[2169] in Kerberos
my previous question refined
daemon@ATHENA.MIT.EDU (Danny Nessett)
Fri Sep 4 18:53:27 1992
Date: Fri, 4 Sep 92 15:31:08 PDT
From: nessett@ocfmail.ocf.llnl.gov (Danny Nessett)
To: kerberos@Athena.MIT.EDU
Recently I asked a question about using su through a connection established
by a Kerberized rlogin daemon. I have received a number of helpful responses
for which I thank the authors. However, my question had a nuance that
wasn't clearly expressed. Let me try again.
Suppose I want to bring up a machine that could only be accessed via
Kerberos. This would require properly Kerberized r-tools, Telnet, FTP,
etc. Now suppose that I am logged onto this machine and want to execute
the su utility. Traditionally, this utility allows me to change to root
access, if I have a root identity and know its password and it also
allows me to change my identity to another user if I know his/her identifier
and password. However, since this machine is completely Kerberized, the
only password I know is my Kerberos password and this isn't stored in
the /etc/passwd file that su accesses. In fact this file probably
won't have any encrypted password at all.
Several responders suggest using a root password held by Kerberos to
gain root privileges. This means passing your root password to
the remote machine. To protect it, you probably want to logon originally
by executing "rlogin -x". Of course, this means either knowing ahead of
time you want to change to root, or (more likely) always executing "rlogin -x".
The only question remaining for this option is whether ksu allows you
to login directly as another user or whether you have to become root
and then use su to do that. Of course, this option doesn't help if you
Telnet to the machine.
Barry Jaspan points out that support of ksu could provide a security hole
if the machine doesn't have a rcmd.<hostname> srvtab. That's another concern,
but can be taken care of by proper administrative controls (of course it
often happens that administration is sloppy).
Jon Rocklis suggests either using ksu or "rlogin -l root". The latter option
doesn't work for Telnet.
Asokan says that Waterloo has something called kesc, that protects the
root password as it travels to the remote machine. Interestingly, Waterloo
has a system administrator who telecommutes, which is a concrete reason
why the su problem is not just theoretical. I will look at the kesc
documentation to see how it does this to determine if it can be used wit
Telnet.
Finally, Jeff Schiller suggests having two identities within a Kerberos
Realm, one for ordinary work and one for root work. When you want to
do root work, you logoff the remote machine, su to root (which gets root
access tickets) and then logon to the remote machine. I'm not sure, but
I think this means that a user with root privilege has those privileges
on all machines.
Of all these suggestions, it seems like ksu is the most workable except
for the problem of passing your root password in the clear. If kesc
works with Telnet, maybe even that problem is solved (again assuming
ksu allows you to change directly to another user).
Dan Nessett
