[2164] in Kerberos
how does kerberos handle su utility
daemon@ATHENA.MIT.EDU (Danny Nessett)
Fri Sep 4 12:40:19 1992
Date: Fri, 4 Sep 92 09:08:35 PDT
From: nessett@ocfmail.ocf.llnl.gov (Danny Nessett)
To: kerberos@Athena.MIT.EDU
Cc: nessett@ocfmail.ocf.llnl.gov
During discussions on another topic, the question arose how remote execution
mechanisms handle on-machine utilities that require authentication. In the
context of Kerberos this question is formulated as follows. If a machine
runs a Kerberized version of rlogin and rexec, is it possible to do away
with user passwords altogether. In particular, once a user has been
authenticated by Kerberos to, let's say, rlogin, how does he then use
the su utility. Since it expects a password when changing the process
effective uid to a different user, this seems to suggest that the user
must also have a password on the machine. Furthermore, this password will
travel in the clear from the machine to which the user's terminal is
attached to the machine running rlogin.
We tried to come up with a scenario whereby the su utility is kerberized, but
kept running into the problem that su expects input to come from a
terminal. Are we missing something obvious here?
Dan Nessett
