[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: pam_unix_auth cleanup: NIS+ issues

On Wed, 09 Jun 1999 17:07:37 +0200, Thorsten Kukuk wrote:
> It is necessary, or you couldn't get the password if you set up
> the NIS+ passwd table in a secure way.

IMHO it isn't necessary in the sense of `required by the protocol'.

To me, this appears to be an implementation issue in the RPC library,
where the auth_des client code picks the netname based on the 
current process' effective uid. The problem can be avoided if
the authdes client is given a function by which PAM can tell it what
netname to use.

That's not the only problem with NIS+ though: In order for the client to
authenticate itself with the NIS+ server, it needs to establish the user's
secure rpc key first, and push it to the local keyserv where it's added
to the cache. In other words, the user is half-way logged in before
we can even check his password. And there's no way we can remove the
private key from keyserv's cache again because we don't know whether we
are the only session or not.

To summarize, the auth_des client code needs a shortcut function
by which PAM and others can pass it a netname and secret key.

[For convenience, it might also be useful to add another rpc call
to keyserv that takes a secret and a public key, and computes the
conversation key without consulting or altering the cache. That call
doesn't even need authentication...].

Olaf Kirch         |  --- o --- Nous sommes du soleil we love when we play
okir@monad.swb.de  |    / | \   sol.dhoop.naytheet.ah kin.ir.samse.qurax

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index] []