From owner-freebsd-security Thu Mar 25 16:37:48 1999 Delivered-To: freebsd-security@freebsd.org Received: from mail1.its.rpi.edu (mail1.its.rpi.edu [128.113.100.7]) by hub.freebsd.org (Postfix) with ESMTP id A61371546B for ; Thu, 25 Mar 1999 16:37:25 -0800 (PST) (envelope-from drosih@rpi.edu) Received: from [128.113.24.47] (gilead.acs.rpi.edu [128.113.24.47]) by mail1.its.rpi.edu (8.8.8/8.8.6) with ESMTP id TAA132832; Thu, 25 Mar 1999 19:36:59 -0500 Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" X-Sender: drosih@pop1.rpi.edu Message-Id: In-Reply-To: References: <199903252044.MAA02527@apollo.backplane.com> Date: Thu, 25 Mar 1999 19:37:46 -0500 To: James Wyatt From: Garance A Drosihn Subject: Re: sudo (was Re: Kerberos vs SSH) Cc: freebsd-security@FreeBSD.ORG Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org At 5:22 PM -0600 3/25/99, James Wyatt wrote: > The thing I don't like about it is that it makes programs like > linsniffer more effective. It looks at TCP startups of telnet, > FTP, pop, etc... and very nicely captures their password. > Capturing root passwords from users 'su'-ing requires a *lot* > more advanced sniffer or cracker intervention. No, it only requires that someone sit down and decide to do it. Conceptually it isn't all that hard to look for "password" in a telnet stream, and keep the packets seen before and after that. The only protection for things like that is to use encryption for the session (ssh or kerberos), or use switches that greatly reduce the number of packets that can be seen from a given (hackers) computer. --- Garance Alistair Drosehn = gad@eclipse.acs.rpi.edu Senior Systems Programmer or drosih@rpi.edu Rensselaer Polytechnic Institute To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message