[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: userid and groups questions



> Scott Nelson <sbnelson@thermeon.com> writes:
>
> > tvaughan@aventail.com wrote:
> >
> > > This to me sounds like an issue PAM /should/ address. Do you really
want
> > > some module other than the first one to be able to set the user id?
> >
> > Perhaps we could have "credentials" modules that would get invoked after
> > authentication and account management have been run?
>
> Let's say in order to be authenticated, someone has to provide three sets
> of credentials: a one-time password, a Social Security Number, and a
static
> password. But if each of these modules is allowed to get and set the
userid
> and the user id is set after all authentication modules have been run,
then
> you could have something like:
>
>         User ID: alice
>         alice's one-time password: 0x0f0f0f0f
>
>         User ID: alice
>         alice's SSN: 555-55-5555
>
>         User ID: bob
>         bob's password: gr8passwd
>
>         <set user id = bob>
>
>         Welcome to service bob.
>
> Which means in order to compromise an identity, all I have to do is
> compromise the last authentication module.
>
Isn't that the way it is today? Any module CAN set the user id by just
ignoring the current userid and asking the conversation for a new user id.
So potentially the last  module CAN set the userid different from any
earlier module's userid. Is this correct, or am I missing something?





[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index] []