[2174] in Kerberos
Existing authentication mechanisms have a deficiency
daemon@ATHENA.MIT.EDU (Danny Nessett)
Tue Sep 8 19:28:35 1992
Date: Tue, 8 Sep 92 16:03:34 PDT
From: nessett@ocfmail.ocf.llnl.gov (Danny Nessett)
To: kerberos@Athena.MIT.EDU
It seems to me, after the discussion about su, ksu, etc., that something is
missing from existing distributed authentication mechanisms. I am not picking
on Kerberos here, since I think the criticism is valid for other systems, such
as SPX. What I mean is this.
If an organization wants to keep its authentication data in exactly one place,
existing authentication mechanisms are insufficient. As Chuck Athey has pointed
out, you need at least an entry for root in /etc/passwd for the system to
be administered and integrated into a Kerberos realm. This means two sources
of authentication data must be maintained, one in the system's /etc/passwd
file (or some surrogate such as a yp database) and one in the Kerberos
database.
In order to keep all authentication data in one place, there needs to be
a suid root routine on each machine that accepts a user id and password from
a directly connected terminal, requests the appropriate credentials from
the Kerberos server (or SPX CDC server, etc) and executes the appropriate
authentication test. This same suid root routine could be used by a modified
su utility or by any other program that wants to do on-machine authentication.
Dan Nessett
