Full Disclosure mailing list archives
Re: distributing passwords to users
From: Gage Bystrom <themadichib0d () gmail com>
Date: Wed, 7 Dec 2011 00:38:09 -0800
O.o and you act like what he wants is a good thing? Getting /any/ service account with that file would be better than pillaging an entire server of ssh keys. With ssh keys you know you only got access to a few more servers on the network, maybe not even root or admin unless you got lucky and score the key used for root/admin for every single box. No, with that you score the entire clientele... Not to mention what you described is not what he is asking. He wants to distribute the passwords to multiple users(idc if they are hashed, encrypted or not, just minor details at this point). What you described is a centralized database. There's only one copy of the file, only one server that holds the goods, the rest can have tidbits and if compromised can do minimum damage. Coupled with the right motivations and logging then attacking the support group on the internal network gives you almost nothing. Conversely attacking a single user holding the password file for the OP is end game. You're simply not going to be able to secure multiple copies of the same file with different access controls(hey I used a textbook phrase :) ). The only alternative is to have one access control, or all users have the same permission. However that is also absurd, you're only multiplying your attack service with each added user. Maybe now ya see where I start wondering where the cognitive dissonance ought to be coming in for attempting what the OP is trying to do? I was wrong for assuming it should be obvious from the get go, but as you can see the ISP wasn't in the same boat he wants to board. They would be sitting in the crows nest wondering why the loonie on the deserted island was trying to paddle it home. Alright, I think I've been harsh enough on the poor OP, but I hope he understands that this is a classic case of "You're doing it wrong". He knows what needs to be done, but his method of doing so actively works against his goal. On Dec 6, 2011 10:51 PM, "James Condron" <james () zero-internet org uk> wrote:
An ISP I worked at stored logins for customer servers where the customer required us to be able to login to provide support. We used a webapp on our internal network with the relevant security accoutrements. Its pretty standard; you login, find the server you need credentials for and hit a button to either launch a putty session or an RDP session. You can also edit passwords or view for non-windows users. The reason tools exist is because there is a demand for them- hell, its a password safe. Perhaps OP should look at this type of solution. On Wed, Dec 7, 2011 at 6:28 AM, Gage Bystrom <themadichib0d () gmail com>wrote:I'm disturbed in the first place that you want to distribute password lists to multiple users. I'm disturbed more so that there is no apparent cognitive dissonance preventing you from functioning enough to have sent that email. Someone please tell me that I'm not the only one disturbed here? And if I am, point to me why please? On Mon, Dec 5, 2011 at 7:30 PM, G V <gvasiliu () gmail com> wrote:Hi, From your experience, what's the best secure and easy way to update a password list and distribute it to 1000 or so unix users? The users would have different privilege levels and different access on network. Throwing ideas, I can think of: pgp (difficult to maintain a separate file for each user), web app (would need to be sucured over ssl, possible password protected), usb disks (difficult to manage changes). Anyone using an enterprise level app (commercial or not) to "share" passwords to users, manage changes and so on? Any other ideas I can use? Thank you, George Vasiliu ------------------------------------------------------------------------ Securing Apache Web Server with thawte Digital Certificate In this guide we examine the importance of Apache-SSL and who needs anSSL certificate. We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1------------------------------------------------------------------------_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: distributing passwords to users Gage Bystrom (Dec 06)
- Message not available
- Re: distributing passwords to users Gage Bystrom (Dec 07)
- Re: distributing passwords to users Martijn Broos (Dec 07)
- Re: distributing passwords to users Gage Bystrom (Dec 07)
- Re: distributing passwords to users Gage Bystrom (Dec 07)
- Message not available