This greatly eases the transition of users from one department's computing environment to another. Our machines use Kerberos authentication, which is a secure method of proving a user's identity. Passwords are not stored on the host, but are kept in the umich cell's Kerberos database. Controlling access authorization We use an AFS authorization mechanism called a protection group to control who can connect to a machine and login. This means that even though a user may be in the machine's password file, the user may be denied access to the machine.
Administrators can control access independently to login, ftp, and xdm sessions.
Our security experts can monitor telnet, ftp, xdm, and smtp access to all machines we administer. They watch for account compromises, harrassment, and system security probes, scans, and breaches. System security is also verified during the testing of new operating systems before they are added to our automated software distribution system. Finally, administrators carry out continual research to watch for discovery of new security problems, by monitoring Internet security mailing lists and news groups, and by working closely with other system administrative teams on campus, and with ITD's User Advocate. Generally, customers will not have root access on their machines.