[2167] in Kerberos
Re: how does kerberos handle su utility
daemon@ATHENA.MIT.EDU (Jeffrey I. Schiller)
Fri Sep 4 15:09:01 1992
Date: Fri, 4 Sep 92 14:43:34 -0400
From: Jeffrey I. Schiller <jis@mit.edu>
To: nessett@ocfmail.ocf.llnl.gov
Cc: kerberos@Athena.MIT.EDU, nessett@ocfmail.ocf.llnl.gov
In-Reply-To: Danny Nessett's message of Fri, 4 Sep 92 09:08:35 PDT <9209041608.AA16275@ocfmail.ocf.llnl.gov>
Basically the notion of an "su" utility doesn't mix well with insecure
networks. We solve this problem at MIT in two different fashions. One
approach is for each potentially privileged user to have a second
instance name, in my case it is jis.root@ATHENA.MIT.EDU. On each
machine for which I am entitled to become "root", there is an entry in
/.klogin for jis.root@ATHENA.MIT.EDU.
If I need to be "root" on some non-local machine, I first obtain
jis.root tickets locally and then I login as root on the remote
machine. Note: When you login as root on one of our machines over the
network, it logs the fact ALONG WITH THE AUTHENTICATED PRINCIPAL THAT
MADE THE CONNECTION. So even though I am logged in as "root" on the
destination machine, the audit logs indicate that
jis.root@ATHENA.MIT.EDU is the initiator of the connection.
As a hack we modified "su" to that it gets ".root" tickets for its
invoker and then becomes the root locally. From a user interface
standpoint this means that first I "su" on my local workstation
(giving my .root instance password) and then rlogin to the destination
machine.
The second approach to this whole problem is to use encrypted rlogin.
If your connection to the remote system is encrypted, then it is safe
to use "su" remotely and type in a password.
-Jeff
