[lkml]   [2003]   [Jan]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [PATCH] Secure user authentication for NFS using RPCSEC_GSS [0/6]
    >>>>> " " == Paul Jakma <> writes:

    > On 12 Jan 2003, Dax Kelson wrote:
    >> Standard NFS security/authentication sucks rocks. Without this
    >> NFS home directory servers are just waiting to be ransacked by
    >> a rouge (or compromised) root user on a client machine.

    > AIUI, A root user still can. The users krbv5 credentials will
    > generally have been cached to storage. (though i suppose one
    > could mount that storage via NFS and use root_squash, but
    > that's little protection.).

    Once the root account has been compromised, it is 'Game Over' no
    matter what you do. Kerberos or no Kerberos, the simplest way to steal
    your identity is simply for the attacker to listen in on your tty
    while you are typing your password.

    The RPCSEC_GSS security model is not meant to protect you against root
    monitoring. It is meant to prevent some third party (on another
    machine for instance) from spoofing RPC requests in you name (==
    strong authentication), intercepting valid RPC requests and modifying
    the payload (== cryptographic data integrity checking), or listening
    in on the client/server communication (== data privacy).

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:32    [W:0.019 / U:2.376 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site