HDTenEightyP/NetNews huggingface dataset:
From: yuan@syl.dl.nec.com (Ruixi Yuan)
Newsgroups: comp.protocols.kerberos
Subject: Kerberos' rlogin
Date: 9 Sep 92 22:10:41 GMT
Organization: NEC Systems Lab.

I have the following problem about the Kerberos rlogin: 

After installing the testing Kerberos IV, on a SUN sparc station with 
SunOS 4.1. I tried to enable the application rlogin and rsh, but I got
the error message as follows when executing the command "rlogin host" 

        rcmd: socket: Permission denied
        rlogin: Kerberos rcmd failed: rcmd protocol failure.
        trying normal rlogin (/usr/ucb/rlogin.ucb)
        exec: No such file or directory

Do any of the netters encounter this problem before? Any hint on how 
to fix this problem? 

Any help is appreciated!
Newsgroups: comp.protocols.kerberos
From: boche@VNET.IBM.COM (Ulrich K. Boche)
Subject: (none)
X-Unparsable-Date: Tue, 15 Sep 92 01: 43:50 CET
Organization: IBM Germany, Ehningen
Date: Tue, 15 Sep 1992 01:08:37 GMT

In RELEASED: Kerberos FAQ Version 0.0 (Trailer), references are
given:
>...
>[6] S.M. Bellovin and M. Merritt, "Limitations of the Kerberos
>Authentication System," Computer Communications Review 20(5), pp.
>119-132 (October 1990).  [research.att.com:dist/kerblimit.usenix.ps]
>...
>
I understand the network information to be file "kerblimit.usenix.ps"
in directory "dist" at node "research.att.com".  When I tried to get
the file via anonymous FTP, I was told the file didn't exist.  Am I
off base with my interpretation or is there a typo in the FAQ trailer?

Ulrich Boche, IBM Germany FSC Large Systems
Disclaimer: This posting represents my own views, not those of IBM
Newsgroups: comp.protocols.kerberos
From: bjaspan@ATHENA.MIT.EDU ("Barry Jaspan")
Subject: Re: No subject found in mail header
Organization: Internet-USENET Gateway at Stanford University
Date: Tue, 15 Sep 1992 02:31:26 GMT


Your interpretation is correct; the information in the FAQ is out of
date.  Here is the correct reference.  A new version of the FAQ will
be released shortly.

[6] S.M. Bellovin and M. Merritt, "Limitations of the Kerberos
Authentication System," USENIX Jan 1991.
[research.att.com:dist/internet_security/kerblimit.usenix.ps]

Barry Jaspan

Newsgroups: comp.protocols.kerberos
From: nessett@OCFMAIL.OCF.LLNL.GOV (Danny Nessett)
Subject: my previous question refined
Organization: Internet-USENET Gateway at Stanford University
Date: Fri, 4 Sep 1992 22:31:08 GMT


Recently I asked a question about using su through a connection established
by a Kerberized rlogin daemon. I have received a number of helpful responses
for which I thank the authors. However, my question had a nuance that
wasn't clearly expressed. Let me try again.

Suppose I want to bring up a machine that could only be accessed via
Kerberos. This would require properly Kerberized r-tools, Telnet, FTP,
etc. Now suppose that I am logged onto this machine and want to execute
the su utility. Traditionally, this utility allows me to change to root
access, if I have a root identity and know its password and it also
allows me to change my identity to another user if I know his/her identifier
and password. However, since this machine is completely Kerberized, the
only password I know is my Kerberos password and this isn't stored in
the /etc/passwd file that su accesses. In fact this file probably
won't have any encrypted password at all.

Several responders suggest using a root password held by Kerberos to
gain root privileges. This means passing your root password to
the remote machine. To protect it, you probably want to logon originally
by executing "rlogin -x". Of course, this means either knowing ahead of
time you want to change to root, or (more likely) always executing "rlogin -x".
The only question remaining for this option is whether ksu allows you
to login directly as another user or whether you have to become root
and then use su to do that. Of course, this option doesn't help if you
Telnet to the machine.

