How to prevent an nidump of the passwd's?

Thread View: comp.sys.next.sysadmin

2 messages

[T] Back to Threads [V] Tree View [G] Group Articles

2 total messages Started by J.B. Nicholson-Owens Sat, 03 Oct 1992 17:49

#1730

Author: J.B. Nicholson-Owens
Date: Sat, 03 Oct 1992 17:49

12 lines
1007 bytes

Other than making the 'nidump' command unavailable via removing the read and  
execute permissions (which really wouldn't help if someone were to get the  
command from somewhere else), how can the password data be protected from being  
read by just anyone on the system?  That is, what needs to be changed so that  
the passwords come out either with asterisks for where the real encrypted  
password would be or just making the entire output from 'nidump passwd /'  
unavailable?

Thanks.
-- 
-- Jeff (jeffo@uiuc.edu)
-- NeXTmail ok

Re: How to prevent an nidump of the passwd's?

#1743

Author: Louis A. Mamakos
Date: Sun, 04 Oct 1992 15:03

30 lines
2048 bytes

In article <BvK45x.Ao0@news.cso.uiuc.edu> jeffo@uiuc.edu (J.B. Nicholson-Owens) writes:
>Other than making the 'nidump' command unavailable via removing the read and  
>execute permissions (which really wouldn't help if someone were to get the  
>command from somewhere else), how can the password data be protected from being  
>read by just anyone on the system?  That is, what needs to be changed so that  
>the passwords come out either with asterisks for where the real encrypted  
>password would be or just making the entire output from 'nidump passwd /'  
>unavailable?

You can protect access to netinfo based on IP address.  This protects
your host from random folks on the Internet doing:

	$ nidump -t passwd uiuc.edu/local

to get your password file entries.  See the security chapter in the
NeXT system admin documentation to explain how to fix this problem.

I'm assuming that you want to protect the encrypted password from
users on the same machine that the password is being used on.  You
can't, using the standard NeXT supplied software.  The NeXT software
has no concept of a shadow password file where the actual encrypted
passwords lie.  Removing nidump/niutil/etc won't do any good, because
all you need to do then is write a trival program to use getpwent() to
fetch them all.

We've moved to a Kerberos based authentication system on our NeXTs, in
conjunction with AFS.  This has necessitated building new versions of
login, ftpd, loginwindow, etc.  This is quite a lot of work.

louie

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads