[975] in Kerberos_V5_Development
Re: Proposed rlogind option reorg
daemon@ATHENA.MIT.EDU (Barry Jaspan)
Tue Jan 23 12:03:17 1996
Date: Tue, 23 Jan 96 12:03:43 EST
From: Barry Jaspan <bjaspan@bbnplanet.com>
To: Sam Hartman <hartmans@MIT.EDU>
Cc: krbdev@MIT.EDU
In-Reply-To: [974]
note that you can still use krlogind -45c
and that this is suceptible to replay attacks on the v4
connections, but requires checksumed v5 connections. I saw no good
reason to add additional code to prevent people from trying to
shoot themselves in the foot.
Perhaps you want to allow people to shoot themselves in the foot, but
you should at least warn them where they are pointing the gun.
If someone does -45c, they have a reasonable basis to believe that a
krb4 connection is being checksummed. Therefore, a warning message
should be sent both to syslog and to the connecting client warning
them of the potential mis-configuration, ie: "Warning! Kerberos 4
{krlogin,krsh} connections are susceptible to active network
attacks!".
Come to think of it, perhaps you should arrange for that message
always to be displayed on krb4 connections. A site that finds it
annoying can comment it out.
Barry
