Re: unified authentication
From: Tillman Hodgson (tillman_at_seekingfire.com)
Date: 09/25/03
- Previous message: Jason Stone: "Re: unified authentication"
- In reply to: Jason Stone: "Re: unified authentication"
- Next in thread: Jason Stone: "Re: unified authentication"
- Reply: Jason Stone: "Re: unified authentication"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Wed, 24 Sep 2003 19:18:07 -0600 To: freebsd-security@freebsd.org
On Wed, Sep 24, 2003 at 03:56:56PM -0700, Jason Stone wrote:
> > > > 1.) Kerberos
> > >
> > > krb is nice, but the problem with it is that all of your applications need
> > > to be kerberized
> >
> > but isn't that true of any auth mechanism?
>
> Other auth methods use more generic interfaces that already exist.
>
> Many/most unix systems/applications are pam aware nowadays, which means
> that any auth system which already has pam modules can be dropped in
> without modifying the apps. And nis is integrated into the libc, so that
> traditional manual authentication (eg, using getpwnam(3) and friends) will
> use nis transparently.
You can use PAM with Kerberos, though it's by no means necessary.
> Also, while kerberos is used for authentication, as far as I understand
> it, kerberos provide no means for distributing a username-to-uid map, so
> you would still have to use nis or something for that. (Someone correct
> me if I'm way off here....)
That's correct. It does authentication, not authorization. It's a
feature - I can use NIS on my server, you can use LDAP on your server,
Bob can use /etc/passwd with disabled passwords on his server.
Flexible mapping schemes allow neat tricks like cross-realm trusts with
Active Directory and secondary user databases ("if not in NIS fall back
to corporate LDAP", etc).
> > > > 5.) NIS/NIS+
> > >
> > > NIS is at a bit of a disadvantage due to the unencrypted transport
> > > of information. Although MD5 hashes in the passwd databases make
> > > passwords harder to crack, usernames and group memberships may still be
> > > retrieved with little difficulty
>
> Well, it's worse than that - since the packets are not authenticated in
> any way, an active attacker doesn't need to crack passwords - he can just
> inject his own packets which can have crypted passwords that he knows.
>
> If you use ipsec and a well-known nis server (as opposed to the easy way
> of just using broadcast), then maybe nis isn't so weak. And all os's and
> network gear support ipsec by now, right?
Which is why I use NIS with Kerberos - the passwords aren't in the NIS
maps and injected fake users won't be authenticated by Kerberos.
-T
-- The phrase "we (I) (you) simply must..." designates something that need not be done. "That goes without saying," is a red warning. "Of course..."means you had best check it yourself. And if "everybody knows" such-and-such, then it ain't so, by at least ten thousand to one. - Robert Heinlein _______________________________________________ freebsd-security@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"
- Previous message: Jason Stone: "Re: unified authentication"
- In reply to: Jason Stone: "Re: unified authentication"
- Next in thread: Jason Stone: "Re: unified authentication"
- Reply: Jason Stone: "Re: unified authentication"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
