From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: tuhs-bounces@minnie.tuhs.org X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=0.8 required=5.0 tests=DKIM_INVALID,DKIM_SIGNED, MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE,SUBJ_ALL_CAPS autolearn=no autolearn_force=no version=3.4.2 Received: from minnie.tuhs.org (minnie.tuhs.org [45.79.103.53]) by inbox.vuxu.org (OpenSMTPD) with ESMTP id 0da7cb61 for ; Wed, 7 Nov 2018 02:49:12 +0000 (UTC) Received: by minnie.tuhs.org (Postfix, from userid 112) id 9B899A22DA; Wed, 7 Nov 2018 12:49:11 +1000 (AEST) Received: from minnie.tuhs.org (localhost [127.0.0.1]) by minnie.tuhs.org (Postfix) with ESMTP id B744FA22A0; Wed, 7 Nov 2018 12:48:31 +1000 (AEST) Received: by minnie.tuhs.org (Postfix, from userid 112) id 15F9AA22A2; Wed, 7 Nov 2018 10:35:12 +1000 (AEST) Received: from tncsrv06.tnetconsulting.net (tncsrv06.tnetconsulting.net [45.33.28.24]) by minnie.tuhs.org (Postfix) with ESMTPS id 16344A22A0 for ; Wed, 7 Nov 2018 10:35:06 +1000 (AEST) Received: from Contact-TNet-Consulting-Abuse-for-assistance by tncsrv06.tnetconsulting.net (8.15.2/8.15.2/Debian-3) with ESMTPSA id wA70Z4ZJ022633 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO) for ; Tue, 6 Nov 2018 18:35:05 -0600 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=tnetconsulting.net; s=2015; t=1541550905; bh=puLiikphsM/tLYyIF32BjboXPX0g8zGVWzVyN63Vgb8=; h=Subject:To:References:From:Message-ID:Date:User-Agent: MIME-Version:In-Reply-To:Content-Type:Cc:Content-Disposition: Content-Language:Content-Transfer-Encoding:Content-Type:Date:From: In-Reply-To:Message-ID:MIME-Version:References:Reply-To: Resent-Date:Resent-From:Resent-To:Resent-Cc:Sender:Subject:To: User-Agent; b=ovXRCl2FTADmIW5g6Pqn7mSxRanBz2yS8wCR25V6GVstdC6ir+D9N1qnr5FSU26j3 l9s13SHAYzrQENdrntfqa/VaT10OHj9FNVT1YACats+bfXrwAcv/1tmgMtzPBieRhb UycgTWUXS7F3BjbyFz+EOrg90W0YkvOPWN6tcYRA= To: tuhs@minnie.tuhs.org References: <0289fa26-d157-8a65-389e-61dd7a01fcc4@spamtrap.tnetconsulting.net> <7d595808-fff7-4c1c-d969-362693ab2672@spamtrap.tnetconsulting.net> Organization: TNet Consulting Message-ID: <7e9e6546-6575-e4d5-caf8-52c504f5a953@spamtrap.tnetconsulting.net> Date: Tue, 6 Nov 2018 17:35:04 -0700 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms000605060203040608010704" Subject: Re: [TUHS] YP / NIS / NIS+ / LDAP X-BeenThere: tuhs@minnie.tuhs.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: The Unix Heritage Society mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Grant Taylor via TUHS Reply-To: Grant Taylor Errors-To: tuhs-bounces@minnie.tuhs.org Sender: "TUHS" This is a cryptographically signed message in MIME format. --------------ms000605060203040608010704 Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 11/06/2018 03:24 PM, Dan Cross wrote: > Isn't that authorization? Not really. Authentication is proving that you are who you claim to be. - Show=20 your drivers license to