[7900] in Kerberos
Re: request for Suggestions
daemon@ATHENA.MIT.EDU (Stephen C. Trier)
Tue Sep 3 17:23:56 1996
From: trier@slc6.INS.CWRU.Edu. (Stephen C. Trier)
Date: Tue, 3 Sep 1996 17:04:25 +0000
In-Reply-To: Dany Said <dany@cyberia.net.lb>
"request for Suggestions" (Sep 3, 8:56pm)
To: dany@cyberia.net.lb, kerberos@MIT.EDU
[This is a Kerberos 4 answer. I suspect Kerberos 5 is similar, but I
don't have first-hand experience with it.]
On Sep 3, 8:56pm, Dany Said wrote:
> - If someone is accessing the network from another domain( from outside
> the university network) , I would like to give him the ability to use
> kerberos for login and for transmitting encrypted data.
Good. If he has Kerberos client software and your machines have
Kerberos-aware daemons, this is easy to set up.
> - If someone is in the dimanin name of the university and wnats to
> access a remte machinr in the network,, I would like him to be able to
> uses kerbero for login but not to encrypt data.
There is no easy, universal way to set this up, but you could modify the
source for the Kerberized servers to disallow encryption for local
connections.
However, I have to ask why you want to disallow encryption? Encryption
reduces the damage an attacker can do. Lots of attacks (in the US, at least)
have been done by an attacker that runs "sniffing" software on one machine
to get the passwords to other machines. Before long, he has broken into
many machines on the network. If the local traffic were encrypted, this
attack would be foiled.
Furthermore, if any of your local users want root privileges, all they have
to do is "sniff" an administrator's telnet connection. If that administrator
isn't allowed to encrypt his data, the root password is readily available.
> - else if he is on the same machine, I don't want him to be able to use
> kerberos.
There is some sense to this. However, if he is on the same machine, he
would hopefully not need Kerberos. If he is doing a loopback connection,
Kerberos makes sense because it reduces the number of times he has to
enter his password. The problem is similar to that with superuser access,
above.
Kerberos does not include general access-control mechanisms like those
you are requesting. For some Kerberized services, the behavior you
want can be kluged up without much work. For example, tcp_wrapper
combined with kerberized rlogind could provide some of the features you
want, but only for rlogin connections. Other services, like telnetd,
would require source code modifications.
Stephen
--
Stephen Trier Les grandes personnes sont dicidiment bien bizarres,
trier@ins.cwru.edu se dit le petit prince.
KG8IH Antoine de Saint Exupiry, _Le Petit Prince_
