[3511] in Athena Bugs
Re: ksu rtpc 6.4 afs
daemon@ATHENA.MIT.EDU (probe@ATHENA.MIT.EDU)
Fri Oct 27 10:56:32 1989
From: probe@ATHENA.MIT.EDU
Date: Fri, 27 Oct 89 10:56:15 -0400
To: geer@ATHENA.MIT.EDU
Cc: bugs@ATHENA.MIT.EDU
In-Reply-To: Dan Geer's message of Fri, 27 Oct 89 08:27:52 -0400,
Reply-To: Richard Basch <probe@ATHENA.MIT.EDU>
From: geer@ATHENA.MIT.EDU
Date: Fri, 27 Oct 89 08:27:52 -0400
e40-342f-2% ksu
Your root instance password:
Unable to verify rcmd ticket: Can't decode authenticator (krb_rd_req)
e40-342f-2% ls -l /etc/srvtab
-r--r--r-- 1 root 0 Jul 8 1988 /etc/srvtab
--dan
This is only in 6.4... I will be raising a question to you about the
behavior of "ksu" for machines that have services registered with
Kerberos but lack the srvtab. The Kerberos team feels that access
should be denied. The only argument that I can see for keeping the
previous behavior is compatibility; in essence, the workstation might be
compromised if for some reason a chroot() were done [by some process
running as root] and the srvtab were no longer accessible. After this,
one could always "ksu", spoof kerberos, and then create a device to read
the entire contents of the disk.
Again, as I said, such an operation would require another process having
dumped you somewhere chroot'd...
Very few workstations have registered services and lack the srvtab; so
what would you recommend we do? The Kerberos version will not be
supporting this case, so we can either maintain a separate "ksu" or we
can use the version from the Kerberos distribution.
Your call.
-Richard
