Aloaha Smartlogin contains a Credential Provider for Windows Vista/7/8/2008/2012 and a Gina for older windows. It supports many different ways to logon a user to the windows session.

Active Directory is supported but NOT required!

The most popular way of using Aloaha Smartlogin without Active directory is with “any Smartcard natively supported by Windows or 3rd party middleware” as explained in http://blog.aloaha.com/2012/08/13/what-are-softtoken-in-aloaha-smartlogin/

Now we introduced new registry settings to allow the user to maintain one central, server based CredentialStore.

If you point the Registry Key: ”HKLM\Software\<Wow6432Node\>Aloaha\CSP\ForcedCredentialStore” to a share in your network Aloaha will copy automatically all files from that network store to the local machines credential store (<installdir>\CredentialStore) whenever the user logs on.

Many important settings are saved in the local file UserPass.ini. If you point ”HKLM\Software\<Wow6432Node\>Aloaha\CSP\MasterUserPassIni” to a file this file will be automatically copied to the file defined in ”HKLM\Software\<Wow6432Node\>Aloaha\CSP\UserPassIni” (Usually <installdir>\UserPass.ini)

Please dot not hesitate to contact us at info@aloaha.com in case you need further and personal assistance.

The latest release of the Aloaha Smartcard Middleware Aloaha Smartcard Connector (http://www.aloaha.com/download/cardconnector.zip) now also supports the popular Muscle Applet.

Included in the Middleware is a Crypto Service Provider, PKCS #11 Module, Harddisk Encryption and a Password Safe.

As an add-on the user can use Aloahas Smartlogin for Smartcard based Windows Logon with or without Active Directory. (http://www.aloaha.com/download/smartlogin.zip)

With faster machines and even faster hard drives (SSD) holding large rainbow tables the average cracking time on a dual processor machine came down to just 15 minutes (according to OBJECTIF SÉCURITÉ).

Also a good german article: http://www.n-tv.de/technik/Passwoerter-werden-unsicherer-article10092261.html

A good english article: http://www.deloitte.com/view/en_GX/global/industries/technology-media-telecommunications/tmt-predictions-2013/tmt-predictions-2013-technology/9eb6f4efcbccb310VgnVCM1000003256f70aRCRD.htm

Having that in mind it is time to consider different logon mechanism with extreme large passwords or two factor authentication.

The Aloaha Smartlogin is one Credential Tile (or Gina on XP) hosting a large number of new authentication methods:

1. Traditional Smartcard Certificate Login via Kerberos (Active Directory required)
Any smartcard holding a certificate issued by the domain CA can be used as a two factor authentication token without even having to have or know a password. Obviously this works also via RDP

2. Smartcard Login via Credentials encrypted with the certificate of the Smartcard.
Basically Username, optional Domain and Password are encrypted with the certificate. This encrypted token is used to authenticate the user. Passwords can be chosen extremely long. The user just needs to remember the PIN of the Smartcard. Aloaha will then use the smartcard to decrypt the extreme long password to pass it to the machine for authentication.
This mode supports Active Directory but does NOT require it. It also works via RDP.
Since there are no requirements on the certificate this mode is suggested for e-Health Cards, ATM Cards, Company Cards, etc.

3. Credentials saved on a PKCS11 Token.
Even here the user can choose an extreme long password. He does not need to remember it since it is stored inside the PKCS11 token. The user only needs to type in the PIN of the token to enable Aloaha to read the extreme long password to pass it for authentication.
This mode supports Active Directory but does NOT require it.

4. Credentials saved on a plain memory card
In this mode it is possible to use very cheap i2c memory cards. Certificates or Active directory are not required since no RSA encryption is involved.
Passwords are NOT saved on the memory card but only a hash. This hash will be compared to the inputted passwords hash and only if they match a logon is granted. So even if someone manages to crack a password he would still need the matching card to get access to the machine.

5. Credentials saved on a plain USB Memory Stick or mobile phone.
This methods works similar to the PKCS11 mechanism BUT cannot be considered as secure as the methods 1-3. It will work ONLY at the console since RDP sessions are NOT supported. This mode is freeware and does not require any license.

