lkml.org 
[lkml]   [1999]   [Jun]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: R: Do not use stock RedHat 6.0 kernels with SMBFS! [OFF-TOPIC]
    On Thu, 10 Jun 1999, Michael H. Warfield wrote:

    > A. Wik enscribed thusly:
    > > "Michael H. Warfield" <mhw@wittsend.com> wrote:
    > > > > (if you call share passwords security at all), they passwords are not
    > > > encrypted,
    >
    > > Neither are telnet and FTP passwords. Besides, unless public-key
    >
    > I use neither... I use SSH and do not allow unencrypted access
    > to interactive connections.

    SSH is great, but unfortunately, not always installed.

    > > cryptography is used, passwords have to be stored in plain-text (or
    > > another sensitive format) on disk if they are to be encrypted on the
    > > network.
    >
    > Not true at all...
    >
    > challenge response system for the client to prove that it knows the hashes
    > without revealing them. In theory, if you broke into the server and stole
    > the hashes, you could create a fake client who could then fake out the
    > server, but you already own the server from having broken into it. You do
    > not have to store passwords in clear, or in any reversible format anywhere.

    No, but the hash file is still more sensitive than a shadow file.

    SMB password encryption in it's current form just doesn't seem (to me)
    worth the trouble of keeping a separate password database, incompatible
    with anything else.



    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.rutgers.edu
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:52    [W:0.020 / U:70.980 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site