On Wed, 18 Nov 1998, Cy Schubert wrote: |You can also issue sudo -k to delete the sudo ticket before running |something potentially dangerous. | |The problem you discuss is also an issue with Kerberos. Any potential |attacker could use cached Kerberos tickets to gain access to hosts, |services, or privileges. To circumvent this, kdestroy your Kerberos |ticket or log in as a different user. | The same problem exists in NIS+ environment. Attacker can get right credentials by issuing a command under already authenticated UID, because all credentials (public and decryptded secret keys) are cached by keyserv daemon and "indexed" by UID. The only way to get rid of those cached information is to run keylogout command.
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:23:55 PDT