Date: Thu, 8 Jul 1999 11:19:56 +0930 (CST) From: Kris Kennaway <kkennawa@physics.adelaide.edu.au> To: Ladavac Marino <mladavac@metropolitan.at> Cc: "'Josef Karthauser'" <joe@pavilion.net>, Brian Somers <brian@awfulhak.org>, Mark Thomas <thomas@clark.net>, freebsd-security@freebsd.org, Wayne Self <wself@cdrom.com> Subject: Credential storage (was RE: userland ppp - startup) Message-ID: <Pine.OSF.4.10.9907081046500.21412-100000@bragg> In-Reply-To: <55586E7391ACD211B9730000C11002761796DA@r-lmh-wi-100.corpnet.at>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, 7 Jul 1999, Ladavac Marino wrote:
> > Hmm... how to do this then? The sppp setup code in rc.* allows
> > username/password
> > to be specified. Can it be done in the environment then? (If rc.conf
> > is visable
> > then the sppp config gives usernames and passwords away as it stands
> > today.)
> [ML] Don't know about sppp, but the only halfway secure way to
> keep this sensitive data is in a file readable by root, and having the
> program which needs it setuid root. Sounds a lot like
> /etc/ppp/ppp.conf, doesn't it?
>
> The secure way would be not keeping the info at all :)
You know, I wonder if it's time to look at providing a generic credential
storage registry; things like password hashes, PPP shared secrets, etc, could
be stored here instead of in lots of separate files.
So user account passwords could point to a SHA-1 hash in the registry, ppp
shared secrets would point to an NT and/or LM hash, samba accounts could have
an associated NT/LM hash, etc. More than one hash could be associated with any
given entity.
The modules which manipulate individual credentials (hashes) would be
pluggable along the lines of PAM.
What do people think - is this worth pursuing?
Kris
-----
"Never criticize anybody until you have walked a mile in their shoes,
because by that time you will be a mile away and have their shoes."
-- Unknown
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.OSF.4.10.9907081046500.21412-100000>