the bouncer. Authorization is deciding if the authenticated entity is allowed to have = access or not. - Is your name on the list of people allowed into the=20 nightclub? Access Control - The bouncer, allowing you in or physically barring you=20 from entering. Each is a discrete function. They all work in close concert with each=20 other. > Not really. It provides the data that lets one perform a relatively wea= k=20 > validation of e.g. a password, but it is not *itself* an authentication= =20 > protocol. Fair enough. > Older versions of Kerberos often included modified versions of popular = > servers and their clients that had been modified to use the kerberos=20 > protocol for authentication, and also often to encrypt communications. I take it that you mean that the Kerberos software that was distributed=20 also included an alternate telnet / rsh / etc daemon that took advantage = of Kerberos. > For example, the version of `telnet` that shipped with MIT kerberos bac= k=20 > in the day had an option that could be used to encrypt the data stream;= =20 > similarly with rlogin, et al. *nod* > I have a dim memory that the version of FTP might support encryption=20 > for the control connection but not data connections (but I also might b= e=20 > purely imagining that). Maybe. There has been a LOT of energy put into FTP. > I'm guessing most of this stuff has been dropped from more recent=20 > distributions Likely. > because...really...telnet? ~chuckle~ I supported multiple old Solaris 6 machines about 5 years ago that I=20 still had to use telnet to connect to. I feel like telnet as a service REALLY does need to go away. That being = said, I still find the telnet (or any NVT) client a valuable diagnostic=20 tool. > What I meant is that SSH supports a limited sense of checking whether=20 > a given key matches and making a yea or nay decision based on that. I'm not sure I understand what you're alluding to. But that's getting=20 off topic. So I digress. > Correct. `ypcat passwd` often gave you a bunch of hashed passwords in=20 > field two of a stream 7th Edition /etc/passwd formatted entries. I would have hoped that there would have been some intelligence to only=20 return the record of the person requesting the information. Or that the = password field was redacted for other users. I guess the ypcat binary could be augmented to do that filtering client=20 side. But that still leaves the underlying problem there for alternate=20 NIS clients. > I have, again, some vague memory that at some point this was changed so= =20 > that root on the localhost could get a shadow-style map, but normal use= rs=20 > couldn't see the password hashes. But I might totally be making that up= ,=20 > and of course, it wasn't robust security since what went over the wire = > wasn't encrypted and breaking root on a host could still get you all=20 > the hashes on the network. It's still subject to alternate