Re: New (?) authentication scheme for local communications

From: bbense+comp.security.unix.Mar.21.03@telemark.slac.stanford.edu
Date: 03/21/03

  • Next message: Andrew Yeomans: "Re: nmap testing UDP ports" 
    From: <bbense+comp.security.unix.Mar.21.03@telemark.slac.stanford.edu>
Date: Fri, 21 Mar 2003 17:22:21 +0000 (UTC)

    -----BEGIN PGP SIGNED MESSAGE-----

    In article <Pine.GSO.4.44.0303211655500.21213-100000@rose.man.poznan.pl>,
    Marek Zawadzki <mzawadzk@man.poznan.pl> wrote:
    >On Fri, 21 Mar 2003 bbense+comp.security.unix.Mar.21.03@telemark.slac.stanford.edu wrote:
    >
    >/ ...
    >> _ Well, all you're really doing is trying to extend the security
    >> of the file system/OS to unix sockets. It seems a lot simpler
    >> to just create a seperate unix socket pair for each user and
    >> just use the OS authentication on that.
    >
    >I didn't think of that solution, but than wouldn't the server have to
    >listen on hundreds of sockets? Because this is how many users I have on my
    >system. And of course I'd have to create all these sockets in advance +
    >tell the server about every new socket I'm adding.
    >

    _ Doing fake security is hard, I've found in the long run it's
    much simpler just to bite the bullet and do kerberos or ssl
    or... However, if you insist on self-abuse, I suggest that you
    investigate the idea of "Channels" in the beep protocol.
    Basically, you have one socket that you listen on for general
    requests. Client sends a file path, Server opens that file
    path, checks auth, conversation. Server closes file path.
    In effect the client becomes a server. There is probably
    a race condition in here somewhere that I haven't thought
    through yet.

    _ I HIGHLY encourage you to read the BEEP book[1] even if you
    insist on such flagrant self-abuse as inventing your own
    security protocols. The first few chapters which discuss
    the reasoning behind the protocol design should be required
    reading before you're allowed to compile with the socket
    library.

    _ Booker C. Bense

    [1]- The first few chapters are pretty much this RFC.

     http://www.beepcore.org/beepcore/docs/rfc3117.jsp

    Here's the book

    http://www.oreilly.com/catalog/beep/

    -----BEGIN PGP SIGNATURE-----
    Version: 2.6.2

    iQCVAwUBPntKTGTWTAjn5N/lAQHJFwP/fIDqX0/Io2ohIXOu3DxyxY1sr06YU4xQ
    PzYEYyVSHMevl+NMDkTh9unQMdBVMZT9NI5faIV6qFw29KyUhT6I43npsyoINVO2
    rEQAc4d7pP2NztJovzzPwFGwREv4vQotn93WWL94WkRdgOjNnsy7KrsLX1LIV2fr
    M5widnBExY4=
    =8xbG
    -----END PGP SIGNATURE-----

  • Next message: Andrew Yeomans: "Re: nmap testing UDP ports"