O'Reilly - Practical UNIX & Internet Sec... 7015KB

[Chapter 19] 19.6 Kerberos
●
●
Secure RPC stores both the user's secret key and public key on the NIS server. The secret key is
encrypted with the user's password and made available to the network, but the network does not
have the ability to decrypt it. Thus, with Secure RPC, there is no need for a specially secured
"authentication server" to establish the identity of users on the network.
Secure RPC is built into Sun's RPC system. While Kerberos requires that each application be
specifically tailored. Secure RPC is a transparent modification to Sun's low-level RPC that works
with any RPC-based service. Any application can use it simply by requesting AUTH_DES
authentication.[18]
[18] If you are using recent versions of Sun's Solaris operating system, you can
specify Kerberos authentication by requesting AUTH_KERB.
Kerberos is an add-on system that can be used with any existing network protocol. Project Athena uses
Kerberos with NFS, remote login, password changing, and electronic mail. Sun Microsystems has added
compatibility with Kerberos to its RPC system. Other software vendors, including the Open Software
Foundation and IBM, have used the ideas pioneered by Kerberos as the basis of their own network
security offerings.
19.6.3 Installing Kerberos
Installing Kerberos is a complicated process that depends on the version of Kerberos you have, the kind
of computer, and the version of your computer's operating system. It's a difficult task that requires that
you either have the source code for your computer system, or that you have source code for replacement
programs. It is not a task to be undertaken lightly.
Fortunately, increasingly you don't have to. Kerberos or Kerberos-like security systems are now available
from several companies, as well as being a standard part of several operating systems. These days, there
is no reason to be running anything but secure network services.
The Kerberos source code is available for the cost of reproduction from MIT; the address and ordering
information are provided in Appendix E, Electronic Resources. Alternatively, you may use FTP to
transfer the files over the Internet from the computer athena-dist.mit.edu.[19]
[19] Because of export restrictions, only U.S. and Canadian citizens may do so legally.
As the changes required to your system's software are substantial and subject to change, the actual
installation process will not be described here. See the documentation provided with Kerberos for details.
19.6.4 Using Kerberos
Using a workstation equipped with Kerberos is only slightly different from using an ordinary
workstation. In the Project Athena environment, all of the special Kerberos housekeeping functions are
performed automatically: when the user logs in, the password typed is used to acquire a Kerberos ticket,
which in turn grants access to the services on the network. Additional tickets are automatically requested
as they are needed. Tickets for services are automatically cached in the /tmp directory. All of a user's
tickets are automatically destroyed when the user logs out.
file:///C|/Oreilly Unix etc/O'Reilly Reference Library/networking/puis/ch19_06.htm (7 of 9) [2002-04-12 10:44:58]