[4916] in Kerberos
Re: terminal server questions
daemon@ATHENA.MIT.EDU (Bob Bosen)
Mon Apr 3 12:53:17 1995
To: kerberos@MIT.EDU
Date: Mon, 3 Apr 1995 16:19:34 GMT
From: bbosen@netcom.com (Bob Bosen)
Stephen Tittel (stephen@zeus.wnc.nedlloyd.nl) wrote:
: I have the following problem. I'm doing research for the possibilities
: to implement Kerberos in our corporate network. The network is built up
: with only terminals, connect via terminal servers to the LAN to work
: with the provided applications on the computersystems. Users don't have
: a workstation to work on.
: Furthermore, the users of remote offices are connected via only a terminal,
: the terminal server and the WAN to use the applications in our computer
: centre. The terminal server isn't managed by our company on account of
: boarding out.
: In general, how do people solve authentication of users working only with
: a terminal? Is it possible that a PC connected with the terminal server
: handles all the Kerberos request between the terminal and the Kerberos
: server?
: Stephen
: --------------------------------------------
: stephen@cti.wnc.nedlloyd.nl
: Network & Security
: Nedlloyd Computer Services B.V.
: Rotterdam, Holland
Stephen:
One problem is that the path between the terminal and the nearest Kerberized
application is probably going to be unsecure. If passwords are exchanged
on this path, they are going to be compromised.
One possible solution is to implement a non-replayable user authentication
system that relies on something in the possession of the user, such as
a super-smart card authenticator.
Regards,
--
Bob Bosen
Enigma Logic Inc.
2151 Salvio St. #301
Concord, CA 94520
USA
Tel: +1 510 827-5707
Internet: bbosen@netcom.com
anonymous ftp archives: ftp.netcom.com /pub/bb/bbosen/Enigma read.me
also: (bigger archives) ftp.netcom.com /pub/sa/safeword readme.001
**************************************************************************
* "It wasn't me!!! Somebody must have captured my username/password!!!" *
**************************************************************************