ypcat impersonation binaries too. > Contrast with Kerberos, where breaking root on a host doesn't compromis= e=20 > much beyond that host (modulo leveraging that to steal user passwords=20 > and the like). ACK > Ha! That's a hoot. ;-) --=20 Grant. . . . unix || die --------------ms000605060203040608010704 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC CxcwggUpMIIEEaADAgECAhAIzwdZriPvq7FXSbc0jGReMA0GCSqGSIb3DQEBCwUAMIGXMQsw CQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxm b3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDE9MDsGA1UEAxM0Q09NT0RPIFJTQSBD bGllbnQgQXV0aGVudGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQTAeFw0xNzExMTcwMDAw MDBaFw0xODExMTcyMzU5NTlaMCsxKTAnBgkqhkiG9w0BCQEWGmd0YXlsb3JAdG5ldGNvbnN1 bHRpbmcubmV0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvhfMhFM6CDAWL4Mg xrKLLbzTCILpI7uBzgG/HFXxV92MX4fba+pAotqOV8of7uF4YykVw94lCsOmFeVkb8VNSn6Q KSFbfnjXmYgU7XRtFHioTZihIynEXXI1LPMhnDXV9jCEzVvrlBx/6mSPdQcWhG1oMAlGd62w uu/CRE5U70LngVVat0wDJhdzrHxZabQlHhAPAvwMex8ObGDAkuieUCn5pQj2xqVKMB65vdcE ZydA8d8X8mvqHHOrEOg5xIwpca7E4JeUMxzYrdp3kVS7V+wXUui1nPwMb6o8WUe72FnL27BY mGqmtUGUc/ajGDUMS4xvabJ0M4Qc/NVGf56qDwIDAQABo4IB2jCCAdYwHwYDVR0jBBgwFoAU gq9sjPjF/pZhfOgfPStxSF7Ei8AwHQYDVR0OBBYEFD8vJWpDFBkhAbiZGgx0EIUgH1EoMA4G A1UdDwEB/wQEAwIFoDAMBgNVHRMBAf8EAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEF BQcDAjBGBgNVHSAEPzA9MDsGDCsGAQQBsjEBAgEDBTArMCkGCCsGAQUFBwIBFh1odHRwczov L3NlY3VyZS5jb21vZG8ubmV0L0NQUzBaBgNVHR8EUzBRME+gTaBLhklodHRwOi8vY3JsLmNv bW9kb2NhLmNvbS9DT01PRE9SU0FDbGllbnRBdXRoZW50aWNhdGlvbmFuZFNlY3VyZUVtYWls Q0EuY3JsMIGLBggrBgEFBQcBAQR/MH0wVQYIKwYBBQUHMAKGSWh0dHA6Ly9jcnQuY29tb2Rv Y2EuY29tL0NPTU9ET1JTQUNsaWVudEF1dGhlbnRpY2F0aW9uYW5kU2VjdXJlRW1haWxDQS5j cnQwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmNvbW9kb2NhLmNvbTAlBgNVHREEHjAcgRpn dGF5bG9yQHRuZXRjb25zdWx0aW5nLm5ldDANBgkqhkiG9w0BAQsFAAOCAQEArDRhn6+otAvz JNgWiGsEeKawiBwqIlR8NSoiOpNYfpmZWS7A+X2mn/47nUT1KypbS3Mf8j8N1rf/FU53p0So WBsnqPAYajAaLjXnGoOEs8pOW0nK/vFYGJHdh8RXvxpPBOd7HUQCqsc4MGJUgasfrWdwqfAZ C1C0G7rNxY5Uvj8RFBPb7d+RfOaegUBMc5FDiXB3Xs43lUEWoWiMi6R3Y5PlQyrvLJB39cLw iLWlOom79addldgAaWZsxnwUDgQgth5ARr1Jw+nfNIimmauAtxDJMgaV17B4ODeuHI1jlPoG HS4+u/qVAwSYq4vtaCN1PSPHwqrrnERAj40c6yPyvzCCBeYwggPOoAMCAQICEGqb4Tg7/ytr nwHV2binUlYwDQYJKoZIhvcNAQEMBQAwgYUxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVh dGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBM aW1pdGVkMSswKQYDVQQDEyJDT01PRE8gUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4X DTEzMDExMDAwMDAwMFoXDTI4MDEwOTIzNTk1OVowgZcxCzAJBgNVBAYTAkdCMRswGQYDVQQI ExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9E TyBDQSBMaW1pdGVkMT0wOwYDVQQDEzRDT01PRE8gUlNBIENsaWVudCBBdXRoZW50aWNhdGlv biBhbmQgU2VjdXJlIEVtYWlsIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA vrOeV6wodnVAFsc4A5jTxhh2IVDzJXkLTLWg0X06WD6cpzEup/Y0dtmEatrQPTRI5Or1u6zf +bGBSyD9aH95dDSmeny1nxdlYCeXIoymMv6pQHJGNcIDpFDIMypVpVSRsivlJTRENf+RKwrB 