[22255] in Kerberos
Re: UI for Kerberos accounts administration
daemon@ATHENA.MIT.EDU (Lukas Kubin)
Mon Aug 23 05:40:29 2004
Message-ID: <4129BA16.4040307@opf.slu.cz>
Date: Mon, 23 Aug 2004 11:34:14 +0200
From: Lukas Kubin <kubin@opf.slu.cz>
MIME-Version: 1.0
To: kerberos@mit.edu
In-Reply-To: <tslsmah22v3.fsf@cz.mit.edu>
Content-Type: multipart/mixed; boundary="===============81002590798803165=="
Errors-To: kerberos-bounces@mit.edu
This is a cryptographically signed message in MIME format.
--===============81002590798803165==
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature";
micalg=sha1; boundary="------------ms000400000805000102050403"
This is a cryptographically signed message in MIME format.
--------------ms000400000805000102050403
Content-Type: multipart/mixed;
boundary="------------070300020407010109030704"
This is a multi-part message in MIME format.
--------------070300020407010109030704
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Sam Hartman wrote:
>>>>>>"Lukas" == Lukas Kubin <kubin@opf.slu.cz> writes:
>
>
> Lukas> I'm planning to build an web interface for administering
> Lukas> our Kerberos/OpenAFS/LDAP accounts. How should I pass
> Lukas> credentials to the web service? I can use the mod_auth_kerb
> Lukas> module for Apache. Then some wrapper script will call
> Lukas> kadmin command. When I want kadmin not to ask for password
> Lukas> everytime it is called, I'll have to create an
> Lukas> administrator's keytab stored on the webserver. That way
> Lukas> appear not to be secure.
>
> Why is this not secure? It places your web service in the role as a
> privilege delegation service rather than as acting as the user
> directly.
In this design I need to store administrator's password in a keytab file
on webserver. In case someone breaks into the webserver, he/she can
easily misuse the keytab to "administer" our Kerberos accounts. That's
what I consider insecure.
Do the K5 enabled sites administer accounts this way?
How do they create accounts for new users? Using some shell script -
kadmin wrapper? Are there any examples of such scripts?
Thank you.
lukas
>
> You actually tend to want this though. At many sites it is reasonable
> for a larger set of users to go through all the steps of creating a
> properly configured account all at once than it is to allow a user to
> only go through one of the steps of account setup. If only the web
> server is authorized to act, it can enforce constraints like this.
>
> --Sam
>
>
--
Lukas Kubin
phone: +420596398275
email: kubin@opf.slu.cz
Information centre
The School of Business Administration in Karvina
Silesian University in Opava
Czech Republic
http://www.opf.slu.cz
--------------070300020407010109030704
Content-Type: text/x-vcard; charset=utf-8;
name="kubin.vcf"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
filename="kubin.vcf"
begin:vcard
fn:Lukas Kubin
n:Kubin;Lukas
org:The School of Business Administration in Karvina;Information centre
adr:;;Univerzitni namesti 1934/3;Karvina;;73340;Czech Republic
email;internet:kubin@opf.slu.cz
title:Network administrator
tel;work:+420596398275
x-mozilla-html:FALSE
url:http://www.opf.slu.cz
version:2.1
end:vcard
--------------070300020407010109030704--
--------------ms000400000805000102050403