Barry Jaspan points out that support of ksu could provide a security hole
if the machine doesn't have a rcmd.<hostname> srvtab. That's another concern,
but can be taken care of by proper administrative controls (of course it
often happens that administration is sloppy).

Jon Rocklis suggests either using ksu or "rlogin -l root". The latter option
doesn't work for Telnet.

Asokan says that Waterloo has something called kesc, that protects the
root password as it travels to the remote machine. Interestingly, Waterloo
has a system administrator who telecommutes, which is a concrete reason
why the su problem is not just theoretical. I will look at the kesc
documentation to see how it does this to determine if it can be used wit
Telnet.

Finally, Jeff Schiller suggests having two identities within a Kerberos
Realm, one for ordinary work and one for root work. When you want to
do root work, you logoff the remote machine, su to root (which gets root
access tickets) and then logon to the remote machine. I'm not sure, but
I think this means that a user with root privilege has those privileges
on all machines.

Of all these suggestions, it seems like ksu is the most workable except
for the problem of passing your root password in the clear. If kesc
works with Telnet, maybe even that problem is solved (again assuming
ksu allows you to change directly to another user).

Dan Nessett
Organization: Carnegie Mellon, Pittsburgh, PA
Newsgroups: comp.protocols.kerberos
Date: Tue, 15 Sep 1992 16:45:00 -0400 
From: Joseph_Jackson@transarc.com
Subject: Re: (none)

boche@VNET.IBM.COM (Ulrich K. Boche) writes:
> In RELEASED: Kerberos FAQ Version 0.0 (Trailer), references are
> given:
> >...
> >[6] S.M. Bellovin and M. Merritt, "Limitations of the Kerberos
> >Authentication System," Computer Communications Review 20(5), pp.
> >119-132 (October 1990).  [research.att.com:dist/kerblimit.usenix.ps]
> >...
> >
> I understand the network information to be file "kerblimit.usenix.ps"
> in directory "dist" at node "research.att.com".  When I tried to get
> the file via anonymous FTP, I was told the file didn't exist.  Am I
> off base with my interpretation or is there a typo in the FAQ trailer?

Try research.att.com:dist/internet_security/kerblimit.usenix.ps
instead.

Joe Jackson,
AFS Product Support,
Transarc Corp.

PS: Sorry if you got this message twice!  I had a disagreement with my mailer.
From: Joseph_Jackson@transarc.com
Newsgroups: comp.protocols.kerberos
Subject: Re: (none)
Date: 15 Sep 92 20:42:08 GMT
Organization: Carnegie Mellon, Pittsburgh, PA

boche@VNET.IBM.COM (Ulrich K. Boche) writes:
> In RELEASED: Kerberos FAQ Version 0.0 (Trailer), references are
> given:
> >...
> >[6] S.M. Bellovin and M. Merritt, "Limitations of the Kerberos
> >Authentication System," Computer Communications Review 20(5), pp.
> >119-132 (October 1990).  [research.att.com:dist/kerblimit.usenix.ps]
> >...
> >
> I understand the network information to be file "kerblimit.usenix.ps"
> in directory "dist" at node "research.att.com".  When I tried to get
> the file via anonymous FTP, I was told the file didn't exist.  Am I
> off base with my interpretation or is there a typo in the FAQ trailer?

Try research.att.com:dist/internet_security
250 CWD command successful
Newsgroups: comp.protocols.kerberos
From: bcn@ISI.EDU (Clifford Neuman)
Subject: [Internet-Drafts@NRI.Reston.VA.US: ID ACTION: draft-ietf-cat-kerberos-01.txt, .ps]
Organization: Internet-USENET Gateway at Stanford University
Date: Sat, 5 Sep 1992 03:42:55 GMT

A Revised Internet Draft is available from the on-line Internet-Drafts 
directories. This draft is a work item of the 
Common Authentication Technology Working Group of the IETF.


