Fwd: KEYRING:persistent and ssh

From	Cedric Blancher <cedric.blancher@gmail.com>
Newsgroups	linux.kernel
Subject	Fwd: KEYRING:persistent and ssh
Date	2016-09-28 22:20 +0200
Message-ID	<smtuF-2XJ-1@gated-at.bofh.it> (permalink)
References	<smtuF-2XJ-3@gated-at.bofh.it> <smtuF-2XJ-5@gated-at.bofh.it> <smtuF-2XJ-7@gated-at.bofh.it> <smtuF-2XJ-9@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

FYI, keyring support is pretty much dead.

Ced

---------- Forwarded message ----------
From: Lionel Cons <lionelcons1972@gmail.com>
Date: 28 September 2016 at 17:25
Subject: Re: KEYRING:persistent and ssh
To: t Seeger <tseegerkrb@gmail.com>
Cc: kerberos@mit.edu


Storing: Simply on a ram filesystem and use ACLS to tackle it down to
the list of users who need it. This is pretty much what KEYRING does,
with a custom nonstandard api.

FYI by policy CERN has forbidden the use of Linux KEYRING because of
several security breaches (info bleeds through chroot&co) and mostly
have patched the kernel to just issue a errno not supported if someone
tries to use Linux KEYRING).

Lionel

On 28 September 2016 at 13:42, t Seeger <tseegerkrb@gmail.com> wrote:
>> On 27 Sep 2016, at 15:20, Tina Harriott <tina.harriott.math@gmail.com> wrote:
>>
>>> On 16 September 2016 at 16:02, t Seeger <tseegerkrb@gmail.com> wrote:
>>> Hello,
>>>
>>> i have a little problem with the 'KRB5CCNAME' environment variable. I set
>>> the default_ccache_name to KEYRING:persistent:%{uid} but if i login it is
>>> set to "file:/tmp/krb5cc_${uid}_XXXXXXXXXX" cause ssh sets the KRB5CCNAME
>>> to file:/tmp/krb5cc_${uid}_XXXXXXXXXX...
>>> I found a workaround with adding "unset KRB5CCNAME" to /etc/bash.bashrc but
>>> this is not very nice.
>>> Did anyone had a similar problem and found a solution?
>>>
>>> Many thanks in advance and best regards
>>> ________________________________________________
>>> Kerberos mailing list           Kerberos@mit.edu
>>> https://mailman.mit.edu/mailman/listinfo/kerberos
>>
>> FYI KEYRING: will be removed in future versions of Linux kernel
>> because of the ongoing design defects.
>> Also, KEYRING is not secure, under certain scenarios (DOCKER&et al)
>> unrelated users/uids can obtain the secure data.
>>
>> Tina
>> --
>> Tina Harriott  - Women in Mathematics
>> Contact: tina.harriott.math@gmail.com
>
> Thank you for your replay. I have two questions. First can you tell me what is the best practice way to store the credential cache and second where can I find more informations about the plan to remove the KEYRING from the kernel?
>
> Thorsten
> ________________________________________________
> Kerberos mailing list           Kerberos@mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos



--
Lionel
________________________________________________
Kerberos mailing list           Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos


-- 
Cedric Blancher <cedric.blancher@gmail.com>
[https://plus.google.com/u/0/+CedricBlancher/]
Institute Pasteur

Back to linux.kernel | Previous | Next | Find similar | Unroll thread

Thread

Fwd: KEYRING:persistent and ssh Cedric Blancher <cedric.blancher@gmail.com> - 2016-09-28 22:20 +0200

csiph-web