6. Custom Plugins
The Aloaha Smartlogin supports custom plugins so that customer are able to create their own authentication mechanism.

The evaluation version can be download from http://www.aloaha.com/download/smartlogin.zip

Your evaluation key is: 8CAAEF6D4-C9D980551-03136DBC5-438EADB32-AC1567A23-2E1E2256E (two weeks from today)
More information can be found on http://www.aloaha.com/smartcard-software-en/aloaha-credential-provider.php and of course in our blog on http://blog.aloaha.com/category/aloaha-smartcard-software-en/aloaha-smart-login/

SecureSIM: Aloaha secureSIM

Some weeks ago we explained how to disable unwanted Credential Providers completly.

http://blog.aloaha.com/2012/08/20/how-to-hide-credential-providers-from-the-windows-logon-user-interface-using-windows-group-policy/

Aloaha Credential Provider Filter

In some cases Credential Providers should be hidden from the Logon User Interface BUT still usable from within the session. For example somone might not want to see the Username/Password Tile during logon but obviously still requires it when mounting a network drive or connecting via RDP to another machine. In those case you cannot hide/disable the providers via windows group policy but a Credential Provider Filter is required.

Aloaha Smartlogin comes with an integrated Credential Provider Filter to be able to hide Tiles from the Windows Logon Interface WITHOUT removing its functionality inside the session.

To activate the Aloaha Credential Provider Filter you need to open the file UserPass.ini in the installation folder. In the section CredentialProviders you can configure different filter for different provider. To enable a filter please set it to 1. Below the section to disable ALL non Aloaha Provider:

[CredentialProviders]
25CBB996-92ED-457e-B28C-4774084BD562=1
3dd6bec0-8193-4ffe-ae25-e08e39ea4063=1
503739d0-4c5e-4cfd-b3ba-d881334f0df2=1
6f45dc1e-5384-457a-bc13-2cd81b0d28ed=1
8bf9a910-a8ff-457f-999f-a5ca10b4a885=1
94596c7e-3744-41ce-893e-bbf09122f76a=1
AC3AC249-E820-4343-A65B-377AC634DC09=1
e74e57b0-6c6d-44d5-9cda-fb2df5ed7435=1
F8A0B131-5F68-486c-8040-7E8FC3C85BB6=1

Many customers are asking if we know any website they can use to test and check website logon via Smartcard or certificate. To make it easier for those customers we configured a test page on https://card.aloaha.com/CertAuth

Please note that that site might generate a warning in your browser since the root certifcate of the page is not issued by a trusted root. You can ignore this warning since this is purely a test page without any content.

Also note that revocation checks are disabled via HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HTTP\Parameters\SslBindingInfo\0.0.0.0:443\DefaultSslCertCheckMode=1

Nevertheless it might be required that we import the root certificate of your smartcard certificate into the machine store. So should you not be able to logon to our test website please send your root (and if required also your intermediate) certificate as a zipped .cer file to info@aloaha.com

If you do not have a Middleware (CSP/PKCS11) for you smartcard yet please have a look at the Aloaha Cardconnnector. Currently it supports more than 45 different cards!

The download link is: http://www.aloaha.com/download/cardconnector.zip

After installation of Aloaha Smart Login, several credential providers are available to logon from the Windows logon user interface. This article explains how to hide certain credential providers from the Windows logon user interface via group policy. If you want to configure Aloaha to hide automatically other credential provider please have a look at: http://blog.aloaha.com/2012/08/14/aloaha-smartlogin-ini-settings/

This way, you can ensure that only the Aloaha credential provider is available for logon.

What To Do

To hide the Microsoft Windows 7 default credential providers after installation of Aloaha, a Windows Group Policy setting has to be configured, using either the local group policy editor (gpedit.msc) or the group policy management console (gpmc.msc).