       Title     : The Kerberos Network Authentication Service (V5)   
       Author(s) : John Kohl, B. Clifford Neuman
       Filename  : draft-ietf-cat-kerberos-01.txt, .ps
       Pages     : 100

This DRAFT document gives an overview and specification of the Version
5 protocol for the Kerberos network authentication system.  Version 4 
is presently in production use at MIT's Project Athena, and at other 
Internet sites.                                                       

Internet-Drafts are available by anonymous FTP.  Login with the	
username "anonymous" and password "guest".  After logging in,
Type "cd internet-drafts".
     "get draft-ietf-cat-kerberos-01.txt".
     "get draft-ietf-cat-kerberos-01.ps".
 
Internet-Drafts directories are located at:	
	                                                
     o  East Coast (US)                          
        Address:  nnsc.nsf.net (128.89.1.178)	
	                                                
     o  West Coast (US)                          
        Address:  ftp.nisc.sri.com (192.33.33.22)
							
     o  Pacific Rim                              
        Address:  munnari.oz.au (128.250.1.21)	
	                                                
     o  Europe                                   
        Address:  nic.nordu.net (192.36.148.17)	
	                                                
Internet-Drafts are also available by mail.	
	                                                
Send a message to:  mail-server@nisc.sri.com. In the body type: 
     "SEND draft-ietf-cat-kerberos-01.txt".
     "SEND draft-ietf-cat-kerberos-01.ps".
							
For questions, please mail to internet-drafts@nri.reston.va.us.
From: westes@sti.com (Will Estes)
Newsgroups: comp.protocols.kerberos
Subject: Re: SF Bay Area Kerberos UG minutes?
Date: 12 Sep 92 00:13:33 GMT
Organization: Mail Group

In article <9209092212.AA04696@shadow.secure.bellcore.com> lunt@CTT.BELLCORE.COM (Steve Lunt) writes:
>
>	Does anyone know how to get the minutes from the SF Bay Area
>Kerberos Users' Group Meeting(s), if such minutes exist?  Thanx in
>advance.

Can someone post a contact name and phone for this user group?  Thanks.
-- 
Will Estes		Internet: westes@netcom.com
From: Joseph_Jackson@transarc.com
Newsgroups: comp.protocols.kerberos
Subject: Re: (none)
Date: 15 Sep 92 20:41:52 GMT
Organization: Carnegie Mellon, Pittsburgh, PA

boche@VNET.IBM.COM (Ulrich K. Boche) writes:
> In RELEASED: Kerberos FAQ Version 0.0 (Trailer), references are
> given:
> >...
> >[6] S.M. Bellovin and M. Merritt, "Limitations of the Kerberos
> >Authentication System," Computer Communications Review 20(5), pp.
> >119-132 (October 1990).  [research.att.com:dist/kerblimit.usenix.ps]
> >...
> >
> I understand the network information to be file "kerblimit.usenix.ps"
> in directory "dist" at node "research.att.com".  When I tried to get
> the file via anonymous FTP, I was told the file didn't exist.  Am I
> off base with my interpretation or is there a typo in the FAQ trailer?

Try research.att.com:dist/internet_security
250 CWD command successful
Newsgroups: comp.protocols.kerberos
From: glenz@ocsg.COM (Glen Zorn)
Subject: Re:  my previous question refined
Organization: Internet-USENET Gateway at Stanford University
Date: Sat, 5 Sep 1992 00:24:12 GMT

In article <9209042231.AA21478@ocfmail.ocf.llnl.gov>, nessett@ocfmail.ocf.llnl.gov (Danny Nessett) writes:

	Several responders suggest using a root password held by Kerberos to
	gain root privileges. This means passing your root password to
	the remote machine. To protect it, you probably want to logon 
	originally
	by executing "rlogin -x". Of course, this means either knowing ahead of
	time you want to change to root, or (more likely) always executing 	
	"rlogin -x".
	The only question remaining for this option is whether ksu allows you
	to login directly as another user 

It does.


	or whether you have to become root
	and then use su to do that. Of course, this option doesn't help if you
	Telnet to the machine.