Content-Type: application/x-pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature
MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIGbDCC
AzIwggIaoAMCAQICAgDmMA0GCSqGSIb3DQEBBAUAMDIxCzAJBgNVBAYTAkNaMQ8wDQYDVQQK
EwZDRVNORVQxEjAQBgNVBAMTCUNFU05FVCBDQTAeFw0wMzExMTkxNDM4NTdaFw0wNDExMTgx
NDM4NTdaMEUxDzANBgNVBAoTBkNFU05FVDEcMBoGA1UEChMTU2lsZXNpYW4gVW5pdmVyc2l0
eTEUMBIGA1UEAxMLbHVrYXMga3ViaW4wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAL7l
zAuBktAjhaVuPR0S2kwnO/xt1fp9D2GdLpxu2NcqUsuyEC00k3VHEijgFzcNt7+QviV1y5nq
P3nmCqk+eNp20Z3qrYZKGh0YTho/qPESyjFZ4P2NmV7W+SewXZ0IEtxD/DaOMQo8kww1ho5y
zaxVgSRItwefSBEMmFYdqrxpAgMBAAGjgcIwgb8wHQYDVR0OBBYEFNBqBwZMDvExebpgW4m8
MCWtsegvMB8GA1UdIwQYMBaAFPhWGtmaeJVttIiEVTUvqgbz1yBaMDUGA1UdHwQuMCwwKqAo
oCaGJGh0dHA6Ly93d3cuY2VzbmV0LmN6L3BraS9jcmwvY2NhLmNybDAOBgNVHQ8BAf8EBAMC
BPAwGwYDVR0RBBQwEoEQa3ViaW5Ab3BmLnNsdS5jejAZBgNVHSAEEjAQMA4GDCsGAQQBvnkB
AgIBATANBgkqhkiG9w0BAQQFAAOCAQEAuI/sMxZZa78h5+Mzo3IhgSxrVMl5Hbm2YgLWLHAx
QG1NxG0W9bkggMmRWrW8Xotr8VPA4IySqBiVwOlVMdZ5GNcUiSCrrFU6zfxAXD6dAJuEHGfb
Vz/dQntptJ9Dz/URteoMleNZjn2gPaLELEax2gaF+2cvbpW521CFJrxxMc2LdScRDBCFapWO
GNbxqSflLqbT8TsrbmS1V6zUicXf2eUurKA36/psbtFdG03vVaD3+V+RMgHr6X5k1NUfDfSI
pmX7irFEn7tMrxq630NTJUrEm1w4ivK/+f+6+F0ozeaamYS/Gm7LUFSgA15ZDtGCKySWQp2V
B+gwUKfc+8R+WjCCAzIwggIaoAMCAQICAgDmMA0GCSqGSIb3DQEBBAUAMDIxCzAJBgNVBAYT
AkNaMQ8wDQYDVQQKEwZDRVNORVQxEjAQBgNVBAMTCUNFU05FVCBDQTAeFw0wMzExMTkxNDM4
NTdaFw0wNDExMTgxNDM4NTdaMEUxDzANBgNVBAoTBkNFU05FVDEcMBoGA1UEChMTU2lsZXNp
YW4gVW5pdmVyc2l0eTEUMBIGA1UEAxMLbHVrYXMga3ViaW4wgZ8wDQYJKoZIhvcNAQEBBQAD
gY0AMIGJAoGBAL7lzAuBktAjhaVuPR0S2kwnO/xt1fp9D2GdLpxu2NcqUsuyEC00k3VHEijg
FzcNt7+QviV1y5nqP3nmCqk+eNp20Z3qrYZKGh0YTho/qPESyjFZ4P2NmV7W+SewXZ0IEtxD
/DaOMQo8kww1ho5yzaxVgSRItwefSBEMmFYdqrxpAgMBAAGjgcIwgb8wHQYDVR0OBBYEFNBq
BwZMDvExebpgW4m8MCWtsegvMB8GA1UdIwQYMBaAFPhWGtmaeJVttIiEVTUvqgbz1yBaMDUG
A1UdHwQuMCwwKqAooCaGJGh0dHA6Ly93d3cuY2VzbmV0LmN6L3BraS9jcmwvY2NhLmNybDAO
BgNVHQ8BAf8EBAMCBPAwGwYDVR0RBBQwEoEQa3ViaW5Ab3BmLnNsdS5jejAZBgNVHSAEEjAQ
MA4GDCsGAQQBvnkBAgIBATANBgkqhkiG9w0BAQQFAAOCAQEAuI/sMxZZa78h5+Mzo3IhgSxr
VMl5Hbm2YgLWLHAxQG1NxG0W9bkggMmRWrW8Xotr8VPA4IySqBiVwOlVMdZ5GNcUiSCrrFU6
zfxAXD6dAJuEHGfbVz/dQntptJ9Dz/URteoMleNZjn2gPaLELEax2gaF+2cvbpW521CFJrxx
Mc2LdScRDBCFapWOGNbxqSflLqbT8TsrbmS1V6zUicXf2eUurKA36/psbtFdG03vVaD3+V+R
MgHr6X5k1NUfDfSIpmX7irFEn7tMrxq630NTJUrEm1w4ivK/+f+6+F0ozeaamYS/Gm7LUFSg
A15ZDtGCKySWQp2VB+gwUKfc+8R+WjGCAicwggIjAgEBMDgwMjELMAkGA1UEBhMCQ1oxDzAN
BgNVBAoTBkNFU05FVDESMBAGA1UEAxMJQ0VTTkVUIENBAgIA5jAJBgUrDgMCGgUAoIIBRTAY
BgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0wNDA4MjMwOTM0MTRa
MCMGCSqGSIb3DQEJBDEWBBQddqI4Z5zva33bCU+vDXqIMXIT6jBHBgkrBgEEAYI3EAQxOjA4
MDIxCzAJBgNVBAYTAkNaMQ8wDQYDVQQKEwZDRVNORVQxEjAQBgNVBAMTCUNFU05FVCBDQQIC
AOYwSQYLKoZIhvcNAQkQAgsxOqA4MDIxCzAJBgNVBAYTAkNaMQ8wDQYDVQQKEwZDRVNORVQx
EjAQBgNVBAMTCUNFU05FVCBDQQICAOYwUgYJKoZIhvcNAQkPMUUwQzAKBggqhkiG9w0DBzAO
BggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwICASgw
DQYJKoZIhvcNAQEBBQAEgYAF+KUnlHmgdbWz3OEofiZxeHDuGMAa+zao23mLl4aWp2nMgY8g
rddaQkxzTFnGl+p4LmZWWJuHd5JvkGns/LEk4X+X7YcIzPkEFfKZ4ftxbqQoZxkW9oUHJL15
7zrGdt52cjNbWh/MQeQNnrqHHfBx23iU0S0lPrd38gDabK1UBwAAAAAAAA==
--------------ms000400000805000102050403--
--===============81002590798803165==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
--===============81002590798803165==--
