🚀 go-pugleaf

In article <1992Nov20.032345.18307@kodak.kodak.com>,
deal@tempus.Kodak.Com (Stephen M. Deal) writes:

>One major implication of distributed processing (of which C/S is but one
>manifestation) is that of authentication.
...
>How do you authorize a client? Can you even trust a client? Perhaps
>those clients executing on a node that has password protection (e.g.
>UNIX, VAX/VMS) can be trusted but what about single tasking nodes that
>run a Disk Operating System (a.k.a. DOS)?
...
>Kerberos (from MIT's Project Athena) provides a glimmer of hope but I
>have not seen any C/S vendor embrace this approach.
...
>Has anyone given much thought to client authentication on PCs and Macs?
>Does anyone have any thoughts on how a server (DB  or otherwise) would
>handle such a mechanism?

You may want to look at RFC 931, "Authentication server", which
proposes a protocol for user authentication from remote clients.

RFC's (Requests for Comments) are available from nic.ddn.nil
via anonymous ftp.  You may be able to locate it elsewhere as well.
If you can't locate it, I can email a copy to you.

--
Steve Bacher (Batchman)                 Draper Laboratory
Internet: seb@draper.com                Cambridge, MA, USA

(A preliminary note: Please, PLEASE follow the guidelines in
news.announce.newusers which state that postings to the Usenet should not
contain lines longer than 80 characters, and in fact recommend limiting line
length to 72 characters.)

In article <1992Nov20.032345.18307@kodak.kodak.com>, deal@tempus.Kodak.Com (Stephen M. Deal) writes:

|> How do you authorize a client? Can you even trust a client? Perhaps those
|> clients executing on a node that has password protection (e.g. UNIX, VAX/VMS)
|> can be trusted

The problem with assuming that "nodes that have password protection" are
trustable is that you are therefore assuming that those nodes have not had
their security breached in any way.  You are relying on node security in order
to guarantee your network security.  That is a bad idea.

The company for which I work (Aktis, Inc., a.k.a. Geer Zolot Associates) does
a lot of security analyses for sites with large networks.  Invariably, those
sites make assumptions about the security of individual machines on the
network when constructing their network security framework.  And invariably,
the security of individual machines on the network is compromisable and
therefore leads to compromises in network security as well.

Unless your physical network is completely secured, so that people cannot put
their own machines on it, your machines on the network are all physically
secure, so that people are not able to break into them using physical means,
and you have direct administration over all the machines on the network so
that you can guarantee that they do not have software security holes on all of
them, you cannot safely trust ANY machine on the network.

If you want network security, you need some sort of network security tool.
|> Kerberos (from MIT's Project Athena) provides a glimmer of hope but I have not
|> seen any C/S vendor embrace this approach.

This is changing.

First of all, the fact that OSF's DCE has embraced Kerberos implies that
vendors who wish to be DCE-compliant are going to have to start supporting
Kerberos.

Tivoli/WORKS, the OSF DME distributed management environment, allows (although
it does not require) the use of Kerberos for the authentication of
individuals' access to the Tivoli environment.

Several of the network RDMS vendors are currently investigating adding
Kerberos support to their products.

-- 
Jonathan Kamens                                         jik@MIT.Edu
MIT Information Systems/Athena              Moderator, news.answers

In article <19921122175106SEB1525@MVS.draper.com>,
SEB1525@MVS.draper.com (Steve Bacher) writes:
> In article <1992Nov20.032345.18307@kodak.kodak.com>,
> deal@tempus.Kodak.Com (Stephen M. Deal) writes:
> >Has anyone given much thought to client authentication on PCs and Macs?
> >Does anyone have any thoughts on how a server (DB  or otherwise) would
> >handle such a mechanism?
> 
> You may want to look at RFC 931, "Authentication server", which
> proposes a protocol for user authentication from remote clients.

Not for PCs and Macs he doesn't.  RFC931 only works with reasonably
trusted hosts; with PC class machines that are trivially subverted,
RFC931 is useless as an authentication protocol.  See the CAVEATS
sections of RFC931:

CAVEATS

   Unfortunately, the trustworthiness of the various host systems that
   might implement an authentication server will vary quite a bit.  It
   is up to the various applications that will use the server to
   determine the amount of trust they will place in the returned
   information.  It may be appropriate in some cases restrict the use of
   the server to within a locally controlled subnet.

For reliable client authentication on untrustworthy hosts, you really
need something like Kerberos.

-- 
-Dan Riley                          Internet: dsr@lns598.tn.cornell.edu
-Wilson Lab, Cornell University     HEPNET/SPAN: lns598::dsr (44630::dsr)