Try the new, improved telnet, with Kerberos authentication *and* DES 
encryption! ;-)


	Asokan says that Waterloo has something called kesc, that *protects*
*emphasis mine*
	the root password as it travels to the remote machine. 

Personally, I'm not sure I'd want the root password floating about on the net,
"protected" or not.  Passwords are relatively long-lived items -- a wiley 
cracker would have something akin to forever to break the encryption, if the transmission was captured.  That said, kesc does sound interesting. I'd like to 
take a look at it myself.


	Finally, Jeff Schiller suggests having two identities within a Kerberos
	Realm, one for ordinary work and one for root work. When you want to
	do root work, you logoff the remote machine, su to root (which gets 
	root
	access tickets) and then logon to the remote machine. I'm not sure, but
	I think this means that a user with root privilege has those privileges
	on all machines.

I'm not sure, but I suspect that Jeff is suggesting the use of a root instance.
If that is the case, then only those machines on which you have a root instance
(i.e., nessett.root@ocfmail.ocf.llnl.gov) listed in /.klogin would allow you to rlogin as root.  By the bye, if you used ksu on the local host, you wouldn't
need to kinit as root, since ksu gets an rcmd ticket itself as a safeguard.


	Of all these suggestions, it seems like ksu is the most workable except
	for the problem of passing your root password in the clear. If kesc
	works with Telnet, maybe even that problem is solved (again assuming
	ksu allows you to change directly to another user).

Actually, I think Jeff's suggestion is by far the most secure, though a bit
cumbersome.

~ Glen


Glen Zorn       Network Security Analyst
glenz@OCSG.COM  Open Computing Security Group



Newsgroups: comp.protocols.kerberos
From: lunt@CTT.BELLCORE.COM (Steve Lunt)
Subject: SF Bay Area Kerberos UG minutes?
Organization: Internet-USENET Gateway at Stanford University
Date: Wed, 9 Sep 1992 22:12:19 GMT

	Does anyone know how to get the minutes from the SF Bay Area
Kerberos Users' Group Meeting(s), if such minutes exist?  Thanx in
advance.

-- Steve

        Steven J. Lunt           |  lunt@bellcore.com  |  RRC 1L-213
Information Technology Security  |---------------------|  444 Hoes Lane
           Bellcore              |   (908) 699-4244    |  Piscataway, NJ 08854

Newsgroups: comp.protocols.kerberos
From: li@oracorp.com (Li Gong)
Subject: Re: New User Accounts
Organization: ORA Corporation, Ithaca, New York
Date: Thu, 10 Sep 1992 03:26:12 GMT

In article <9209031516.AA09658@Athena.MIT.EDU> smb@ulysses.att.com writes:
>	 Dictionary attacks can eb stopped using the protocls developed
>	 by li Gong et al, and by Bellovin & Merrit. Note that the
>	 latter necessitates the use of public-key, and both have
>	 (probably acceptable) an overhead.
>
>Both protocols require public key cryptosystems.  One significant difference
>is that the Lomas/Gong/Needham/Saltzer protocol requires a known public
>key for the server, and the Bellovin/Merritt one does not.  Both require
>high-quality random numbers.  Bellovin/Merritt imposes some possibly-tricky
>constraints on what a public key can look like.

Just a bit of up-to-date information on this.  In our new paper

L. Gong, T.M.A. Lomas, R.M. Needham, and J.H. Saltzer, ``Protecting
Weak Secrets from Guessing Attacks'', to appear in {\em IEEE Journal
on Selected Areas in Communications''}, first quarter, 1993.

we have consolidated and greatly expanded our previous efforts.  In
particular, we described several more practical derivations of our
example protocol (published in ACM 12thSOSP, 1989) to deal with
concerns such as minimization of number of messages, using nonces
instead of synchronized clocks (since they may not be available),
one-way identification, and so on.  In particular, we showed a simple
derivation that does away with the need to let the server's key known
to other parties in advance, and another derivation for direct
authentication (i.e., not via a server S).  This last protocol's
functionality is similar to that of the Bellovin/Merritt protocol and
has similar constraint on the public system.  However, due to our use
of confounders, even when a session key is compromised (say by
cryptanalysis), one cannot masquarade as another or mount a dictionary
attack on the password.

