Messages & Announcements

An HCC user account's information was recently stolen. In this case, a remote machine was compromised, and a login ID and passwd obtained. All evidence is that the account was not able to escalate privileges beyond user level. Currently login to Sandhills and Tusker is disabled while final tests are performed. This attack would have been thwarted by Duo 2-factor authentication.

I have thus directed that password-only login to HCC machines be disabled immediately. Starting today, all HCC machines (Crane, Tusker and Sandhills) will require Duo two-factor authentication for access. This will require either a smart phone or one can obtain a yubikey for a small fee ($15). Details concerning Duo security may be found here:

https://hcc-docs.unl.edu/display/HCCDOC/Setting+up+and+using+Duo

We will set up accounts face to face; HCC staff both in Lincoln (Schorr 118) and in Omaha (PKI 152) will be available from 9am to 5pm to sign up users for Duo authentication. We will further have a staff member at UNMC most of the day tomorrow (details to be mailed), and are willing to come to your lab, or at least your part of campus, upon request. You may follow this message at the HCC web site for further updates. (http://hcc.unl.edu/hcccreditedit/messages.php)

This is not my preferred time frame to implement this; I realize this is sudden. However, we have suffered several similar attacks recently which would have been thwarted by Duo 2-factor authentication. A single Duo sign on will work for all HCC machines. Those signed up already for Crane are already all set. The trade off is immediate nuisance verses the ongoing risk of yet another stolen account -- in the latter case, the worst case scenario is well beyond inconvenience.

*Please bring a laptop when you come to sign up so we can immediately verify your access.*

Our intent is to do all we can to move forward as quickly as possible with this process. In the case of off-campus colleagues we will find a work around on a case by case basis. For most users, it will be quick and easy to add this second factor via the Duo Security app on their smart phone.

If you have questions or concerns, please contact us at hcc-support@unl.edu.

***If you have a hard deadline or other immediate need please contact me directly and I will work with you to find a solution. My contact info is included below.***

Sincerely,
David Swanson
dswanson@cse.unl.edu
402-472-5006