Thread View: comp.sys.sgi.admin
4 messages
4 total messages
Started by Jung Joo-won
Tue, 15 Dec 1992 06:26
[Q] C2 security or Shadow...
Author: Jung Joo-won
Date: Tue, 15 Dec 1992 06:26
Date: Tue, 15 Dec 1992 06:26
20 lines
1277 bytes
1277 bytes
Does anybody know about C2 security on SGI? (or shadow password mechanism which can go along with NIS...) We have 4 workstations and they are tightly coupled with NFS and NIS(YP). The server(master) machine is Iris 4D, and clients are Sun4 and Mips. But, as you know, the NIS without C2 has great security hole. (If you got the domain name, you could get anything from that domain.) I have to secure our machines. Please send a E-mail to me if you have the right answer.... Thanks in advance. -Jung Joowon (jwjung@jupiter.kaist.ac.kr) -- Jung Joowon | E-mail: jwjung@cs.kaist.ac.kr Dept. of Computer Science | /\^ Always being Korea Advanced Inst. of Sci. and Tech. | / \/\ with Network Taejon, Republic of Korea, 305-701 | / \ \ Mountain Duck (Quack)
Re: [Q] C2 security or Shadow...
Author: Casper H.S. Dik
Date: Tue, 15 Dec 1992 13:32
Date: Tue, 15 Dec 1992 13:32
25 lines
1392 bytes
1392 bytes
jwjung@kaist.ac.kr (Jung Joo-won) writes: >Does anybody know about C2 security on SGI? >(or shadow password mechanism which can go along with NIS...) >We have 4 workstations and they are tightly coupled with NFS and NIS(YP). >The server(master) machine is Iris 4D, and clients are Sun4 and Mips. >But, as you know, the NIS without C2 has great security hole. >(If you got the domain name, you could get anything from that domain.) Why do you think that NIS with C2 is more secure? You have three possibilities: - make only Sun servers and install patch #100482-0x (x >= 2) or - filter all packets in the range 0-1024 that are incoming. or - make the NIS servers totally inaccessible from the outside There are no shadow password mechanisms that work between vendors with distributed password databases and work out of the box. I hope that NIS+ will make it to other vendors. Casper
Re: [Q] C2 security or Shadow...
Author: Aaron Schuman
Date: Tue, 15 Dec 1992 17:48
Date: Tue, 15 Dec 1992 17:48
25 lines
1403 bytes
1403 bytes
jwjung> Does anybody know about C2 security on SGI? jwjung> (or shadow password mechanism which can go along with NIS...) Irix 5.0 will have shadow passwords and c2-style auditing as bundled (but configurable) features. C2 features are not available in Irix 4.0, but they can be found in Trusted Irix 4.0.4T, which is under consideration for the B1 evaluation class by the US National Computer Security Center. jwjung> But, as you know, the NIS without C2 has great security hole. NIS was designed without security in mind. Attempts to retrofit access protection to it have been haphazard and inadequate. I wouldn't recommend NIS as the administrative solution for anybody whose systems were facing a serious intrusion threat. Aaron ............................................................................. Aaron Schuman 415-390-1901 schuman@sgi.com Silicon Graphics, Inc.
Re: [Q] C2 security or Shadow...
Author: Casey Schaufler
Date: Wed, 16 Dec 1992 18:06
Date: Wed, 16 Dec 1992 18:06
15 lines
1254 bytes
1254 bytes
The architecture of NIS (YP prior to the trademark's owner's objection) precludes it's applicability at the C2 (or any higher) level. Shadow passwords (available in an upcoming IRIX release) must be hidden from the general public. NIS, however, is a public service which will distribute the information to everyone. NIS cannot be used to distribute shadow passwords, as it will not hide them from unprivileged users. NIS does not allow databases to be restricted to the super-user. Sun has (or did at one point have) a PROPRIETARY extension involving a daemon (pwauthd) and some deep-under-the-covers-magic-in-libc to provide shadow passwords in a YP environment, but I do not believe that interface has ever been published. -casey
Thread Navigation
This is a paginated view of messages in the thread with full content displayed inline.
Messages are displayed in chronological order, with the original post highlighted in green.
Use pagination controls to navigate through all messages in large threads.
Back to All Threads