Subject: Re: ["Frank O'Dwyer" <[email-masked]>: Re: Kerberos login sniffer and cracker

From: Matt Crawford <[email-masked]>
Date: Mon, 02 Dec 2002 11:46:26 -0600

for Windows 2000/XP]
In-reply-to: "02 Dec 2002 11:57:10 EST." <[email-masked]>
To: Derek Atkins <[email-masked]>
Cc: [email-masked]
Message-id: <[email-masked]>
Sender: [email-masked]
Precedence: bulk

> Also note that any DCE-RFC26 solution requires that any
> AS_REQ-producing client be setuid-root in order to read the system
> key.  This means that kinit, kpasswd, and who knows what other
> applications _necessaily_ need to be setuid.
> 
> This adds a metric buttload of additional (potential) security
> vulnerabilities.
> 
> I, personally, do not want to require kinit to be setuid....

Mere (ahem) implementation details.  There could be a root daemon
that dispenses non-tgt creds for the authentication service over a
host-local communication mechanism.  Or the daemon could provide an
intermediation service.  Et, as they say, cetera.