[797] in Kerberos
Re: kinit security
daemon@TELECOM.MIT.EDU (Ben Cranston)
Tue Sep 19 23:23:07 1989
From: zben@UMD5.UMD.EDU (Ben Cranston)
To: kerberos@ATHENA.MIT.EDU
This is getting a bit beyond kerberos per se, but it is security-related.
Unix, along with many other modern operating system, has mailbox names,
principal names, and login names exactly identical. Thus, one can sometimes
test for the existance of principals by trying to bounce mail off them.
This is not graven in stone. It would theoretically be possible to make
the login name (i.e. that which must be given to be logged in) different
from the kerberos principal names and/or mailbox names. This removes the
utility of using discovered principal or mailbox names for computer driven
iterated breakin attacks, at the cost of making the users memorize yet
another cryptic piece of information.
On host UMD2 login names (account numbers) are completely decoupled from
mailbox names, through a small many-to-many database. Users need not enter
their mailbox names at login, as the database provides a mapping from a login
name to a default mailbox.