Modify an existing group policy or create a new one and navigate to the “Exclude credential providers” setting:
Computer Configuration | Policies | Administrative Templates | System | Logon | Exclude credential providers.
Open the properties of the group policy setting, set the policy to “Enabled”
Use the “Exclude the following credential providers” field to exclude specific credential providers. Enter the comma separated-CLSIDs for multiple credential providers to be excluded from use during the authentication process.
If you just want to hide a certain credential provider, the following is a list of default Windows 7 credential providers CLSIDs:

Credential Provider,CLSID

• GenericProvider, {25CBB996-92ED-457e-B28C-4774084BD562}
• NPProvider, {3dd6bec0-8193-4ffe-ae25-e08e39ea4063}
• VaultCredProvider, {503739d0-4c5e-4cfd-b3ba-d881334f0df2}
• PasswordProvider, {6f45dc1e-5384-457a-bc13-2cd81b0d28ed}
• Password Provider\LogonPasswordReset, {8841d728-1a76-4682-bb6f-a9ea53b4b3ba}
• Smartcard Credential Provider, {8bf9a910-a8ff-457f-999f-a5ca10b4a885}
• Smartcard Pin Provider, {94596c7e-3744-41ce-893e-bbf09122f76a}
• WinBio Credential Provider, {AC3AC249-E820-4343-A65B-377AC634DC09}
• CertCredProvider, {e74e57b0-6c6d-44d5-9cda-fb2df5ed7435}

On a system with Aloaha installed, all other credential providers may be hidden using the following string:
{25CBB996-92ED-457e-B28C-4774084BD562},{3dd6bec0-8193-4ffe-ae25-e08e39ea4063},{503739d0-4c5e-4cfd-b3ba-d881334f0df2},{6f45dc1e-5384-457a-bc13-2cd81b0d28ed},{8841d728-1a76-4682-bb6f-a9ea53b4b3ba},{8bf9a910-a8ff-457f-999f-a5ca10b4a885},{94596c7e-3744-41ce-893e-bbf09122f76a},{AC3AC249-E820-4343-A65B-377AC634DC09},{e74e57b0-6c6d-44d5-9cda-fb2df5ed7435}

After applying the setting, only the Aloaha credential provider is shown during the authentication process.

To check for additionally installed 3rd party credential providers, open up the registry on the Windows 7 machine and browse to following location: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers]. Check for any 3rd party credential provider you want to hide and write down the providers CLSID. Configure the CLSID in the above mentioned group policy to hide the 3rd party credential provider.

Note:

Hiding credential providers via group policy also applies to UAC and RunAs authentication dialog boxes.
Make sure you unhide the hidden credential providers again if you plan to remove Aloaha from your system. If you leave them hidden, following removal of Aloaha, the Windows Logon User Interface does not provide you with a credential provider to authenticate, and the Windows credential providers remain hidden.
Hiding credential providers via group policy also applies to UAC and RunAs authentication dialog boxes.

If you need more information or guidance, then please contact technical support at info@aloaha.com

The new Aloaha Smartlogin has been released today. It can be downloaded from http://www.aloaha.com/download/smartlogin.zip

Evaluation Keys can be requested from info@aloaha.com

Aloaha Smart Login

Our new version supports a broad range of Logon Token:

