Re: ssh with diskless machines

On Wed, Mar 19, 2003 at 10:35:33AM +0100, Peter wrote:
> Hi there,

That's why it is harder to do. You can't do any authentication until the user logs in.

> How about creating a dedicated user and using `su' to retrieve the

*smile*
You don't seem to get it. If the remote machine can't store a secret (or get it from some non-networked resource, like the human user example), the game is over.

Think about your black hat's attack in this case. We have changed the problem from stealing the host keys via NFS to stealing the keyper user's private key via NFS. The black hat steals the keyper private key, grabs the host keys, and we're back where we started.

There is not a way around it. You can not do digital network authentication without a secret.

-- 
Crist J. Clark                     |     cjclark@alum.mit.edu
                                   |     cjclark@jhu.edu
http://people.freebsd.org/~cjc/    |     
cjc(at)freebsd.org