[5452] in Kerberos
Re: check passwords
daemon@ATHENA.MIT.EDU (Jon A. Rochlis)
Sun Jul 2 15:44:24 1995
To: Sam Hartman <hartmans@MIT.EDU>
Cc: hfalken@x4u2.desy.de (Harald Falkenberg), kerberos@MIT.EDU
In-Reply-To: Your message of "Sat, 01 Jul 1995 14:53:48 EDT."
<199507011853.OAA12487@tertius.mit.edu>
Date: Sun, 02 Jul 1995 15:29:36 -0400
From: "Jon A. Rochlis" <jon@cam.ov.com>
Assuming that your situation actually requires verification of
the Kerberos password, why not just set KRBTKFILE to some dummy file,
run kinit, check the exit status, then kdestroy the file? Be sure to
set PATH to a trusted value so the user can't substitute their own
kinit.
You need to actually get a service ticket and use it (verifying the
server's secret key against a keytab) or else you are vulnerable to a
kind of spoofing attack. (As demonstrated, I believe, by Stan Zanarotti's
attack on early versions of ksu.) If you think about it just getting a
TGT is only using one secret and you need two to for kerberos
authentication to work.
-- Jon
