From: bill@bill.ab.umd.edu (Bill Bame)
Newsgroups: comp.os.vms
Subject: Re: KERBEROS as replacement for SYSUAF
Date: 15 Oct 92 18:25:01 GMT
Reply-To: bill@office.ab.umd.edu
Organization: M.I.E.M.S.S.

Wow, looks like I stirred up a real hornets nest.  Even though it was not
my intention to cause this much DEC-bashing/flaming, it's obvious that I hit
on a real sore spot.  Good.

A quick update...

First of all, thanks to all who replied.  I am currently investigating several
leads (MIT, Pitt, TGV, and one or two others) and am hopeful that I will find
something good lurking outside the DEC fold.  I think that Multinet/Kerberos
might run under UCX (since multinet is extremely compatibile with UCX), but I
haven't found out for sure yet.  If it doesn't, maybe TGV could be persuaded
to release a version that works with UCX as a separate product.  Just a thought.

In case you are wondering why I insist on UCX, it's because I get it for "free"
under DECs CSLG agreement.  Besides, I don't think it's as horrible as other
people seem to - not that I would turn down a free multinet (or WIN/TCP)
license :)

Strangely enough Ken Richardson was correct in his earlier posting.  There was
a symposium session a couple of years ago (with Andy Goldstein as one of the
panelists) in which VMS security and Kerberos were discussed.  I talked to
someone local who attended the session and has been waiting impatiently for
that "pie-in-the-sky" vision to become reality.  My plan is to get a copy of
the tape and bring my local DEC software person in to watch it with me (heh
heh).

I'll post more followups as I find out more.

In the mean time, why don't we make a wishlist of features we would like in
a network security "product"; just in case we/I actually form a working group
of some sort.  I'll throw out some general wishes to start it off (remember,
this is a WISH list, not a spec).  Feel free to add more specific items to the
list (even if you think they only matter at your site).

1) Cross-platform operability covering (at least) VMS, u*x (various), DOS,
   Mac/OS, OS/2, and Windows/NT.  I'm not sure how/if it would fit with Novell.

2) It should be fully integrated into each OS.  This means it should be a
   low-level replacement for $GETUAI, $SETUAI, and any other applicable system
   services under VMS (and DEC should rewrite the sections of VMS that bypass
   these system services).  It should handle validation for Appleshare services
   on Macs.  Use your imagination for other OSs.

3) It should have a complete and well designed API which is easily usable from
   several common languages.

3) It should offer network protocol independence.  It should be implemented at
   a high enough level that any transport protocol can carry it.  Technically
   this is true of Kerberos, even though I am not aware of any non-TCP/IP
   implementations - with a library of DECnet socket routines it should be
   simple to make it work over DECnet.

4) It should handle multiple/redundant servers appropriately.  Changes to the
   security database should be propagated to all appropriate servers.

5) A knowledgeable user should be able to add functionality to it without
   jumping through too many hoops.

6) It should be in the public domain (or be the CMU-Tek variety of shareware),
   but be maintained by experienced and dedicated people.  <Well I can dream
   can't I?>

--
--------------------------------------------------------------------------------
William P. Bame                    | sneakernet: William P. Bame
internet: bill@bill.ab.umd.edu     |             M.I.E.M.S.S.
          bbame@achi1.ab.umd.edu   |             22 South Greene Street
AT&T    : [Work] (410) 328-3062    |             Baltimore, MD 21201
CIS     : 71620,425                |             Room: T1R55
--------------------------------------------------------------------------------