The final version should be ready in 2-3 weeks time.  Anyone who
cannot wait till first quarter 1993 could drop me a line for a ps copy
or maybe a hardcopy.

Li
-- 
Li GONG, PhD                | Email  : li@oracorp.com
ORA Corporation             | Fax    : 607-277-3206
301A Dates Drive            | Switch : 607-277-2020
Ithaca, New York 14850, USA | Direct : 607-272-0736 (dial 217 on tone)
Newsgroups: comp.protocols.kerberos
From: nessett@OCFMAIL.OCF.LLNL.GOV (Danny Nessett)
Subject: thanks
Organization: Internet-USENET Gateway at Stanford University
Date: Fri, 4 Sep 1992 21:16:41 GMT


Asokan,

Thanks for the info. I would be quite interested in looking at ksuw. By
the way, when you say "for non-root userids, ksu(1) behaves just like su(1)"
do you mean that if I type the name and password of another user, ksu
will establish me under the effective uid of that user?

Dan
Newsgroups: comp.protocols.kerberos
From: bagate!socrates!bbh7rq5 (Davies)
Subject: Kinit & kpasswd in kerberosV5 (Sandia dist.)
Organization: Internet-USENET Gateway at Stanford University
Date: Tue, 15 Sep 1992 17:43:47 GMT

Hello,

I am working on configuring Kerberos V5 (Sandia distribution) and am having
some troubles with kinit and kpasswd.  The kdc is up and running and
the database has been initialized and a few users added.

When I run kinit, I get the following:
=======================================================================
kerberos:cdavies$ kinit cdavies
Enter password:

Enter Your SecurId Access Code Prepended with Your PIN
 (or a '#'if Your PIN is entered on the card keypad)
 or Type return <CR> if You Do NOT Use a SecurId Card:
kinit: Password has expired. Use kpassword to renew.
=======================================================================

I find it strange that it tells me to run "kpassword" instead of "kpasswd".







Then, when I run kpasswd I get:
=======================================================================
kerberos:cdavies$ kpasswd
Old password for cdavies@SOCRATES.BELL-ATL.COM:

Unable to Get Initial Credentials : Program lacks support for key type -17653282
35


Protocol Failure - Password NOT Changed.
=======================================================================




Also, when I first compiled kpasswd and ran it, I got a message:
	unknown symbol: _des_string_to_key

So, after looking through the header files, I noticed that des_string_to_key
and mit_des_string_to_key #defined to be the same.  So, I changed kpasswd.c
from:
	if (retval = des_string_to_key(arg->password.data,
                                   v4_keyptr)) {
to:
	if (retval = mit_des_string_to_key(arg->password.data,
                                   v4_keyptr)) {

This seemed to make kpasswd work better.  (At least no unknown symbol)


Any help on these errors?

Thanks in advance...
Chris


-- 

*******************************************************************************

Chris Davies	                        e-mail: cdavies@socrates.bell-atl.com
Bell Atlantic                            Voice: (301) 989-4111
                                           Fax: (301) 595-1341


Note: If your e-mail reply to me bounces, try sending it explicitly to 
cdavies@socrates.bell-atl.com instead of using the 'reply' feature.
******************************************************************************
Newsgroups: comp.protocols.kerberos
From: Bernhard.Schneck@Physik.TU-Muenchen.DE
Subject: Re: KerberosIV on multihomed hosts
Organization: Internet-USENET Gateway at Stanford University
Date: Wed, 9 Sep 1992 18:05:45 GMT

In message <9209082112.AA07418@deathtongue.MIT.EDU> you write:
 > The short answer is, kerberos V4 doesn't do that.  Make sure you send
 > things out the same port as the kerberos server.
 > 
 > V5, however, will support this, once it gets released!

