[2171] in Kerberos
Re: my previous question refined
daemon@ATHENA.MIT.EDU (Glen Zorn)
Fri Sep 4 21:42:56 1992
Date: Fri, 4 Sep 92 17:24:12 PDT
From: glenz@ocsg.COM (Glen Zorn)
To: kerberos@Athena.MIT.EDU, nessett@ocfmail.ocf.llnl.gov
In article <9209042231.AA21478@ocfmail.ocf.llnl.gov>, nessett@ocfmail.ocf.llnl.gov (Danny Nessett) writes:
Several responders suggest using a root password held by Kerberos to
gain root privileges. This means passing your root password to
the remote machine. To protect it, you probably want to logon
originally
by executing "rlogin -x". Of course, this means either knowing ahead of
time you want to change to root, or (more likely) always executing
"rlogin -x".
The only question remaining for this option is whether ksu allows you
to login directly as another user
It does.
or whether you have to become root
and then use su to do that. Of course, this option doesn't help if you
Telnet to the machine.
Try the new, improved telnet, with Kerberos authentication *and* DES
encryption! ;-)
Asokan says that Waterloo has something called kesc, that *protects*
*emphasis mine*
the root password as it travels to the remote machine.
Personally, I'm not sure I'd want the root password floating about on the net,
"protected" or not. Passwords are relatively long-lived items -- a wiley
cracker would have something akin to forever to break the encryption, if the transmission was captured. That said, kesc does sound interesting. I'd like to
take a look at it myself.
Finally, Jeff Schiller suggests having two identities within a Kerberos
Realm, one for ordinary work and one for root work. When you want to
do root work, you logoff the remote machine, su to root (which gets
root
access tickets) and then logon to the remote machine. I'm not sure, but
I think this means that a user with root privilege has those privileges
on all machines.
I'm not sure, but I suspect that Jeff is suggesting the use of a root instance.
If that is the case, then only those machines on which you have a root instance
(i.e., nessett.root@ocfmail.ocf.llnl.gov) listed in /.klogin would allow you to rlogin as root. By the bye, if you used ksu on the local host, you wouldn't
need to kinit as root, since ksu gets an rcmd ticket itself as a safeguard.
Of all these suggestions, it seems like ksu is the most workable except
for the problem of passing your root password in the clear. If kesc
works with Telnet, maybe even that problem is solved (again assuming
ksu allows you to change directly to another user).
Actually, I think Jeff's suggestion is by far the most secure, though a bit
cumbersome.
~ Glen
Glen Zorn Network Security Analyst
glenz@OCSG.COM Open Computing Security Group