6vcfWlP8dSsE3Rfywq09N0ZfxcBa39V0wsGtkGWC+eQKiz4pBZYKjrc5NOpG9qrxpZxyb4o4 yNNwTqzaaPpGRqXB7IMjtf7tTmU2jqPMLxFNe1VXj9XB1rHvbRikw8lBoNoSWY66nJN/VCJv 5ym6Q0mdCbDKCMPybTjoNCQuelc0IAaO4nLUXk0BOSxSxt8kCvsUtQIDAQABo4IBPDCCATgw HwYDVR0jBBgwFoAUu69+Aj36pvE8hI6t7jiY7NkyMtQwHQYDVR0OBBYEFIKvbIz4xf6WYXzo Hz0rcUhexIvAMA4GA1UdDwEB/wQEAwIBhjASBgNVHRMBAf8ECDAGAQH/AgEAMBEGA1UdIAQK MAgwBgYEVR0gADBMBgNVHR8ERTBDMEGgP6A9hjtodHRwOi8vY3JsLmNvbW9kb2NhLmNvbS9D T01PRE9SU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDBxBggrBgEFBQcBAQRlMGMwOwYI KwYBBQUHMAKGL2h0dHA6Ly9jcnQuY29tb2RvY2EuY29tL0NPTU9ET1JTQUFkZFRydXN0Q0Eu Y3J0MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5jb21vZG9jYS5jb20wDQYJKoZIhvcNAQEM BQADggIBAHhcsoEoNE887l9Wzp+XVuyPomsX9vP2SQgG1NgvNc3fQP7TcePo7EIMERoh42aw GGsma65u/ITse2hKZHzT0CBxhuhb6txM1n/y78e/4ZOs0j8CGpfb+SJA3GaBQ+394k+z3ZBy WPQedXLL1OdK8aRINTsjk/H5Ns77zwbjOKkDamxlpZ4TKSDMKVmU/PUWNMKSTvtlenlxBhh7 ETrN543j/Q6qqgCWgWuMAXijnRglp9fyadqGOncjZjaaSOGTTFB+E2pvOUtY+hPebuPtTbq7 vODqzCM6ryEhNhzf+enm0zlpXK7q332nXttNtjv7VFNYG+I31gnMrwfHM5tdhYF/8v5UY5g2 xANPECTQdu9vWPoqNSGDt87b3gXb1AiGGaI06vzgkejL580ul+9hz9D0S0U4jkhJiA7EuTec P/CFtR72uYRBcunwwH3fciPjviDDAI9SnC/2aPY8ydehzuZutLbZdRJ5PDEJM/1tyZR2niOY ihZ+FCbtf3D9mB12D4ln9icgc7CwaxpNSCPt8i/GqK2HsOgkL3VYnwtx7cJUmpvVdZ4ognzg Xtgtdk3ShrtOS1iAN2ZBXFiRmjVzmehoMof06r1xub+85hFQzVxZx5/bRaTKTlL8YXLI8nAb R9HWdFqzcOoB/hxfEyIQpx9/s81rgzdEZOofSlZHynoSMYIENTCCBDECAQEwgawwgZcxCzAJ BgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZv cmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMT0wOwYDVQQDEzRDT01PRE8gUlNBIENs aWVudCBBdXRoZW50aWNhdGlvbiBhbmQgU2VjdXJlIEVtYWlsIENBAhAIzwdZriPvq7FXSbc0 jGReMA0GCWCGSAFlAwQCAQUAoIICWTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqG SIb3DQEJBTEPFw0xODExMDcwMDM1MDRaMC8GCSqGSIb3DQEJBDEiBCCu5Sz2nyHCj1ED1PM/ En492eiE72Ana3Q3e71YS1guLDBsBgkqhkiG9w0BCQ8xXzBdMAsGCWCGSAFlAwQBKjALBglg hkgBZQMEAQIwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcG BSsOAwIHMA0GCCqGSIb3DQMCAgEoMIG9BgkrBgEEAYI3EAQxga8wgawwgZcxCzAJBgNVBAYT AkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGjAY BgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMT0wOwYDVQQDEzRDT01PRE8gUlNBIENsaWVudCBB dXRoZW50aWNhdGlvbiBhbmQgU2VjdXJlIEVtYWlsIENBAhAIzwdZriPvq7FXSbc0jGReMIG/ BgsqhkiG9w0BCRACCzGBr6CBrDCBlzELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIg TWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0 ZWQxPTA7BgNVBAMTNENPTU9ETyBSU0EgQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBTZWN1 cmUgRW1haWwgQ0ECEAjPB1muI++rsVdJtzSMZF4wDQYJKoZIhvcNAQEBBQAEggEAbOki1QDS XKoUGUea46QcMlA7DT3Estg7S/S1uKkJzqKzxj4sy5Yr92klFFxNa/8IlVy269GAYFelvSPV loa8inafldoEjiY9ZFWfXl/LepEWBOMMsQKlD9xAVT7i7F0ZAFn122GYQchLWN7c177kYt/w heuGUbzT4W3DOqQigvRu6iyfVm18lPNAPrwgCnSiWzN/vPgZLobW+Ycxp7vdunLTy4K+0ITj XwvPEubTpj92j48aDMoTbteDapnfYCbF+xWDYShxqAxNR0PGNxgPuS4jgaT/J7j70yvTu2mY aREeaccdeiRUwCMu6WofEpHT7GOHhq5We8JQ60yILTI8dwAAAAAAAA== --------------ms000605060203040608010704--