Re: tlug: NFS question

["Stephen J. Turnbull" <turnbull@example.com>]

>>>>> "Karl-Max" == Karl-Max Wagner <karlmax@example.com> writes:

    Karl-Max> Frank Bennett writes:

    >> To protect against this, I figure that each subdirectory needs
    >> a file like ~/.checkname, owned by root but readable to
    >> everyone else.  The /etc/profile script that runs before
    >> ~/.bash_profile will check the content of this, and compare it
    >> with the result of "whoami".  If there's a discrepancy, the
    >> server knows that the user is spoofing his identity, and script
    >> issues an immediate "exit", killing the shell.

    >> Can anyone see obvious holes in this?

Well, the main one is I'm not sure which host you think is running the
checking programs.  The problem is that the NFS client needs to mount
the file system before the user can log in.  So I log in locally as
root, before trying to log in as a user, and I now can read everything
in /home.  If necessary I do it from a boot floppy to bypass any stuff
you've installed to make authentication checks (heck, while I'm at it,
I'll install a few Trojan horses too so that I still have the keys
even if I don't have the boot floppy with me).

    Karl-Max> Easy. Just rename you client to have an identity that
    Karl-Max> fits and you're in business.

I'm not sure what you're trying to say.

But I think Karl-Max is right:in order to get real security in a PC
world, you will need something like SSH/SSL (secure sockets layer, I
think it is) or Kerberos.

-- 
University of Tsukuba                Tennodai 1-1-1 Tsukuba 305-8573 JAPAN
Institute of Policy and Planning Sciences        Tel/fax: +1 (298) 53-5091
__________________________________________________________________________
__________________________________________________________________________
What are those two straight lines for?  "XEmacs rules."
---------------------------------------------------------------
Next Nomikai: 20 November, 19:30 Tengu TokyoEkiMae 03-3275-3691
Next Meeting: 12 December, 12:30 Tokyo Station Yaesu central gate
---------------------------------------------------------------
Sponsor: PHT, makers of TurboLinux http://www.pht.co.jp