Date: Sat, 19 Jan 2002 16:29:46 +0000 From: Mark Murray <mark@grondar.za> To: "Andrey A. Chernov" <ache@nagual.pp.ru> Cc: Kris Kennaway <kris@obsecurity.org>, cvs-committers@FreeBSD.org, cvs-all@FreeBSD.org Subject: Re: cvs commit: src/lib/libpam/modules/pam_opie pam_opie.c Message-ID: <200201191629.g0JGTkt22254@grimreaper.grondar.org> In-Reply-To: <20020119145947.GF9803@nagual.pp.ru> ; from "Andrey A. Chernov" <ache@nagual.pp.ru> "Sat, 19 Jan 2002 17:59:47 %2B0300." References: <20020119145947.GF9803@nagual.pp.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
> On Sat, Jan 19, 2002 at 14:21:50 +0000, Mark Murray wrote: > > > We already live with this "change" several years when S/Key was here and > > > nobody complaints. This is not a change, this is return to old way as it > > > must be. > > > > One of the reasons I went for OPIE was to get away from S/Key brokenness. > > What brokenness do you mean, exactly? There basically just the same idea > in OPIE, only OTP response format is changed which is enhancement and not > brokennes fix. Many other OPIE "features" either _lowers_ security and > should be never turned on (like LOCKING) or gains nothing for security, > just make interface inconvinient. Some other (not so useful, but who > knows) features like tty-level access is even removed in OPIE. If the sysadmin turns on OPIE for a particular facility (like say, ftpd) then there MUST be an OPIE challenge for all users (except perhaps root and the anonymous user). That way, the external user gets much less info about the internal security arrangements (like who is using OPIE, and who may be using (insecure) unix passwords). The less you tell the attacker, the better. If that means giving a bogus OPIE challenge for a user who has no OPIE enables, then that is GOOD, because it gives the attacker something bogus to chew on. The fact that this may be open source is irrellevant. With the external attacker, the contents of /etc/ are still partially protected. M -- o Mark Murray \_ FreeBSD Services Limited O.\_ Warning: this .sig is umop ap!sdn To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe cvs-all" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200201191629.g0JGTkt22254>