[7868] in Kerberos
Re: kcmd not encrypted?
daemon@ATHENA.MIT.EDU (Sam Hartman)
Tue Aug 27 19:41:40 1996
To: michael shiplett <walrus@ans.net>
Cc: kerberos@MIT.EDU
From: Sam Hartman <hartmans@MIT.EDU>
Date: 27 Aug 1996 19:33:07 -0400
In-Reply-To: michael shiplett's message of 27 Aug 1996 13:06:48 -0400
>>>>> "michael" == michael shiplett <walrus@ans.net> writes:
michael> Greetings, After re-compiling MIT's k5b6 under Solaris
michael> 2.5.1 using gcc without optimization, the r-cmds work. I
michael> noticed, however, that while kcmd() checksums the remote
michael> user and the command, it sends them unencrypted to the
michael> remote host. Even though an attacker would be hard
michael> pressed to hijack the connection, this is an unexpected
michael> information leak.
The attacker would be cryptographically challenged to change
this information. In addition, in current uses of kcmd, information
about whether the session will eventually be encrypted is sent in the
authenticator checksum. Thus, if the session is encrypted, grabbing
the session after this information is sent is useless because feature
data must be encrypted in the session key.
michael> Will kcmd() encrypt all of its information in beta 7?
No. There are no plans to do this in a future version of
Kerberos. If you come up with a way of doing this without breaking
compatability with Beta 5, then we'll re-evaluate the situation. (The
current code is only compatible back to Beta 5 without a server-side
command line option.)
Our long term goal is to move to using telnet to replace all
rcmds. This involves getting some telnet options to handle duplexing
streams and remote execution of specific commands implemented so that
telnet could be used to do what rsh currently does. This is fairly
long-term and will not be in Beta 7.
As a side effect of that code, the command you attempt to
execute would be encrypted.
Honestly, though, in the few situations where you can't live
with the information leak presented by the current behavior, a short
work around in the form of a shell script to read its arguments from
stdin then execute them should work fine.
michael> michael