• Plain USB Memory Stick. Username/Password is saved encrypted on any plain USB Memory Token. This feature is currently freeware and does not require any domain.
  http://blog.aloaha.com/2012/08/12/use-plain-usb-memory-stick-as-windows-logon-token/
  video: http://blog.aloaha.com/2012/07/25/windows-logon-with-plain-usb-memory-stick/ 
• I2C Memory Card. Username and Password are written encrypted to the Memory Card. This mode does NOT require any domain or middleware installed and furthermore i2c cards are very cheap!
• PKCS#11 Token. The Username and Password can be saved in a protected field on your PIN protected PKCS #11 Smartcard or Token. The machine is not required to be member of any domain!
  http://blog.aloaha.com/2012/08/12/how-do-i-save-my-logon-credentials-to-a-pkcs11-token/
  video: http://blog.aloaha.com/2012/07/26/windows-logon-via-credentials-saved-encrypted-on-pkcs-11-token/
• Any Smartcard natively supported by Windows or 3rd party middleware. We call this also Encrytion Token since Username and Password will be encrypted with the certificate on the card but saved locally (or on a share/URL) as encypted softtoken. To logon the user needs the PIN, the smartcard and the softtoken has to be reachable. This methods works without any domain controller!
  http://blog.aloaha.com/2012/08/13/what-are-softtoken-in-aloaha-smartlogin/ 
  video: http://blog.aloaha.com/2012/07/28/windows-logon-via-any-smartcard/ 
• PKI/Kerberos Logon with Windows or 3rd Party supported smartcard as above but in this new mode NO Username or Password is being saved anywhere. The logon is a pure Kerberos Logon. That implies also that a Domain Controller and a Domain Certificate is required!
  video: http://blog.aloaha.com/2012/07/29/windows-logon-via-any-smartcard-and-kerberos/

Requirements

1. Windows XP 32 bit
2. Windows Vista or higher (32 and 64 bit)
3. “Smart Card” Service running (SCardSvr)
4. .NET 3.5 or higher installed
5. Logon Token. For example USB Memory Key, Smartcard, Memorycard, Mobile.

Special Features:

Licensing

• The use of Plain USB Stick token is freeware
• For licensed user of the Aloaha Middleware (Aloaha Cardconnector) Smartlogin is freeware
• Licenses for Smartlogin can be purchased on http://www.aloaha.com/shop-en/aloaha-smart-login.php

Some settings in <installdir>UserPass.ini are essential to control the look and feel and behavior of the Credential Tiles and/or the GINA.

[Generic]

Enable/Disable Username Field in Credential Provider Tile or Gina
One value should be always 1 and one value 0
DisableUserName=1
EnableUserName=0

AllowUP controls wether the Aloaha Service should enable or disable other credential tiles. AllowUP=0 disables ALL other credential tiles! If you want to use group policies please have a look at: http://blog.aloaha.com/2012/08/20/how-to-hide-credential-providers-from-the-windows-logon-user-interface-using-windows-group-policy/
AllowUP=1

The Kerberos Section defines which Smartcards are considered as PKI/Kerberos Cards
If the value the Middleware Name or Smartcard Name is 1 the Smartcard is not considered as Encryption Token but als pure PKI Card!
The value 1 should NEVER be used in stand alone machines but ONLY in domain machines!

[Kerberos]
aloaha_3BDB18FFC080B1FE751F035A43372E352052455620416F=1
Aloaha Cryptographic Provider=1
Datakey M 330=1
eToken Base Cryptographic Provider=1

The Aloaha Smart Login Supports a broad range of Logon Tokens. For example memory cards or sticks, PKI or Kerberos Smartcards, PKCS11 token, etc.

For that reason it is not really required that Windows shows all logon tiles as below:

Windows Logon TIles

During the start of the Aloaha Service it checks some settings in <installdir>Userpass.ini. If you set AllowUP=0 the Aloaha Service will disable ALL other Credential Tiles:

[Generic]
AllowUP=0

The result will look like:

Aloaha Credential Tile only

The Aloaha Smartlogin GINA supports a broad range of logon token. For example Memory Sticks, Memory Cards (i2c), PKI Smartcards and also PKCS11 Token.

Depending on the token detected the Aloaha GINA will look different.

On http://blog.aloaha.com/2012/08/14/aloaha-smart-login-gina/ we explained already PKI/Kerberos Cards.

Here we will explain the GINA for all NON PKI or Kerberos Smartcards.

Per default the screen will look like:

Aloaha SmartLogin Gina any Token

In case the Domain/Username field is empty Aloaha will guess the Domain/Username automatically. With many tokens that is possible since the token itself contains the Username.

For that reason we made it easy to disable the Username Field completly. Just open the <installdir>\Userpass.ini and edit the required entries as shown below:

[Generic]
DisableUserName=1
EnableUserName=0
AllowUP=1

After a reboot the result looks like:

Aloaha Smart Login Gina no Username