From: bill@bill.ab.umd.edu (Bill Bame)
Newsgroups: comp.os.vms
Subject: Re: KERBEROS as replacement for SYSUAF
Keywords: VMS, KERBEROS, ATHENA
Date: 12 Oct 92 15:19:48 GMT
Reply-To: bill@office.ab.umd.edu
Organization: M.I.E.M.S.S.

In article <1992Oct11.232127.1@alien.gici.com>, laut@alien.gici.com (Bill Laut) writes:
>
>In article <61050080@acf3.NYU.EDU>, tihor@acf3.NYU.EDU (Stephen Tihor) writes:
>> Sounds like a good idea if a bit of a challenge.  I hope you
>> have talks to DEC about it ...
>
>	I did.  They laughed (well, sort of).
>

A couple of weeks ago I had a person from DEC come in to talk to me about
what they were doing about security now that networks were the norm rather
than the exception.

I've got a dozen medium-sized VAX clusters (sorry, I mean VMS clusters) as
well as a bunch of standalone machines, and with a user population >2000 and
a high turnover rate, security maintenance has started to become tedious.  To
make things worse, there are also lots of PCs/Macs (pathworks) and some u*x
machines out there.

The DEC person started out by giving me (a VMS veteran of 10 years) some stuff
describing the levels of VMS security available complete with examples (i.e.
set file/prot, edit/acl).  I have to admit that I was a little insulted, but
I was more concerned that he hadn't understood my questions about _network_
security as opposed to _operating_system_ security.  As he was about to go
through his "intro-to-DCL" level examples, I stopped him, described the things
I had already done with VMS security, and asked him point blank where DEC was
going in terms of network security.  He evaded the question (clumsily).  I
asked him if he knew what Kerberos was to his credit, he didn't say anything
about mythological beasts.  All in all it was not a good meeting - although he
did suggest that DEC would be willing to do some custom programming which would
cost several hundred thousand dollars.  He said he would poke around internally
and see what he could come up with.

A week later I got a copy of an MIT/Athena newsletter describing the
implementation of Kerberos (client only) under VMS.  Unfortunately this was
the only thing he sent, and the folks at MIT hadn't made any effort to make
it work with VMS security, they just hacked up the Kerberos client sources
so that they were compilable with VAX C.  Not exactly what I had in mind.

In the mean time I had investigated writing a custom LOGINOUT that would use
Kerberos for authentication - yuck!  I think the idea of replacing the related
system services is a much more elegant solution.  I would be interested in any
work along these lines.  If we could get enough people interested we could
do it as a group project.  I would be glad to do some of the work, but I don't
want to do it all if I can help it.

>> ... and arrange to discuss the issues with
>> the other people who have worked on related projects.

Nobody at DEC admits to working on, thinking about, or taking seriously the
question of network security.  If there are any "related projects" inside or
outside of DEC I have been unable to locate them.

>
>	Which "other people" might these be?
>

Yeah, where are they?

>
>-- 
--
--------------------------------------------------------------------------------
William P. Bame                    | sneakernet: William P. Bame
internet: bill@bill.ab.umd.edu     |             M.I.E.M.S.S.
          bbame@achi1.ab.umd.edu   |             22 South Greene Street
AT&T    : [Work] (410) 328-3062    |             Baltimore, MD 21201
CIS     : 71620,425                |             Room: T1R55
--------------------------------------------------------------------------------