O'Reilly - Practical UNIX & Internet Sec... 7015KB

[Chapter 8] 8.7 One-Time Passwords
Kerberos and DCE: Alternatives to One-Time Passwords?
Kerberos and DCE are two systems which allow workstations to authenticate themselves to services
running on servers without ever sending a password in clear text over the network. At first glance, then,
Kerberos and DCE appear immune to password sniffers. If used properly, they are so.
Unfortunately, Kerberos and DCE have their drawbacks. The first is that both systems require
modification to both the client and the server: you cannot connect to a Kerberos service from any
workstation on the Internet. Instead, you can only use workstations that are specially configured to run
the exact version of Kerberos or DCE which your server happens to use.
A bigger problem, though, happens when users try to log into computers running Kerberos over the
network. Take the example of an MIT professor, who wishes to access her MIT computer account from a
colleague's computer at Stanford. In this case, the professor will sit down at the Stanford computer, telnet
to the MIT computer, and type her password. As a result, her password will travel over the Internet in the
clear on its way to the secure Kerberos workstation. In the process, it may be picked up by a password
sniffer. The same could happen if she were using one of the many DCE implementations currently
available.
Of course, Kerberos isn't supposed to work in this manner. At Stanford, the MIT professor is supposed to
be able sit down at a Kerberos-equipped workstation and use it to transmit an encrypted password over
the Internet using the standard Kerberos encryption scheme. The problem, though, is that the workstation
must be able to locate the Kerberos server at MIT to use it, which often requires prior setup. And the
Kerberos- (or DCE-) equipped workstation, with compatible versions of the software, needs to be at
Stanford in the first place. Thus, while Kerberos and DCE may seem as if they are alternatives to
one-time passwords, they unfortunately are not in many real-world cases.
The Kerberos system's biggest problem, though, is that it still allows users to pick bad passwords and to
write them down.
8.6 The UNIX Encrypted
Password System
8.8 Administrative
Techniques for Conventional
Passwords
[ Library Home | DNS & BIND | TCP/IP | sendmail | sendmail Reference | Firewalls | Practical Security ]
file:///C|/Oreilly Unix etc/O'Reilly Reference Library/networking/puis/ch08_07.htm (7 of 7) [2002-04-12 10:44:31]