[2346] in Kerberos
Local password validation (was: kerberizing xlock)
daemon@ATHENA.MIT.EDU (Clifford Neuman)
Thu Nov 5 18:36:06 1992
Date: Thu, 5 Nov 92 15:04:35 PST
From: Clifford Neuman <bcn@ISI.EDU>
To: bf4grjc@socrates.MIT.EDU 595-8439)
Cc: bjaspan@Athena.MIT.EDU, kerberos@Athena.MIT.EDU
In-Reply-To: Ravi Ganesan (301's message of Thu, 5 Nov 92 14:00:50 EST <9211051900.AA01169@ramanujam.bell-atl.com>
From: bf4grjc@socrates.MIT.EDU (Ravi Ganesan (301) 595-8439)
Date: Thu, 5 Nov 92 14:00:50 EST
I feel that getting a ticket and then getting a service ticket and using that
service - under the condition the service is on the same machine, is a
theoretically messy, but practically convenient solution. (To recap a
hyper-kludgy hyper-quick and hyper-dirty way of doing this would be to
replace login with a combination of a kinit, a chown on the ticket, and then
a quick rlogin into the same machine. Naturally in practice you would set
up a dummy server that does something trivial like retun a YES/No
repsonse to your login program.
Note that if all you want is to verify the password locally, and if
you do not have a use for subsequent Kerberos authentication, then you
can request a ticket for the "local verification" service in your
first request to Kerberos. There is no need to first request a ticket
granting ticket.
Also, there is no need to actually contact the local verification
service out of band. The verification can be done entirely by the
login program.
What you would do is initially request a ticket for the verification
service, use that ticket to construct an authenticator, then
immediately verify the ticket and authenticator from within the login
program using the "local verification" services key which is
presumably available to the login program since it runs as root.
You could simplify this even further if you were willing to write your
own code to do the verification, instead of using the code in the
Kerberos library. To do this, you would:
Make an initial request for a "local verification" server ticket
Decrypt the response using the password entered by the user
Decrypt the ticket using the key of the "local verification" server
Check to make sure the ticket is not expired
Compare the session key from the ticket with that from the
response from the KDC.
If they match, and the ticket has not expired, then you have verified
the identity of the user.
~ Cliff
