Scorpion Software CEO Dana Epp. “Our goal is to solve the obvious problems with passwords that others ignore, and that includes the risk and pain of having to log in and out of applications all day long. We solved that with AuthAnvil Single Sign On, and made it even easier to use with version 3.5.”

Instead of staff logging in and out of applications as they need them, they can login once through AuthAnvil Single Sign On, and then gain secure access to all their applications as they need them without having to enter another password.

Benefits of the latest release of AuthAnvil Single Sign On help improve the user experience:

• We have expanded our application catalog to include built-in support for Outlook Web Access, Office 365, Zendesk, and WordPress, allowing your staff to quickly and securely access these popular applications with very little extra configuration. 
• Users now have full control over the SSO portal layout, allowing them to prioritize their most-used applications and customize their personal experience.

“AuthAnvil Single Sign On increases staff efficiency while also improving company security,” says Steve Syfuhs, Microsoft Security MVP and lead AuthAnvil Single Sign On developer. “Staff spend less time logging in during their workday, have fewer passwords to remember, and login securely with two factors of authentication.”

The latest edition – AuthAnvil Single Sign On version 3.5 – is available for both new and existing customers. All they need to do is download the AuthAnvil Single Sign On 3.5 upgrade and install it to take advantage of the recently-developed features.

Aren’t already using AuthAnvil Single Sign On? Learn more about AuthAnvil Single Sign On and how it saves time while increasing security.

Microsoft patch Tuesday caused Wednesday whammy for AuthAnvil Password Solutions

Hey guys,

Just a quick note if you are trying a new install of AuthAnvil Password Solutions today and its not working for you. Yesterday Microsoft decided in their infinite wisdom to update many of the links to their x86 pre-req runtimes. That has caused some issues with our installers, which prevents the intelligence engine that downloads the Microsoft pre-reqs from their site to fail, blocking the installation.

We are aware of the issue and are actively building a new set of installers that address this issue. They are just going into QA testing now and should be available in the next few days. In the meantime, if you are having an issue doing a new install please open a case at www.scorpionsoft.com/help/ and our Customer Service team would be happy to help and point you to appropriate guidance in our knowledgebase on how to get around this so you can have a successful install.

Our apologies for the inconvenience.

WordPress Plugin now available for AuthAnvil Single Sign On

Now you can access your WordPress website dashboard directly through AuthAnvil Single Sign On. WordPress is the world’s largest blogging and website content management system in the world. Chances are you view hundreds of WordPress-based sites a week, or you use WordPress for your own website.

Our single sign-on software allows you to sign in once, and then have instant access to multiple services like WordPress, Salesforce, and Google Apps without having to enter additional usernames or passwords. You logon once using secure two-factor authentication, and from your AuthAnvil Single Sign On dashboard you have easy and secure one click access to get where you need to go.

• Step 1 – download the WordPress Plugin here
• Step 2 – follow instructions in our install documentation about how to configure WordPress into AuthAnvil Single Sign On.

It’s that easy. Now you can get into WordPress without having to remember a username and password. Sure it’s handy, but it also increases your security. Single sign-on completely eliminates passwords (it uses federation instead), so not only do you connect securely, you have an audit trail with identity assurance.

AuthAnvil Single Sign On also gives you greater control of user access. If you have multiple people contributing to and editing your WordPress website, you have many different passwords floating around that could lead to a potential open door to your site. With AuthAnvil Single Sign On the user never even has to know that password in the first place, so you can control the strength and complexity of all passwords for the WordPress backend.

You can still get into your WordPress website directly with your username and password at the admin logon, but that logon is an unprotected access point. Our best practice recommendation is to install and enable the AuthAnvil Two Factor Auth WordPress Logon Agent plugin as well. Now you have the security of two factor authentication and the ease of access that single sign-on provides.

Don’t use AuthAnvil Single Sign On in the first place? Learn more about AuthAnvil Single Sign On and how it saves you time and increases security.

Scorpion Software gets new digs!

A few weeks ago, we moved into our new building and have just about finished settling in and putting the final touches on the place. It’s a fantastic building with a nice big bright open space for the developers, and loads of natural sunlight for everybody else. Importantly, to make sure that we always remember what what we’re here to do, Dana made a point of putting our mission statement up on the wall in the developers’ area, so that we would see it every single day.

We’re looking forward to a good many years in this place, and plan to solve the world’s password problems from here.

One last thing. If you need to send us snail mail, the new address is:

Scorpion Software Corp.
#101 – 44981 Commercial Court
Chilliwack, BC
V2R 0A7 Canada

If you’ve got something in the mail right now headed to the old address, don’t worry, we’ll be forwarding the mail for some time to come. If you’d like to contact us using another method, check out the contact us page for all of our information.

AuthAnvil Two Factor Auth 4.5.2 update now available

Yesterday afternoon, we released an update for AuthAnvil Two Factor Auth 4.5 and 4.5.1 that resolves an additional condition that can cause the AuthAnvil Licensing Manager to fail to connect to the AuthAnvil Two Factor Auth database and shut down. This is a recommended update for all customers running AuthAnvil Two Factor Auth 4.5 and 4.5.1.

Check out the upgrade documentation for instructions on updating your AuthAnvil Two Factor Auth installation. Customers doing new Two Factor Auth installs and upgrades from previous versions using the AuthAnvil Two Factor Auth 4.5 installer don’t need to worry, they’ll get the latest bits automatically.