[29555] in Kerberos
Re: delegating principal creation to a web process
daemon@ATHENA.MIT.EDU (Jason Edgecombe)
Thu Mar 20 21:37:52 2008
Message-ID: <47E31132.5020701@rampaginggeek.com>
Date: Thu, 20 Mar 2008 21:36:50 -0400
From: Jason Edgecombe <jason@rampaginggeek.com>
MIME-Version: 1.0
To: Russ Allbery <rra@stanford.edu>
In-Reply-To: <87tzj18bul.fsf@windlord.stanford.edu>
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Russ Allbery wrote:
> Simon Wilkinson <simon@sxw.org.uk> writes:
>
>
>> It's not clear from your description how you check that the script is
>> creating the 'correct' account name for a particular user - nor how you
>> protect against denial of service attacks, or attacks which create
>> 'magic' account names (root, <blah>/ admin, anything else your site has
>> in a wildcard)
>>
>
> http://www.eyrie.org/~eagle/software/kadmin-remctl/ may be helpful in that
> respect.
>
>
The script will check that the user is in the /etc/password file. The
keytab will only have privileges to add accounts, so existing accounts
like admin/root are safe.
How would remctl give me more security in this arrangement? The key
issue seems to be protecting the keytab, verifying the url used, and
validating the request for the a valid username to create.
Jason
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