V5 is not available outside the US yet ... and I don't know when it will be.

hilary@snll-arpagw.llnl.gov (Hilary Jones) offered to send me a patch
for KerberosIV

 > -derek

Thanks,

\Bernhard.
From: Joseph_Jackson@transarc.com
Newsgroups: comp.protocols.kerberos
Subject: Re: (none)
Date: 15 Sep 92 20:42:09 GMT
Organization: Carnegie Mellon, Pittsburgh, PA

boche@VNET.IBM.COM (Ulrich K. Boche) writes:
> In RELEASED: Kerberos FAQ Version 0.0 (Trailer), references are
> given:
> >...
> >[6] S.M. Bellovin and M. Merritt, "Limitations of the Kerberos
> >Authentication System," Computer Communications Review 20(5), pp.
> >119-132 (October 1990).  [research.att.com:dist/kerblimit.usenix.ps]
> >...
> >
> I understand the network information to be file "kerblimit.usenix.ps"
> in directory "dist" at node "research.att.com".  When I tried to get
> the file via anonymous FTP, I was told the file didn't exist.  Am I
> off base with my interpretation or is there a typo in the FAQ trailer?

Try research.att.com:dist/internet_security
250 CWD command successful
Newsgroups: comp.protocols.kerberos
From: bjaspan@ATHENA.MIT.EDU ("Barry Jaspan")
Subject: Re:  Existing authentication mechanisms have a deficiency
Organization: Internet-USENET Gateway at Stanford University
Date: Wed, 9 Sep 1992 17:59:59 GMT


   Date: Wed, 9 Sep 92 09:14:34 PDT
   From: nessett@ocfmail.ocf.llnl.gov (Danny Nessett)

   One could imagine a system configured so that all on-machine
   authentication requests contacted the appropriate server, say the
   Kerberos server ...

Yes, that is part of what Kerberos does, for all the reasons you
mentioned.

   ... my suggestion about modifying su to contact the appropriate
   server to perform authentication was along these lines.

And that is *exactly* what ksu does.  It uses a central authentication
service, Kerberos, to determine the identity of a user, and then a
local authorization service, the /.klogin file, to determine whether
or not to allow the authenticated individual to become root on the
local host.  The /etc/passwd file is not consulted for authentication
or authorization information.

Hmmm.. Are suggesting that a modified su should request a tgt for the
Kerberos principal root (as opposed to the Unix user root) and allow
root access if the correct Kerberos password is provided?  That's a
possibility (given the caveats in the Kerberos FAQ question #9), but
it seems much less flexible to define one "root password" for all
machines on the network instead of allowing each machine to specify
its own set of "root users".

In short, I do not understand what you think should be changed.

Barry
Newsgroups: comp.protocols.kerberos
From: nessett@OCFMAIL.OCF.LLNL.GOV (Danny Nessett)
Subject: My apologies
Organization: Internet-USENET Gateway at Stanford University
Date: Wed, 9 Sep 1992 20:21:18 GMT


I have just finished reading the beta FAQ for Kerberos and hereby offer my
apologies to this list for a recent clutter of traffic. My original question
was about on-machine authentication (i.e., authentication requests from
programs running on a machine and accepting passwords as evidence). In
reviewing my subsequent messages, I see that I segued in perhaps a confusing
way into how one might eliminate all authentication data stored on a machine.

In fact question 9 of the Kerberos FAQ answers the second question very
well. My first question was answered in the first several messages I received
in response to it. The remaining traffic resulted from my ignorance about
the support described in question 9 (I knew Kerberos could be used in this
way, because we do so here. However, I thought it was a local mod, not a
standard feature of the Kerberos software). Once again, my apologies for
the unnecessary resource use.

Dan Nessett