[2318] in Kerberos
Re: kerberizing xlock ???
daemon@ATHENA.MIT.EDU (Alan Crosswell)
Fri Oct 30 11:09:30 1992
Date: Thu, 29 Oct 1992 16:39:33 GMT
From: alan@curta.cc.columbia.edu (Alan Crosswell)
To: kerberos@shelby.Stanford.EDU
In article <9210290256.AA18310@neptune.ctron> hendrick@neptune.ctron.com (Jim
Hendrick) writes:
> I am trying to figure out how to "correctly" kerberize xlock. I
> have sources and would like to replace the authentication via
>
> pw = getpwnam(cuserid(NULL));
> strcpy(userpass, pw->pw_passwd);
>
> ....
>
> done = !((strcmp(crypt(buffer, userpass), userpass))
> && (!allowroot || strcmp(crypt(buffer, rootpass), rootpass)));
>
>
>
> etc. with the appropriate kerberized login verification. I have looked at the
> sources to login and rlogin and think I should be able to use login to
> authenticate this via appropriate calls but how? I don't mind writing the
> code but I am new to kerberos and #1 don't want to open a hole or
> #2 re-invent the wheel :-) If any of you have done this, please let me know
> or else I will press onward as time permits and eventually (if successful)
> post the finished sources or something . . .
>
>
> Thanks
>
> Jim
>
The basic things you will want to do are:
1. Find out some stuff about your kerberos environment:
krb_get_lrealm(realm, 1) /* fills in realm with my realm name */
2. Create a temporary ticket file (so you don't clobber the user's normal
ticket cache):
sprintf(tkfile,"/tmp/tkt_xlock_%d",getpid());
krb_set_tkt_string(tkfile); /* set the name of the tkt file */
3. Change the xlock code that reads the password string to deal with the much
longer max kerberos password length. There's a kerberos function that
does this: read_long_pw_string(), but I suspect you will need to do it
yourself since xlock does some X call to get the text.
4. Try to obtain a kerberos ticket-granting-ticket & succesfully decrypt
it (thereby proving that you know the password):
rc = krb_get_pw_in_tkt(username, /* kerberos user name */
NULL, /* null instance */
realm, /* local realm */
"krbtgt", /* name of service I want */
realm, /* instance of service I want */
1, /* ticket lifetime in 5 min. clicks*/
password); /* password string */
if (rc == KSUCCESS) then the password was OK.
You will have to read the source code to get_in_tkt.c for documentation
of this function as it is not in the man3 directory:-)
5. Clean up after yourself:
bzero(password,sizeof(password));
dest_tkt(); /* destroy the temporary ticket file */
All the above instructions are for kerberos v4 which is what I assume you
are using.
/a
