Message-ID: <CAM2Hf5nu22CqvXqp7ZhSJ=nsEbJV_t2Taj79F5WecD5dVr03VQ@mail.gmail.com>
Date: Wed, 7 Dec 2011 00:38:09 -0800
From: Gage Bystrom <themadichib0d@...il.com>
To: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: distributing passwords to users

O.o and you act like what he wants is a good thing? Getting /any/ service
account with that file would be better than pillaging an entire server of
ssh keys. With ssh keys you know you only got access to a few more servers
on the network, maybe not even root or admin unless you got lucky and score
the key used for root/admin for every single box. No, with that you score
the entire clientele...

Not to mention what you described is not what he is asking. He wants to
distribute the passwords to multiple users(idc if they are hashed,
encrypted or not, just minor details at this point). What you described is
a centralized database. There's only one copy of the file, only one server
that holds the goods, the rest can have tidbits and if compromised can do
minimum damage. Coupled with the right motivations and logging then
attacking the support group on the internal network gives you almost
nothing.

Conversely attacking a single user holding the password file for the OP is
end game. You're simply not going to be able to secure multiple copies of
the same file with different access controls(hey I used a textbook phrase
:) ).

The only alternative is to have one access control, or all users have the
same permission. However that is also absurd, you're only multiplying your
attack service with each added user.

Maybe now ya see where I start wondering where the cognitive dissonance
ought to be coming in for attempting what the OP is trying to do? I was
wrong for assuming it should be obvious from the get go, but as you can see
the ISP wasn't in the same boat he wants to board. They would be sitting in
the crows nest wondering why the loonie on the deserted island was trying
to paddle it home.

Alright, I think I've been harsh enough on the poor OP, but I hope he
understands that this is a classic case of "You're doing it wrong". He
knows what needs to be done, but his method of doing so actively works
against his goal.
On Dec 6, 2011 10:51 PM, "James Condron" <james@...o-internet.org.uk> wrote:

> An ISP I worked at stored logins for customer servers where the customer
> required us to be able to login to provide support.
>
> We used a webapp on our internal network with the relevant security
> accoutrements. Its pretty standard; you login, find the server you need
> credentials for and hit a button to either launch a putty session or an RDP
> session. You can also edit passwords or view for non-windows users.
>
> The reason tools exist is because there is a demand for them- hell, its a
> password safe. Perhaps OP should look at this type of solution.
>
>
> On Wed, Dec 7, 2011 at 6:28 AM, Gage Bystrom <themadichib0d@...il.com>wrote:
>
>> I'm disturbed in the first place that you want to distribute password
>> lists to multiple users.
>> I'm disturbed more so that there is no apparent cognitive dissonance
>> preventing you from functioning enough to have sent that email.
>>
>> Someone please tell me that I'm not the only one disturbed here? And
>> if I am, point to me why please?
>>
>> On Mon, Dec 5, 2011 at 7:30 PM, G V <gvasiliu@...il.com> wrote:
>> > Hi,
>> >
>> > From your experience, what's the best secure and easy way to update a
>> > password list and distribute it to 1000 or so unix users? The users
>> > would have different privilege levels and different access on network.
>> > Throwing ideas, I can think of: pgp (difficult to maintain a separate
>> > file for each user), web app (would need to be sucured over ssl,
>> > possible password protected), usb disks (difficult to manage changes).
>> > Anyone using an enterprise level app (commercial or not) to "share"
>> > passwords to users, manage changes and so on? Any other ideas I can
>> > use?
>> >
>> > Thank you,
>> > George Vasiliu
>> >
>> > ------------------------------------------------------------------------
>> > Securing Apache Web Server with thawte Digital Certificate
>> > In this guide we examine the importance of Apache-SSL and who needs an
>> SSL certificate.  We look at how SSL works, how it benefits your company
>> and how your customers can tell if a site is secure. You will find out how
>> to test, purchase, install and use a thawte Digital Certificate on your
>> Apache web server. Throughout, best practices for set-up are highlighted to
>> help you ensure efficient ongoing management of your encryption keys and
>> digital certificates.
>> >
>> >
>> http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
>> > ------------------------------------------------------------------------
>> >
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
>
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists