[2170] in Kerberos
Re: my previous question refined
daemon@ATHENA.MIT.EDU (Mark W. Eichin)
Fri Sep 4 20:26:06 1992
Date: Fri, 4 Sep 92 20:13:02 EDT
From: "Mark W. Eichin" <eichin@cygnus.com>
To: nessett@ocfmail.ocf.llnl.gov (Danny Nessett)
Cc: kerberos@Athena.MIT.EDU
In-Reply-To: [2169]
Mr. Nesset makes several comments...
> the remote machine. To protect it, you probably want to logon originally
> by executing "rlogin -x". Of course, this means either knowing ahead of
> time you want to change to root, or (more likely) always executing "rlogin -x".
I do work cross-country (via AlterNET and NEARnet); the 56Kbps
link at the other end is far more of a bottleneck than DES encryption
will ever be. I always use encrypted rlogin.
Note that the 91.03.25 version of telnet does support toggling
encryption on and off, inbound and outbound, if you do notice the
performance.
> Jon Rochlis suggests either using ksu or "rlogin -l root". The latter option
> doesn't work for Telnet.
Actually, when the aforementioned telnet is invoked as rlogin,
it *does* work. (It seems not to work for root, but there is no
problem switching to other users based on the .klogin file; failing as
root in particular appears to be simply a bug.)
> access tickets) and then logon to the remote machine. I'm not sure, but
> I think this means that a user with root privilege has those privileges
> on all machines.
The only machines that a user with a root instance has root
access to (via rlogin or ksu) are those with their root instance
listed in the /.klogin file. This could easily be no machines at all;
root access has nothing to with the name of the instance, all that
matters is that the name of the principal given is on the access
control list.
> Barry Jaspan points out that support of ksu could provide a security hole
> if the machine doesn't have a rcmd.<hostname> srvtab. That's another concern,
If the machine is "tightly kerberized" as you describe, then
without such a srvtab, you won't be able to get in at all, other than
from a directly wired terminal, so ksu won't be a threat. It is still
important to be careful about making ksu available on "client only"
machines that don't have such a srvtab.
> do root work, you logoff the remote machine, su to root (which gets root
> access tickets) and then logon to the remote machine. I'm not sure, but
I don't think Jeff implied that it was necessary to log off;
most of us use window systems of some sort, so popping up an
additional connection isn't a hassle.
_Mark_ <eichin@cygnus.com>
Cygnus Support --
"Cygnus Network Security"
