full-disclosure - Re: (Psexec on *NIX)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <9f08cff0702041620u2e239b73vad3a749fa21f7e96@mail.gmail.com>
Date: Mon, 5 Feb 2007 11:20:05 +1100
From: Q-Ball <qballus@...il.com>
To: "Stan Bubrouski" <stan.bubrouski@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: (Psexec on *NIX)

Key-based logon is a bad idea in general because afaik, it's not
possible to implement any type of password policy on those keys. This
therefore potentially allows someone with access to those keys, access
to further accounts or resources on remote systems.
The exception to this where the task required, can be suitably
restricted to a small and preferably unprivileged set of commands,
such as in automated logons.

On 2/3/07, Stan Bubrouski <stan.bubrouski@...il.com> wrote:
> On 2/2/07, Tyop? <tyoptyop@...il.com> wrote:
> >
> > key-based login without passphrase is like eating cheese without
> > bred. useless (IMHO).
> >
>
> Totally, if someone compromises the machine and gets root they get all
> your keys and without a passphrase... yeah no good.
>
> > > - - With a little bit of configuration, it's easy to figure out which
> > > key was used to login to an account; the audit trail can be managed
> > > that way.
> > > - - Managing which users have access to which root accounts is trivial
> > > this way: just add or delete their keys from .ssh/authorized_keys[2].
> >
> > Totally agree.
> >
>
> Ditto.
>
> -sb
>
> > --
> > Tyop?
> > http://altmylife.blogspot.com
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
> >
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/