[2165] in Kerberos
Re: how does kerberos handle su utility
daemon@ATHENA.MIT.EDU (jon@MIT.EDU)
Fri Sep 4 13:18:20 1992
From: jon@MIT.EDU
To: nessett@ocfmail.ocf.llnl.gov (Danny Nessett)
Cc: kerberos@Athena.MIT.EDU
In-Reply-To: Your message of Fri, 04 Sep 92 09:08:35 -0700.
Date: Fri, 04 Sep 92 12:52:20 BST
We do two things:
1) don't use su, instead "rlogin -l root" to the machine in question.
Put the kerberos names of those authorized to be root on the machine
in question in /.klogin. We use a convention of putting only .root
instances in /.klogin, but that's up to you.
2) use the "ksu" program. You run this once you've logged into the
machine and it prompts you for your root instance password. (You need
to have a srvtab on the machine or you have a potential problem with
spoofing.) The advantage of ksu is that you don't maintain password
information on the end machine.
As you point out using ksu does involve typing an important password
in the clear. You should really only use ksu over a secure channel,
i.e. an encrypted remote login or from the console of the machine in
question. I suppose you could modify ksu to use your existing TGT,
but then you'd have to guard unattended terminals more carefully. For
these reasons, I recommend just using remote login as root and not
using ksu.
-- Jon
