[22594] in Kerberos
Re: Cross-realm security issues
daemon@ATHENA.MIT.EDU (Sam Hartman)
Wed Sep 29 17:48:48 2004
To: Fredrik Tolf <fredrik@dolda2000.com>
From: Sam Hartman <hartmans@mit.edu>
Date: Wed, 29 Sep 2004 17:47:12 -0400
In-Reply-To: <1096468043.10848.43.camel@pc7.dolda2000.com> (Fredrik Tolf's
message of "Wed, 29 Sep 2004 16:27:23 +0200")
Message-ID: <tslacv83fz3.fsf@cz.mit.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
>>>>> "Fredrik" == Fredrik Tolf <fredrik@dolda2000.com> writes:
Fredrik> See, I don't understand how this can be a security issue
Fredrik> at all. I mean, I realize of course that the security of
Fredrik> a principal is no greater than the security of its realm,
Fredrik> but as far as I know principals from foreign realms don't
Fredrik> get authorized unless one explicitly adds them to one's
Fredrik> ~/.k5login, isn't that so? If that truly is the case, how
Fredrik> can cross- realm authentication possibly be an issue in
Fredrik> any way?
I tend to agree with your understanding. It could be a problem if you
don't trust your users to make reasonable authorization decisions.
I think most of the concern about cross-realm security is unfounded.
--Sam
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
