[2314] in Kerberos
Re: kerberizing xlock ???
daemon@ATHENA.MIT.EDU (Steve Lunt)
Thu Oct 29 14:33:54 1992
Date: Thu, 29 Oct 92 13:44:40 EST
From: Steve Lunt <lunt@ctt.bellcore.com>
To: kerberos@Athena.MIT.EDU
> > I am trying to figure out how to "correctly" kerberize xlock.
>
> Be careful; Kerberos was not designed to do what you want. Here is an
> answer from the FAQ that will explain why.
The comments in the FAQ certainly apply to `login', but I use
a Kerberized xlock primarily to ensure I always have a fresh ticket
cache. I am not in this case worried about the spoofing that could
occur. An attacker would have to get physical access to my
workstation to type the password, whereas the analogous login
vulnerability only requires network connectivity.
I enclose below my diffs to the xlock source for Kerberos.
-- Steve
Steven J. Lunt Bellcore
Information Technology Security RRC 1L-213
lunt@bellcore.com 444 Hoes Lane
(908) 699-4244 Piscataway, NJ 08854
*** xlock.c.orig Mon Aug 13 15:14:22 1990
--- xlock.c Thu Aug 16 11:12:23 1990
***************
*** 469,474 ****
--- 470,476 ----
XDrawString(dsp, w, textgc, ICONX, y, invalid, strlen(invalid));
}
+ else get_tgt(pw->pw_name, buffer);
}
return 0;
}
________________________________________________
*** xlock.man.orig Wed Apr 3 15:46:22 1991
--- xlock.man Tue Oct 1 10:46:08 1991
***************
*** 59,64 ****
--- 59,67 ----
active as kill and erase respectively. To return to the locked screen,
click in the small icon version of the changing pattern.
+ Regardless of the outcome of the above, an attempt to fetch
+ a ticket granting ticket will be made for \fIusername@localrealm\fP
+ using the typed password.
.SH OPTIONS
.TP 5
.B \-display " dsp"
***************
*** 183,185 ****
--- 186,189 ----
.SH CONTRIBUTORS
milliken@heron.bbn.com karlton@wsl.dec.com
dana@thumper.bellcore.com vesper@3d.dec.com flar@sun.com
+ lunt@ctt.bellcore.com
________________________________________________
get_tgt.c:
/*
* Copyright 1987, 1988 by the Massachusetts Institute of Technology.
*
* For copying and distribution information, please see the file
* <mit-copyright.h>.
*
* Routine to refresh the ticket cache given a username and password.
* Generally called from a lockscreen program.
*
* Written by Steve Lunt 8/10/90
*/
#include <mit-copyright.h>
#include <stdio.h>
#include <krb.h>
#define LIFE 96 /* lifetime of ticket in 5-minute units */
get_tgt(username,password)
char *username, *password;
{
char aname[ANAME_SZ];
char inst[INST_SZ];
char realm[REALM_SZ];
strncpy(aname, username, sizeof(aname));
aname[sizeof(aname) - 1] = '\0';
*inst = *realm = '\0';
if (krb_get_lrealm(realm, 1))
return(0);
return(!krb_get_pw_in_tkt(aname, inst, realm, "krbtgt", realm, LIFE, password));
}
