[2426] in Kerberos
Re: Encrypted telnet ,ftp and AFS
daemon@ATHENA.MIT.EDU (Roland Schemers)
Fri Dec 4 01:43:44 1992
Date: Fri, 4 Dec 92 06:28:42 GMT
From: schemers@leland.stanford.edu (Roland Schemers)
To: kerberos@shelby.Stanford.EDU
In article <9212040516.AA18069@tsx-11.MIT.EDU> tytso@ATHENA.MIT.EDU (Theodore Ts'o) writes:
>At the moment, there is no standardized Kerberized ftp protocol. It
>turns out that ftp is a relatively complicated protocol, and the simple,
>obvious ways of kerberizing it are not necessarily secure. There is a
As a learning experience I kerberized an ftpd and an ftp client. I did
this by adding a SITE extension called AUTH. When the client connects
to the ftpd instead of starting with a USER command it sends the command:
SITE AUTH KV4 (I've been using kerberos from DECathena)
If the server accepts this type of authorization then it opens a
binary connection to the client and the client sends the authenticator
to the server. This is what it looks like:
Slapshot:~/Work/Kerberos/kftp 3# kftp slapshot
Connected to Slapshot.Stanford.EDU.
220 Slapshot.Stanford.EDU FTP server (Version 6.57 Wed Nov 11 23:46:44 PST 1992) ready.
200 PORT command successful.
150 Opening BINARY mode data connection for kerberos authenticator.
230 User schemers.@OLYMPIA.STANFORD.EDU [36.53.0.16] logged in.
ftp>
So the authenticator is treated just like binary file, and the standard
way of sending binary data is used. I've also modified the ftpd to treat
an unknown principle as an anonymous user (as along as the normal ~ftp
account is setup).
Does this seem like a reasonable approach? I then envisioned adding
encryption and verification modes with something like:
SITE TYPE SAFE
SITE TYPE SECRET
Or something similar. Of course this means all clients and ftpds must
be modified, but it also means the modified versions can interoperate
with existing versions. For example:
Slapshot:~/Work/Kerberos/kftp 5# ftp argus
Connected to Argus.Stanford.EDU.
220 Argus.Stanford.EDU FTP server (ULTRIX Version 4.1 Tue Mar 19 00:38:17 EST 1991) ready.
200 PORT command successful.
502 SITE command not implemented.
Name (argus:schemers):
So if the ftpd doesn't understand the "SITE AUTH ..." command then the client
just falls back to prompting for the username/password.
This has just been a learning experience, but I tried to extend the ftp
protocol through SITE options, and make it extensible:
SITE AUTH KV4
SITE AUTH KV5
etc.
Are there any gaping security holes in my logic? :-)
Roland
--
Roland J. Schemers III | Networking Systems
Systems Programmer | 168 Pine Hall (415)-723-6740
Distributed Computing Group | Stanford, CA 94305-4122
Stanford University | schemers@Slapshot.Stanford.EDU
